Add stale PR refs cleanup to iOS addressables build

Same fix as mac_build - prune stale PR refs before checkout to prevent
"Could not scan for Git LFS files" errors on self-hosted runners.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitattributes

@@ -10,3 +10,4 @@
 src/main/csharp/**/GUI[[:space:]]Pro[[:space:]]Kit*/**/*.ttf !filter !diff !merge
 src/main/csharp/**/Modern[[:space:]]UI[[:space:]]Pack/**/*.ttf !filter !diff !merge
 *.herodata filter=lfs diff=lfs merge=lfs -text
+*.ogg filter=lfs diff=lfs merge=lfs -text

.github/workflows/artifact_storage_check.yml

@@ -0,0 +1,39 @@
+name: Artifact Storage Check
+
+on:
+  schedule:
+    # Run every 6 hours
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+jobs:
+  check-storage:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check artifact storage size
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Calculate total artifact storage
+          total_bytes=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
+            --paginate -q '.artifacts[].size_in_bytes' | awk '{sum+=$1} END {print sum}')
+
+          total_mb=$((total_bytes / 1024 / 1024))
+          echo "Total artifact storage: ${total_mb} MB"
+
+          # Fail if over 500MB
+          if [ "$total_mb" -gt 500 ]; then
+            echo "::error::Artifact storage is ${total_mb} MB, which exceeds the 500 MB threshold!"
+            echo ""
+            echo "Largest artifacts:"
+            # Save to temp file to avoid SIGPIPE/broken pipe errors with head
+            gh api "repos/${{ github.repository }}/actions/artifacts" \
+              --paginate -q '.artifacts[] | "\(.size_in_bytes)\t\(.name)\t\(.created_at)"' > /tmp/artifacts.txt
+            sort -rn /tmp/artifacts.txt | head -20 | \
+              awk -F'\t' '{printf "%d MB\t%s\t%s\n", $1/1024/1024, $2, $3}'
+            rm -f /tmp/artifacts.txt
+            exit 1
+          fi
+
+          echo "Storage is within acceptable limits."

.github/workflows/auth_build.yml

@@ -9,6 +9,7 @@ on:
       - 'src/main/protobuf/net/eagle0/eagle/api/auth.proto'
       - 'src/main/protobuf/net/eagle0/eagle/api/admin/**'
       - 'src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
+      - 'src/main/resources/net/eagle0/attributions.json'
       - 'ci/BUILD.bazel'
       - '.github/workflows/auth_build.yml'
   workflow_dispatch:
@@ -24,7 +25,7 @@ permissions:
 
 jobs:
   build-auth:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     outputs:
       image_tag: ${{ steps.push-auth.outputs.image_tag }}
     steps:
@@ -104,6 +105,14 @@ jobs:
       DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
       GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
       GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+      GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
+      GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
+      APPLE_SIGNIN_CLIENT_ID: ${{ secrets.APPLE_SIGNIN_CLIENT_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_SIGNIN_KEY_ID: ${{ secrets.APPLE_SIGNIN_KEY_ID }}
+      APPLE_SIGNIN_PRIVATE_KEY: ${{ secrets.APPLE_SIGNIN_PRIVATE_KEY }}
+      TWITCH_CLIENT_ID: ${{ secrets.TWITCH_CLIENT_ID }}
+      TWITCH_CLIENT_SECRET: ${{ secrets.TWITCH_CLIENT_SECRET }}
       JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
       FASTMAIL_API_TOKEN: ${{ secrets.FASTMAIL_API_TOKEN }}
       FASTMAIL_FROM_EMAIL: ${{ secrets.FASTMAIL_FROM_EMAIL }}
@@ -112,16 +121,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Copy update-env script to server
-        uses: appleboy/scp-action@v0.1.7
-        with:
-          host: ${{ secrets.DO_DROPLET_IP }}
-          username: deploy
-          key: ${{ secrets.DO_SSH_KEY }}
-          source: "deploy/update-env.sh,deploy/env.template"
-          target: /opt/eagle0/
-          strip_components: 1
-
       - name: Deploy auth service to production
         uses: appleboy/ssh-action@v1.0.3
         with:
@@ -129,51 +128,75 @@ jobs:
           username: deploy
           key: ${{ secrets.DO_SSH_KEY }}
           script_stop: true
-          envs: AUTH_IMAGE,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,JWT_PRIVATE_KEY,FASTMAIL_API_TOKEN,FASTMAIL_FROM_EMAIL,FASTMAIL_FROM_NAME
+          envs: AUTH_IMAGE,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,GH_OAUTH_CLIENT_ID,GH_OAUTH_CLIENT_SECRET,APPLE_SIGNIN_CLIENT_ID,APPLE_TEAM_ID,APPLE_SIGNIN_KEY_ID,APPLE_SIGNIN_PRIVATE_KEY,TWITCH_CLIENT_ID,TWITCH_CLIENT_SECRET,JWT_PRIVATE_KEY,FASTMAIL_API_TOKEN,FASTMAIL_FROM_EMAIL,FASTMAIL_FROM_NAME
           script: |
             set -x
             cd /opt/eagle0
 
-            # Update env vars using shared script (preserves vars set by other workflows)
-            chmod +x update-env.sh
-            ./update-env.sh \
-              "AUTH_IMAGE=${AUTH_IMAGE}" \
-              "DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID}" \
-              "DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET}" \
-              "GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}" \
-              "GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}" \
-              "JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY}" \
-              "FASTMAIL_API_TOKEN=${FASTMAIL_API_TOKEN}" \
-              "FASTMAIL_FROM_EMAIL=${FASTMAIL_FROM_EMAIL}" \
-              "FASTMAIL_FROM_NAME=${FASTMAIL_FROM_NAME}"
+            # Export env vars for docker compose (appleboy/ssh-action sets them but doesn't export)
+            export AUTH_IMAGE="${AUTH_IMAGE}"
+            export DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
+            export DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
+            export GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
+            export GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
+            export GH_OAUTH_CLIENT_ID="${GH_OAUTH_CLIENT_ID}"
+            export GH_OAUTH_CLIENT_SECRET="${GH_OAUTH_CLIENT_SECRET}"
+            export APPLE_SIGNIN_CLIENT_ID="${APPLE_SIGNIN_CLIENT_ID}"
+            export APPLE_TEAM_ID="${APPLE_TEAM_ID}"
+            export APPLE_SIGNIN_KEY_ID="${APPLE_SIGNIN_KEY_ID}"
+            export APPLE_SIGNIN_PRIVATE_KEY="${APPLE_SIGNIN_PRIVATE_KEY}"
+            export TWITCH_CLIENT_ID="${TWITCH_CLIENT_ID}"
+            export TWITCH_CLIENT_SECRET="${TWITCH_CLIENT_SECRET}"
+            export JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
+            export FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
+            export FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
+            export FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
 
             # Login to registry
             echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "${{ secrets.DO_REGISTRY_TOKEN }}" --password-stdin
 
             echo "Deploying auth service: $AUTH_IMAGE"
 
-            # Use crane to pull image
-            echo "Installing crane..."
-            curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
-            chmod +x crane
+            # Pull the image directly (docker is already logged in)
+            echo "Pulling Auth image..."
+            docker pull "${AUTH_IMAGE}" || { echo "ERROR: Failed to pull auth image"; exit 1; }
 
-            echo "Pulling Auth image with crane..."
-            ./crane pull "${AUTH_IMAGE}" auth.tar || { echo "ERROR: Failed to pull auth image"; exit 1; }
-            echo "Loading Auth image into Docker..."
-            docker load -i auth.tar
-            rm auth.tar
-            rm ./crane
+            # Tag as :latest locally so any fallback uses correct image
+            docker tag "${AUTH_IMAGE}" registry.digitalocean.com/eagle0/auth-server:latest
 
-            # Only recreate the auth container (not eagle, shardok, etc.)
-            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate auth
+            # Debug: check environment and .env file
+            echo "DEBUG: AUTH_IMAGE=$AUTH_IMAGE"
+            env | grep AUTH || echo "AUTH_IMAGE not in env output"
+            if [ -f .env ]; then
+              echo "DEBUG: .env file contents related to AUTH:"
+              grep AUTH .env || echo "No AUTH in .env"
+            fi
+
+            # Recreate auth container - pass AUTH_IMAGE explicitly on command line
+            AUTH_IMAGE="${AUTH_IMAGE}" docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate auth
 
             # Wait for health check
             sleep 5
-            docker compose -f docker-compose.prod.yml ps auth
 
-            # Verify container is using correct image
+            # Verify container is using the correct image
+            # Note: docker-compose may use :latest tag (which we tagged to the correct image)
             echo "=== Verifying auth container image ==="
-            docker compose -f docker-compose.prod.yml images auth
+            RUNNING_IMAGE=$(docker inspect auth-server --format '{{.Config.Image}}')
+            RUNNING_DIGEST=$(docker inspect auth-server --format '{{.Image}}')
+            EXPECTED_DIGEST=$(docker inspect "${AUTH_IMAGE}" --format '{{.Id}}')
+            echo "Expected image: ${AUTH_IMAGE}"
+            echo "Running image:  ${RUNNING_IMAGE}"
+            echo "Expected digest: ${EXPECTED_DIGEST}"
+            echo "Running digest:  ${RUNNING_DIGEST}"
+
+            if [ "$RUNNING_DIGEST" != "$EXPECTED_DIGEST" ]; then
+              echo "ERROR: Container is running wrong image!"
+              exit 1
+            fi
+            echo "Image digests match - correct image is running"
+
+            # Show container status
+            docker compose -f docker-compose.prod.yml ps auth
 
             # Cleanup old images
             docker image prune -f

.github/workflows/bazel_cache_cleanup.yml

@@ -0,0 +1,36 @@
+name: Bazel Cache Cleanup
+
+on:
+  schedule:
+    # Run weekly on Sunday at 00:00 UTC
+    - cron: '0 0 * * 0'
+  workflow_dispatch:  # Allow manual trigger
+
+jobs:
+  cleanup:
+    runs-on: [self-hosted, bazel]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Show disk usage before cleanup
+        run: |
+          echo "=== Disk usage before cleanup ==="
+          BAZEL_USER_ROOT="/private/var/tmp/_bazel_$(whoami)"
+          echo "Bazel user root: $BAZEL_USER_ROOT"
+          du -sh "$BAZEL_USER_ROOT" 2>/dev/null || echo "Not found"
+          df -h .
+
+      - name: Run bazel clean
+        run: |
+          echo "=== Running bazel clean ==="
+          bazel clean
+          echo "Clean complete"
+
+      - name: Show disk usage after cleanup
+        run: |
+          echo "=== Disk usage after cleanup ==="
+          BAZEL_USER_ROOT="/private/var/tmp/_bazel_$(whoami)"
+          du -sh "$BAZEL_USER_ROOT" 2>/dev/null || echo "Not found"
+          df -h .

.github/workflows/bazel_test.yml

@@ -26,16 +26,16 @@ permissions:
 
 jobs:
   test:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
       with:
         lfs: false
+    - name: Check BUILD.bazel dependencies
+      run: ./scripts/check_build_deps.sh --strict
     - name: Run tests
-      id: test
-      continue-on-error: true
       run: bazel test --build_event_json_file=test.json //src/test/... //src/main/go/...
     - name: Collect failed test logs
       if: always()
@@ -75,6 +75,7 @@ jobs:
       with:
         name: test.json
         path: test.json
+        retention-days: 5
     - name: Archive failed test logs
       if: always()
       uses: actions/upload-artifact@v4
@@ -82,6 +83,4 @@ jobs:
         name: failed-test-logs
         path: failed_test_logs/
         if-no-files-found: ignore
-    - name: Fail if tests failed
-      if: steps.test.outcome == 'failure'
-      run: exit 1
+        retention-days: 5

.github/workflows/build_protos_test.yml

@@ -1,21 +0,0 @@
-name: Build Protos
-
-on:
-  pull_request:
-    paths:
-      - "src/main/protobuf/**"
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: self-hosted
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-      - name: Run tests
-        run: ./scripts/build_protos.sh

.github/workflows/build_sysroot.yml

@@ -37,6 +37,7 @@ jobs:
         with:
           name: ubuntu-noble-sysroot-amd64
           path: tools/sysroot/output/
+          retention-days: 1
 
       - name: Install AWS CLI
         run: |
@@ -98,6 +99,7 @@ jobs:
         with:
           name: ubuntu-noble-sysroot-arm64
           path: tools/sysroot/output/
+          retention-days: 1
 
       - name: Install AWS CLI
         run: |

.github/workflows/client_presigner.yml

@@ -1,35 +0,0 @@
-name: Client Presigner
-
-on:
-  push:
-    branches: [ "main" ]
-    paths:
-      - ".github/workflows/client_presigner.yml"
-      - "src/main/go/net/eagle0/client_download/**"
-      - "src/main/go/net/eagle0/util/**"
-  pull_request:
-    paths:
-      - ".github/workflows/client_presigner.yml"
-      - "src/main/go/net/eagle0/client_download/**"
-      - "src/main/go/net/eagle0/util/**"
-
-permissions:
-  contents: read
-
-jobs:
-  client-presigner:
-    runs-on: self-hosted
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          lfs: false
-          clean: false
-      - name: Build Client Presigner
-        run: bazel build --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //src/main/go/net/eagle0/client_download
-      - name: Archive presigner binary
-        if: success() || failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: client_download
-          path: bazel-bin/src/main/go/net/eagle0/client_download/client_download_/client_download

.github/workflows/docker_build.yml

@@ -4,10 +4,18 @@ on:
   push:
     branches: [ "main" ]
     paths:
-      - 'src/main/cpp/**'
+      # Note: C++ changes trigger shardok_arm64_build.yml instead
+      # Note: Auth changes trigger auth_build.yml instead
+      # Note: Windows installer changes trigger installer_build.yml instead
       - 'src/main/go/**'
+      - '!src/main/go/net/eagle0/authservice/**'
+      - '!src/main/go/net/eagle0/authcli/**'
+      - '!src/main/go/net/eagle0/clients/**'
       - 'src/main/scala/**'
       - 'src/main/protobuf/**'
+      - '!src/main/protobuf/net/eagle0/eagle/api/auth.proto'
+      - '!src/main/protobuf/net/eagle0/eagle/api/admin/**'
+      - '!src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
       - 'src/main/resources/**'
       - 'ci/BUILD.bazel'
       - 'MODULE.bazel'
@@ -22,37 +30,63 @@ on:
         default: 'false'
         type: boolean
 
+# Only allow one deployment at a time to prevent race conditions
+concurrency:
+  group: docker-build-deploy
+  cancel-in-progress: false  # Don't cancel running deployments, queue new ones
+
 permissions:
   contents: read
 
 jobs:
-  build-eagle:
-    runs-on: self-hosted
+  # Single consolidated build job - builds all images with one bazel invocation
+  # This uses 1 runner slot instead of 4, and Bazel parallelizes internally
+  # NOTE: Must run on a runner with the bazel label to ensure consistent Bazel cache
+  build-all:
+    runs-on: [self-hosted, bazel]
     outputs:
-      image_tag: ${{ steps.push-eagle.outputs.image_tag }}
+      eagle_image_tag: ${{ steps.push-images.outputs.eagle_image_tag }}
+      admin_image_tag: ${{ steps.push-images.outputs.admin_image_tag }}
+      jfr_sidecar_image_tag: ${{ steps.push-images.outputs.jfr_sidecar_image_tag }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           lfs: false
 
-      - name: Build Eagle Docker image
-        id: build-eagle
+      - name: Build all Docker images
+        id: build-all
         run: |
           set -ex
-          bazel build --platforms=//:linux_x86_64 //ci:eagle_server_image
 
-          # Also build the warmup tool for Linux
-          bazel build //src/main/go/net/eagle0/warmup:warmup_linux_amd64
+          # Build ALL images in a single bazel command - Bazel parallelizes internally
+          # Note: Shardok is built separately for ARM64 and deployed to Hetzner
+          echo "=== Building Docker images ==="
+          bazel build \
+            --platforms=//:linux_x86_64 \
+            --extra_toolchains=@llvm_toolchain_linux//:all \
+            //ci:eagle_server_image \
+            //ci:admin_server_image \
+            //ci:jfr_sidecar_image \
+            //ci:warmup_tar
 
-          # Copy warmup binary to scripts/ so it gets deployed with other scripts
+          # Extract warmup binary from tar for deployment
           mkdir -p scripts/bin
-          cp bazel-bin/src/main/go/net/eagle0/warmup/warmup_linux_amd64_/warmup_linux_amd64 scripts/bin/warmup
+          tar -xf bazel-bin/ci/warmup_tar.tar -C scripts/bin --strip-components=1
 
-          # Save the resolved path before any other bazel command changes bazel-bin symlink
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/eagle_server_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
+          # Save all image paths before any other bazel command changes bazel-bin symlink
+          EAGLE_PATH=$(readlink -f bazel-bin/ci/eagle_server_image)
+          ADMIN_PATH=$(readlink -f bazel-bin/ci/admin_server_image)
+          JFR_PATH=$(readlink -f bazel-bin/ci/jfr_sidecar_image)
+
+          echo "eagle_path=$EAGLE_PATH" >> $GITHUB_OUTPUT
+          echo "admin_path=$ADMIN_PATH" >> $GITHUB_OUTPUT
+          echo "jfr_path=$JFR_PATH" >> $GITHUB_OUTPUT
+
+          echo "=== Image paths ==="
+          echo "Eagle: $EAGLE_PATH"
+          echo "Admin: $ADMIN_PATH"
+          echo "JFR Sidecar: $JFR_PATH"
 
       - name: Login to DigitalOcean Container Registry
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
@@ -62,382 +96,73 @@ jobs:
           mkdir -p ~/.docker
           AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
           echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          # Also set for current directory in case Bazel uses different home
           mkdir -p .docker
           cp ~/.docker/config.json .docker/
 
-      - name: Push Eagle image to DO registry
-        id: push-eagle
+      - name: Push all images to DO registry
+        id: push-images
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
         env:
           DOCKER_CONFIG: ${{ github.workspace }}/.docker
         run: |
           set -ex
 
-          # Use cross-compiled image path from build step
-          EAGLE_IMAGE="${{ steps.build-eagle.outputs.image_path }}"
-          echo "Using Eagle image: $EAGLE_IMAGE"
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
 
-          if [ -z "$EAGLE_IMAGE" ] || [ ! -d "$EAGLE_IMAGE" ]; then
-            echo "ERROR: Eagle image not found at: $EAGLE_IMAGE"
-            exit 1
-          fi
-
-          # Debug: show OCI layout contents
-          echo "=== OCI Layout Contents ==="
-          cat "$EAGLE_IMAGE/index.json"
-          echo ""
-          echo "=== Blobs ==="
-          ls -la "$EAGLE_IMAGE/blobs/sha256/" | head -20
-
-          # Verify OCI layout consistency before pushing
-          echo "=== Verifying OCI layout consistency ==="
-          for digest in $(cat "$EAGLE_IMAGE/index.json" | grep -o '"sha256:[^"]*"' | tr -d '"'); do
-            blob_path="$EAGLE_IMAGE/blobs/${digest/://}"
-            if [ ! -f "$blob_path" ]; then
-              echo "ERROR: Blob not found: $blob_path"
-              exit 1
-            fi
-            actual_digest="sha256:$(shasum -a 256 "$blob_path" | cut -d' ' -f1)"
-            if [ "$digest" != "$actual_digest" ]; then
-              echo "ERROR: Digest mismatch for $blob_path"
-              echo "  Index says: $digest"
-              echo "  Actual: $actual_digest"
-              exit 1
-            fi
-            echo "✓ Verified: $digest"
-          done
-
-          # Build the push target to get crane in runfiles
+          # Get crane from push target runfiles
           bazel build //ci:eagle_server_push
-
-          # Use crane directly for push (avoids OCI->Docker digest mismatch)
           CRANE="bazel-bin/ci/push_eagle_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
-          echo "Using crane: $CRANE"
 
-          # Push with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/eagle-server:${GIT_SHA}"
-          echo "Pushing eagle image: $IMAGE_TAG"
-          $CRANE push "$EAGLE_IMAGE" "$IMAGE_TAG"
-
-          # Verify push by checking what's in the registry
-          echo "=== Verifying push ==="
-          $CRANE manifest "$IMAGE_TAG" | head -50
-          PUSHED_DIGEST=$($CRANE digest "$IMAGE_TAG")
-          echo "Registry reports digest: $PUSHED_DIGEST"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience (but deploy won't use it)
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/eagle-server:latest"
-
-  build-shardok:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-shardok.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build Shardok binary (cross-compile for Linux)
-        run: |
-          set -ex
-
-          # Step 1: Build JUST the binary with cross-compilation
-          # We need --extra_toolchains to force the Linux toolchain to be used
-          # because toolchains_llvm registers with dev_dependency=True
-          echo "=== Building shardok-server binary for linux-x86_64 ==="
-          bazel build \
-            --platforms=//:linux_x86_64 \
-            --extra_toolchains=@llvm_toolchain_linux//:all \
-            //src/main/cpp/net/eagle0/shardok:shardok-server
-
-          # Step 2: Check the binary directly from bazel-bin
-          # bazel-bin is a symlink that points to the correct output directory
-          LINUX_BIN="bazel-bin/src/main/cpp/net/eagle0/shardok/shardok-server"
-          echo "=== Checking binary at: $LINUX_BIN ==="
-
-          if [ ! -f "$LINUX_BIN" ]; then
-            echo "ERROR: Binary not found at $LINUX_BIN"
-            exit 1
+          if [ ! -e "$CRANE" ]; then
+            # Fallback: find any Darwin crane
+            RUNFILES="bazel-bin/ci/push_eagle_server_push.sh.runfiles"
+            CRANE=$(find "$RUNFILES" -path "*darwin*" -name crane 2>/dev/null | head -1)
           fi
 
-          # Debug: show what bazel-bin points to
-          echo "bazel-bin symlink target: $(readlink bazel-bin || echo 'not a symlink')"
-
-          # Step 3: Verify it's ELF (Linux) not Mach-O (macOS)
-          echo "=== Verifying binary format ==="
-          MAGIC=$(head -c 4 "$LINUX_BIN" | xxd -p)
-          echo "Binary magic bytes: $MAGIC"
-
-          if [ "$MAGIC" = "7f454c46" ]; then
-            echo "SUCCESS: Binary is ELF format (Linux)"
-          elif [ "$MAGIC" = "cfaeedfe" ] || [ "$MAGIC" = "cffaedfe" ]; then
-            echo "ERROR: Binary is Mach-O format (macOS) - cross-compilation failed!"
-            echo ""
-            echo "Debug info:"
-            echo "- bazel-bin points to: $(readlink bazel-bin)"
-            file "$LINUX_BIN" || true
-            exit 1
-          else
-            echo "WARNING: Unknown binary format: $MAGIC"
-            file "$LINUX_BIN" || true
-          fi
-
-      - name: Build Shardok Docker image
-        id: build-shardok
-        run: |
-          set -ex
-
-          # Build the OCI image with cross-compilation flags
-          bazel build \
-            --platforms=//:linux_x86_64 \
-            --extra_toolchains=@llvm_toolchain_linux//:all \
-            //ci:shardok_server_image
-
-          # The image is output to bazel-bin which is a symlink.
-          # Resolve it now before any other bazel commands change where it points.
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/shardok_server_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-          # Verify the binary inside the tar layer is ELF
-          echo "=== Verifying binary in image tar ==="
-          BINARY_TAR="bazel-bin/ci/shardok_binary_layer.tar"
-          if [ -f "$BINARY_TAR" ]; then
-            echo "Checking binary in $BINARY_TAR"
-            # Extract just the first 4 bytes of the binary from the tar
-            MAGIC=$(tar -xOf "$BINARY_TAR" app/shardok-server 2>/dev/null | head -c 4 | xxd -p)
-            echo "Binary magic in tar: $MAGIC"
-            if [ "$MAGIC" = "7f454c46" ]; then
-              echo "SUCCESS: Binary in tar is ELF format (Linux)"
-            else
-              echo "ERROR: Binary in tar is NOT ELF format!"
-              echo "This means pkg_tar is packaging the wrong binary."
-              exit 1
-            fi
-          else
-            echo "WARNING: Could not find $BINARY_TAR"
-          fi
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          # Also set for current directory in case Bazel uses different home
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push Shardok image to DO registry
-        id: push-shardok
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          # Use cross-compiled image path from build step
-          CROSS_IMAGE="${{ steps.build-shardok.outputs.image_path }}"
-          echo "Using cross-compiled image: $CROSS_IMAGE"
-
-          if [ -z "$CROSS_IMAGE" ] || [ ! -d "$CROSS_IMAGE" ]; then
-            echo "ERROR: Cross-compiled image not found at: $CROSS_IMAGE"
-            exit 1
-          fi
-
-          # Get crane from Eagle push target (which doesn't need cross-compilation)
-          # This gives us a macOS crane binary we can actually run.
-          # We can't build shardok_server_push with platform flags because it would
-          # download a Linux crane that can't run on macOS.
-          bazel build //ci:eagle_server_push
-
-          # Find the Darwin crane binary (may be a symlink)
-          RUNFILES="bazel-bin/ci/push_eagle_server_push.sh.runfiles"
-          CRANE=$(find "$RUNFILES" -path "*darwin*" -name crane 2>/dev/null | head -1)
-          if [ -z "$CRANE" ]; then
-            # Fallback to any crane
-            CRANE=$(find "$RUNFILES" -name crane 2>/dev/null | head -1)
-          fi
           if [ -z "$CRANE" ] || [ ! -e "$CRANE" ]; then
-            echo "ERROR: crane not found. Listing runfiles:"
-            find "$RUNFILES" -name crane 2>/dev/null || true
+            echo "ERROR: crane not found"
             exit 1
           fi
           echo "Using crane: $CRANE"
 
-          # Push the cross-compiled image with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/shardok-server:${GIT_SHA}"
-          echo "Pushing shardok image: $IMAGE_TAG"
-          $CRANE push "$CROSS_IMAGE" "$IMAGE_TAG"
+          # Push Eagle image
+          EAGLE_IMAGE="${{ steps.build-all.outputs.eagle_path }}"
+          EAGLE_TAG="registry.digitalocean.com/eagle0/eagle-server:${GIT_SHA}"
+          echo "Pushing Eagle: $EAGLE_TAG"
+          $CRANE push "$EAGLE_IMAGE" "$EAGLE_TAG"
+          $CRANE copy "$EAGLE_TAG" "registry.digitalocean.com/eagle0/eagle-server:latest"
+          echo "eagle_image_tag=$EAGLE_TAG" >> $GITHUB_OUTPUT
 
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+          # Push Admin image
+          ADMIN_IMAGE="${{ steps.build-all.outputs.admin_path }}"
+          ADMIN_TAG="registry.digitalocean.com/eagle0/admin-server:${GIT_SHA}"
+          echo "Pushing Admin: $ADMIN_TAG"
+          $CRANE push "$ADMIN_IMAGE" "$ADMIN_TAG"
+          $CRANE copy "$ADMIN_TAG" "registry.digitalocean.com/eagle0/admin-server:latest"
+          echo "admin_image_tag=$ADMIN_TAG" >> $GITHUB_OUTPUT
 
-          # Also update :latest for convenience (but deploy won't use it)
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/shardok-server:latest"
+          # Push JFR Sidecar image
+          JFR_IMAGE="${{ steps.build-all.outputs.jfr_path }}"
+          JFR_TAG="registry.digitalocean.com/eagle0/jfr-sidecar:${GIT_SHA}"
+          echo "Pushing JFR Sidecar: $JFR_TAG"
+          $CRANE push "$JFR_IMAGE" "$JFR_TAG"
+          $CRANE copy "$JFR_TAG" "registry.digitalocean.com/eagle0/jfr-sidecar:latest"
+          echo "jfr_sidecar_image_tag=$JFR_TAG" >> $GITHUB_OUTPUT
 
-  build-admin:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-admin.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build Admin Server Docker image
-        id: build-admin
-        run: |
-          set -ex
-
-          # Build admin server image (Go binary has explicit goos/goarch in BUILD.bazel)
-          bazel build //ci:admin_server_image
-
-          # Save the resolved path before any other bazel command changes bazel-bin symlink
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/admin_server_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push Admin image to DO registry
-        id: push-admin
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          ADMIN_IMAGE="${{ steps.build-admin.outputs.image_path }}"
-          echo "Using Admin image: $ADMIN_IMAGE"
-
-          if [ -z "$ADMIN_IMAGE" ] || [ ! -d "$ADMIN_IMAGE" ]; then
-            echo "ERROR: Admin image not found at: $ADMIN_IMAGE"
-            exit 1
-          fi
-
-          # Build the push target to get crane in runfiles
-          bazel build //ci:admin_server_push
-
-          # Use crane directly for push
-          CRANE="bazel-bin/ci/push_admin_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
-          echo "Using crane: $CRANE"
-
-          # Push with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/admin-server:${GIT_SHA}"
-          echo "Pushing admin image: $IMAGE_TAG"
-          $CRANE push "$ADMIN_IMAGE" "$IMAGE_TAG"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/admin-server:latest"
-
-  build-jfr-sidecar:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-jfr-sidecar.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build JFR Sidecar Docker image
-        id: build-jfr-sidecar
-        run: |
-          set -ex
-
-          # Build JFR sidecar image (Go binary has explicit goos/goarch in BUILD.bazel)
-          bazel build //ci:jfr_sidecar_image
-
-          # Save the resolved path before any other bazel command changes bazel-bin symlink
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/jfr_sidecar_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push JFR Sidecar image to DO registry
-        id: push-jfr-sidecar
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          JFR_IMAGE="${{ steps.build-jfr-sidecar.outputs.image_path }}"
-          echo "Using JFR Sidecar image: $JFR_IMAGE"
-
-          if [ -z "$JFR_IMAGE" ] || [ ! -d "$JFR_IMAGE" ]; then
-            echo "ERROR: JFR Sidecar image not found at: $JFR_IMAGE"
-            exit 1
-          fi
-
-          # Build the push target to get crane in runfiles
-          bazel build //ci:jfr_sidecar_push
-
-          # Use crane directly for push
-          CRANE="bazel-bin/ci/push_jfr_sidecar_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
-          echo "Using crane: $CRANE"
-
-          # Push with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/jfr-sidecar:${GIT_SHA}"
-          echo "Pushing JFR sidecar image: $IMAGE_TAG"
-          $CRANE push "$JFR_IMAGE" "$IMAGE_TAG"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/jfr-sidecar:latest"
+          echo "=== All images pushed successfully ==="
 
   deploy:
-    runs-on: self-hosted
-    needs: [build-eagle, build-shardok, build-admin, build-jfr-sidecar]
+    runs-on: [self-hosted, bazel]
+    needs: [build-all]
     if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
     environment: production
     env:
-      EAGLE_IMAGE: ${{ needs.build-eagle.outputs.image_tag }}
-      SHARDOK_IMAGE: ${{ needs.build-shardok.outputs.image_tag }}
-      ADMIN_IMAGE: ${{ needs.build-admin.outputs.image_tag }}
-      JFR_SIDECAR_IMAGE: ${{ needs.build-jfr-sidecar.outputs.image_tag }}
+      EAGLE_IMAGE: ${{ needs.build-all.outputs.eagle_image_tag }}
+      ADMIN_IMAGE: ${{ needs.build-all.outputs.admin_image_tag }}
+      JFR_SIDECAR_IMAGE: ${{ needs.build-all.outputs.jfr_sidecar_image_tag }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
       GPT_MODEL_NAME: ${{ secrets.GPT_MODEL_NAME }}
       EAGLE_ENABLE_S3: ${{ secrets.EAGLE_ENABLE_S3 }}
       DO_SPACES_ACCESS_KEY: ${{ secrets.DO_SPACES_ACCESS_KEY }}
@@ -447,6 +172,14 @@ jobs:
       DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
       GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
       GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+      GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
+      GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
+      APPLE_SIGNIN_CLIENT_ID: ${{ secrets.APPLE_SIGNIN_CLIENT_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_SIGNIN_KEY_ID: ${{ secrets.APPLE_SIGNIN_KEY_ID }}
+      APPLE_SIGNIN_PRIVATE_KEY: ${{ secrets.APPLE_SIGNIN_PRIVATE_KEY }}
+      TWITCH_CLIENT_ID: ${{ secrets.TWITCH_CLIENT_ID }}
+      TWITCH_CLIENT_SECRET: ${{ secrets.TWITCH_CLIENT_SECRET }}
       SHARDOK_ADDRESS: ${{ secrets.SHARDOK_ADDRESS }}
       SHARDOK_AUTH_TOKEN: ${{ secrets.SHARDOK_AUTH_TOKEN }}
       SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
@@ -455,6 +188,7 @@ jobs:
       FASTMAIL_FROM_NAME: ${{ secrets.FASTMAIL_FROM_NAME }}
       DO_DROPLET_IP: ${{ secrets.DO_DROPLET_IP }}
       DO_REGISTRY_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
+      NOTIFY_SECRET: ${{ secrets.EAGLE_NOTIFY_SECRET }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -468,28 +202,24 @@ jobs:
 
       - name: Build warmup tool
         run: |
-          bazel build //src/main/go/net/eagle0/warmup:warmup_linux_amd64
+          bazel build //ci:warmup_tar
           mkdir -p scripts/bin
-          cp bazel-bin/src/main/go/net/eagle0/warmup/warmup_linux_amd64_/warmup_linux_amd64 scripts/bin/warmup
+          tar -xf bazel-bin/ci/warmup_tar.tar -C scripts/bin --strip-components=1
 
       - name: Copy config files to droplet
         run: |
           # Create directory structure on remote
-          # Use -p to create parents, and test write access before copying
           ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" bash -s << 'SETUP_DIRS'
           set -e
-          mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx /opt/eagle0/deploy
-
-          # Remove existing warmup binary (it may have read-only permissions from bazel)
+          mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx
           rm -f /opt/eagle0/scripts/bin/warmup
           SETUP_DIRS
 
-          # Copy files preserving structure
+          # Copy files
           scp -i ~/.ssh/deploy_key docker-compose.prod.yml deploy@"$DO_DROPLET_IP":/opt/eagle0/
           scp -i ~/.ssh/deploy_key nginx/nginx.conf deploy@"$DO_DROPLET_IP":/opt/eagle0/nginx/
-          scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/
+          scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh scripts/eagle-exec.sh scripts/eagle-logs.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/
           scp -i ~/.ssh/deploy_key scripts/bin/warmup deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/bin/
-          scp -i ~/.ssh/deploy_key deploy/env.template deploy/update-env.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/deploy/
 
       - name: Deploy to production droplet
         run: |
@@ -497,156 +227,181 @@ jobs:
           set -ex
           cd /opt/eagle0
 
-          # Environment variables passed via heredoc
-          EAGLE_IMAGE="${EAGLE_IMAGE}"
-          SHARDOK_IMAGE="${SHARDOK_IMAGE}"
-          ADMIN_IMAGE="${ADMIN_IMAGE}"
-          JFR_SIDECAR_IMAGE="${JFR_SIDECAR_IMAGE}"
-          OPENAI_API_KEY="${OPENAI_API_KEY}"
-          GPT_MODEL_NAME="${GPT_MODEL_NAME}"
-          EAGLE_ENABLE_S3="${EAGLE_ENABLE_S3}"
-          DO_SPACES_ACCESS_KEY="${DO_SPACES_ACCESS_KEY}"
-          DO_SPACES_SECRET_KEY="${DO_SPACES_SECRET_KEY}"
-          JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
-          DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
-          DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
-          GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
-          GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
-          SHARDOK_ADDRESS="${SHARDOK_ADDRESS}"
-          SHARDOK_AUTH_TOKEN="${SHARDOK_AUTH_TOKEN}"
-          SENTRY_DSN="${SENTRY_DSN}"
-          FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
-          FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
-          FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
-          DO_REGISTRY_TOKEN="${DO_REGISTRY_TOKEN}"
+          # =================================================================
+          # CRITICAL: Validate environment variables before proceeding
+          # This catches GitHub Actions secret store hiccups early
+          # =================================================================
+          validate_env() {
+              local var_name="\$1"
+              local var_value="\$2"
+              local default_value="\${3:-}"
 
-          # Check Docker has IPv6 support for connecting to Hetzner Shardok
-          # (One-time setup: sudo tee /etc/docker/daemon.json <<< '{"ipv6": true, "ip6tables": true, "experimental": true, "fixed-cidr-v6": "fd00::/80"}' && sudo systemctl restart docker)
-          if ! cat /etc/docker/daemon.json 2>/dev/null | grep -q '"ip6tables"'; then
-            echo "WARNING: Docker IPv6 not configured. Eagle may not reach Hetzner Shardok."
-            echo "Run: sudo tee /etc/docker/daemon.json <<< '{\"ipv6\": true, \"ip6tables\": true, \"experimental\": true, \"fixed-cidr-v6\": \"fd00::/80\"}' && sudo systemctl restart docker"
+              if [ -z "\${var_value}" ]; then
+                  echo "ERROR: \${var_name} is empty. GitHub Actions secrets may have failed to load."
+                  echo "Please retry the workflow."
+                  return 1
+              fi
+
+              # Check if we got a default value instead of the real secret
+              if [ -n "\${default_value}" ] && [ "\${var_value}" = "\${default_value}" ]; then
+                  echo "ERROR: \${var_name} has default value '\${default_value}' instead of the actual secret."
+                  echo "This indicates GitHub Actions secrets failed to load. Please retry the workflow."
+                  return 1
+              fi
+
+              return 0
+          }
+
+          echo "Validating critical environment variables..."
+
+          # These are the raw values from GitHub Actions (before export)
+          # We check them before exporting to catch issues early
+          VALIDATION_FAILED=0
+
+          validate_env "SHARDOK_ADDRESS" "${SHARDOK_ADDRESS}" "" || VALIDATION_FAILED=1
+          validate_env "EAGLE_IMAGE" "${EAGLE_IMAGE}" "" || VALIDATION_FAILED=1
+          validate_env "JWT_PRIVATE_KEY" "${JWT_PRIVATE_KEY}" "" || VALIDATION_FAILED=1
+          validate_env "DO_REGISTRY_TOKEN" "${DO_REGISTRY_TOKEN}" "" || VALIDATION_FAILED=1
+
+          if [ "\${VALIDATION_FAILED}" -eq 1 ]; then
+              echo ""
+              echo "========================================="
+              echo "DEPLOYMENT ABORTED: Missing critical secrets"
+              echo "This is likely a transient GitHub Actions issue."
+              echo "Please retry the workflow."
+              echo "========================================="
+              exit 1
           fi
 
-          # Update env vars using shared script (preserves vars set by other workflows)
-          chmod +x update-env.sh
-          ./update-env.sh \
-            "EAGLE_IMAGE=\${EAGLE_IMAGE}" \
-            "SHARDOK_IMAGE=\${SHARDOK_IMAGE}" \
-            "ADMIN_IMAGE=\${ADMIN_IMAGE}" \
-            "JFR_SIDECAR_IMAGE=\${JFR_SIDECAR_IMAGE}" \
-            "OPENAI_API_KEY=\${OPENAI_API_KEY}" \
-            "GPT_MODEL_NAME=\${GPT_MODEL_NAME:-gpt-4o}" \
-            "EAGLE_ENABLE_S3=\${EAGLE_ENABLE_S3:-false}" \
-            "DO_SPACES_ACCESS_KEY=\${DO_SPACES_ACCESS_KEY}" \
-            "DO_SPACES_SECRET_KEY=\${DO_SPACES_SECRET_KEY}" \
-            "JWT_PRIVATE_KEY=\${JWT_PRIVATE_KEY}" \
-            "DISCORD_CLIENT_ID=\${DISCORD_CLIENT_ID}" \
-            "DISCORD_CLIENT_SECRET=\${DISCORD_CLIENT_SECRET}" \
-            "GOOGLE_CLIENT_ID=\${GOOGLE_CLIENT_ID}" \
-            "GOOGLE_CLIENT_SECRET=\${GOOGLE_CLIENT_SECRET}" \
-            "SHARDOK_ADDRESS=\${SHARDOK_ADDRESS:-shardok:40042}" \
-            "SHARDOK_AUTH_TOKEN=\${SHARDOK_AUTH_TOKEN}" \
-            "SENTRY_DSN=\${SENTRY_DSN}" \
-            "FASTMAIL_API_TOKEN=\${FASTMAIL_API_TOKEN}" \
-            "FASTMAIL_FROM_EMAIL=\${FASTMAIL_FROM_EMAIL}" \
-            "FASTMAIL_FROM_NAME=\${FASTMAIL_FROM_NAME}"
+          echo "All critical environment variables validated successfully."
+
+          # =================================================================
+          # Export environment variables for docker compose
+          # These are passed via heredoc and exported so child processes (docker compose) can access them
+          export EAGLE_IMAGE="${EAGLE_IMAGE}"
+          export ADMIN_IMAGE="${ADMIN_IMAGE}"
+          export JFR_SIDECAR_IMAGE="${JFR_SIDECAR_IMAGE}"
+          export OPENAI_API_KEY="${OPENAI_API_KEY}"
+          export ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}"
+          export GEMINI_API_KEY="${GEMINI_API_KEY}"
+          export GPT_MODEL_NAME="${GPT_MODEL_NAME:-gpt-4o}"
+          export EAGLE_ENABLE_S3="${EAGLE_ENABLE_S3:-false}"
+          export DO_SPACES_ACCESS_KEY="${DO_SPACES_ACCESS_KEY}"
+          export DO_SPACES_SECRET_KEY="${DO_SPACES_SECRET_KEY}"
+          export JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
+          export DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
+          export DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
+          export GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
+          export GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
+          export GH_OAUTH_CLIENT_ID="${GH_OAUTH_CLIENT_ID}"
+          export GH_OAUTH_CLIENT_SECRET="${GH_OAUTH_CLIENT_SECRET}"
+          export APPLE_SIGNIN_CLIENT_ID="${APPLE_SIGNIN_CLIENT_ID}"
+          export APPLE_TEAM_ID="${APPLE_TEAM_ID}"
+          export APPLE_SIGNIN_KEY_ID="${APPLE_SIGNIN_KEY_ID}"
+          export APPLE_SIGNIN_PRIVATE_KEY="${APPLE_SIGNIN_PRIVATE_KEY}"
+          export TWITCH_CLIENT_ID="${TWITCH_CLIENT_ID}"
+          export TWITCH_CLIENT_SECRET="${TWITCH_CLIENT_SECRET}"
+          export SHARDOK_ADDRESS="${SHARDOK_ADDRESS}"
+          export SHARDOK_AUTH_TOKEN="${SHARDOK_AUTH_TOKEN}"
+          export SENTRY_DSN="${SENTRY_DSN}"
+          export FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
+          export FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
+          export FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
+          export DO_REGISTRY_TOKEN="${DO_REGISTRY_TOKEN}"
+          export NOTIFY_SECRET="${NOTIFY_SECRET}"
+
+          # Check Docker has IPv6 support
+          if ! cat /etc/docker/daemon.json 2>/dev/null | grep -q '"ip6tables"'; then
+            echo "WARNING: Docker IPv6 not configured. Eagle may not reach Hetzner Shardok."
+          fi
 
           # Login to registry
           echo "\$DO_REGISTRY_TOKEN" | docker login registry.digitalocean.com -u "\$DO_REGISTRY_TOKEN" --password-stdin
 
-          # Use exact image tags passed from build jobs (no :latest fallback)
-          # Note: AUTH_IMAGE is managed separately by auth_build.yml
-          echo "Using images: \$EAGLE_IMAGE, \$SHARDOK_IMAGE, \$ADMIN_IMAGE, \$JFR_SIDECAR_IMAGE"
+          echo "Using images: \$EAGLE_IMAGE, \$ADMIN_IMAGE, \$JFR_SIDECAR_IMAGE"
 
-          # Use crane to pull images (handles OCI format correctly) then load into Docker
-          # This avoids digest mismatch from DO registry's OCI->Docker format conversion
+          # Install crane for pulling OCI images
           echo "Installing crane..."
           rm -f crane
           curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
           chmod +x crane
-          if [ ! -x crane ]; then
-            echo "ERROR: Failed to install crane"
-            ls -la crane || true
-            exit 1
-          fi
-          echo "Crane installed"
-          ls -la crane
 
-          # crane uses Docker config for auth
-          echo "Pulling Eagle image with crane..."
-          ./crane pull "\${EAGLE_IMAGE}" eagle.tar || { echo "ERROR: Failed to pull eagle image"; exit 1; }
-          echo "Loading Eagle image into Docker..."
-          docker load -i eagle.tar
-          rm eagle.tar
+          # Pull and load all images
+          echo "Pulling Eagle image..."
+          ./crane pull "\${EAGLE_IMAGE}" eagle.tar && docker load -i eagle.tar && rm eagle.tar
 
-          echo "Pulling Shardok image with crane..."
-          ./crane pull "\${SHARDOK_IMAGE}" shardok.tar || { echo "ERROR: Failed to pull shardok image"; exit 1; }
-          echo "Loading Shardok image into Docker..."
-          docker load -i shardok.tar
-          rm shardok.tar
+          echo "Pulling Admin image..."
+          ./crane pull "\${ADMIN_IMAGE}" admin.tar && docker load -i admin.tar && rm admin.tar
+          # Tag as :latest locally so docker-compose fallback uses correct image
+          docker tag "\${ADMIN_IMAGE}" registry.digitalocean.com/eagle0/admin-server:latest
 
-          echo "Pulling Admin image with crane..."
-          ./crane pull "\${ADMIN_IMAGE}" admin.tar || { echo "ERROR: Failed to pull admin image"; exit 1; }
-          echo "Loading Admin image into Docker..."
-          docker load -i admin.tar
-          rm admin.tar
+          echo "Pulling JFR Sidecar image..."
+          ./crane pull "\${JFR_SIDECAR_IMAGE}" jfr-sidecar.tar && docker load -i jfr-sidecar.tar && rm jfr-sidecar.tar
 
-          echo "Pulling JFR Sidecar image with crane..."
-          ./crane pull "\${JFR_SIDECAR_IMAGE}" jfr-sidecar.tar || { echo "ERROR: Failed to pull jfr-sidecar image"; exit 1; }
-          echo "Loading JFR Sidecar image into Docker..."
-          docker load -i jfr-sidecar.tar
-          rm jfr-sidecar.tar
-
-          # Keep crane for blue-green deploys (don't delete it)
-          echo "Crane kept at ./crane for future blue-green deploys"
-
-          # Also pull other compose images
+          # Pull other compose images
           docker pull nginx:alpine || true
           docker pull certbot/certbot || true
 
           echo "All images pulled successfully"
 
-          # Recreate non-Eagle services (not auth - managed by auth_build.yml)
-          # Note: jfr-sidecar must start after eagle-blue due to PID namespace sharing
-          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate shardok admin
+          # =================================================================
+          # Verify Shardok connectivity before proceeding with deployment
+          # This catches network/firewall issues early
+          # =================================================================
+          echo "Verifying Shardok connectivity..."
+          SHARDOK_HOST=\$(echo "\${SHARDOK_ADDRESS}" | cut -d: -f1)
+          SHARDOK_PORT=\$(echo "\${SHARDOK_ADDRESS}" | cut -d: -f2)
 
-          # Deploy Eagle with blue-green (zero-downtime) if scripts are available
-          if [ -x "/opt/eagle0/scripts/deploy-blue-green.sh" ]; then
-            echo "Using blue-green deployment for Eagle..."
-            chmod +x /opt/eagle0/scripts/*.sh
-            # Make warmup binary executable if present
-            if [ -f "/opt/eagle0/scripts/bin/warmup" ]; then
-              chmod +x /opt/eagle0/scripts/bin/warmup
-            fi
-            GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://')
-            /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}" || {
-              echo "Blue-green deployment failed, falling back to direct restart"
-              docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate eagle-blue
-            }
+          # Try to connect to Shardok (timeout after 10 seconds)
+          if nc -z -w 10 "\${SHARDOK_HOST}" "\${SHARDOK_PORT}" 2>/dev/null; then
+              echo "Shardok connectivity verified: \${SHARDOK_ADDRESS} is reachable"
           else
-            echo "Blue-green scripts not found, using direct restart..."
-            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate eagle-blue
+              echo ""
+              echo "========================================="
+              echo "ERROR: Cannot reach Shardok at \${SHARDOK_ADDRESS}"
+              echo "This may indicate:"
+              echo "  - Shardok server is not running on Hetzner"
+              echo "  - Network/firewall issues between DigitalOcean and Hetzner"
+              echo "  - Incorrect SHARDOK_ADDRESS configuration"
+              echo ""
+              echo "DEPLOYMENT ABORTED: Shardok must be reachable for battles to work."
+              echo "========================================="
+              exit 1
           fi
 
-          # Start jfr-sidecar after eagle-blue (shares PID namespace with eagle-blue)
-          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate jfr-sidecar
+          # Stop local shardok container if running (now runs on Hetzner)
+          docker stop shardok-server 2>/dev/null || true
+          docker rm shardok-server 2>/dev/null || true
 
-          # Ensure auth is running (but don't force-recreate it)
-          docker compose -f docker-compose.prod.yml up -d auth
+          # Deploy Eagle with blue-green (handles eagle, nginx, admin, jfr-sidecar)
+          # Note: Shardok runs on Hetzner, deployed separately via shardok_arm64_build.yml
+          # Note: Auth is deployed separately via auth_build.yml - do NOT touch auth here
+          chmod +x /opt/eagle0/scripts/*.sh
+          [ -f "/opt/eagle0/scripts/bin/warmup" ] && chmod +x /opt/eagle0/scripts/bin/warmup
+          GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://')
+          /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}"
 
-          # Restart nginx to pick up new container IPs
-          # (nginx caches DNS at startup, so it needs restart after eagle/shardok)
-          docker compose -f docker-compose.prod.yml up -d --force-recreate nginx
-
-          # Wait for health checks
+          # Verify
           sleep 10
           docker compose -f docker-compose.prod.yml ps
-
-          # Verify containers are using correct images
-          echo "=== Verifying container image tags ==="
           docker compose -f docker-compose.prod.yml images
 
-          # Cleanup stopped containers and old images
+          # Verify admin container is running the correct image
+          echo "=== Verifying admin container image ==="
+          ADMIN_RUNNING_DIGEST=\$(docker inspect admin-server --format '{{.Image}}')
+          ADMIN_EXPECTED_DIGEST=\$(docker inspect "\${ADMIN_IMAGE}" --format '{{.Id}}')
+          echo "Expected image: \${ADMIN_IMAGE}"
+          echo "Expected digest: \${ADMIN_EXPECTED_DIGEST}"
+          echo "Running digest:  \${ADMIN_RUNNING_DIGEST}"
+          if [ "\${ADMIN_RUNNING_DIGEST}" != "\${ADMIN_EXPECTED_DIGEST}" ]; then
+            echo "ERROR: Admin container is running wrong image!"
+            echo "Container entrypoint:"
+            docker inspect admin-server --format '{{.Config.Entrypoint}}'
+            exit 1
+          fi
+          echo "Admin image verification passed"
+
+          # Cleanup
           docker container prune -f
           docker image prune -f
           DEPLOY_SCRIPT

.github/workflows/eagle_build.yml

@@ -0,0 +1,37 @@
+name: Eagle Build
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'src/main/scala/**'
+      - 'src/main/protobuf/net/eagle0/eagle/**'
+      - 'src/main/protobuf/net/eagle0/common/**'
+      - 'WORKSPACE'
+      - 'MODULE.bazel'
+      - 'BUILD.bazel'
+      - '.github/workflows/eagle_build.yml'
+  pull_request:
+    paths:
+      - 'src/main/scala/**'
+      - 'src/main/protobuf/net/eagle0/eagle/**'
+      - 'src/main/protobuf/net/eagle0/common/**'
+      - 'WORKSPACE'
+      - 'MODULE.bazel'
+      - 'BUILD.bazel'
+      - '.github/workflows/eagle_build.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: [self-hosted, bazel]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+      - name: Build Eagle server
+        run: bazel build //src/main/scala/net/eagle0/eagle:eagle_server

.github/workflows/installer_build.yml

@@ -5,18 +5,20 @@ on:
     branches: [ "main" ]
     paths:
       - ".github/workflows/installer_build.yml"
-      - "src/main/csharp/net/eagle0/clients/win/installer/**"
+      - "src/main/go/net/eagle0/clients/win/installer/**"
   pull_request:
     paths:
       - ".github/workflows/installer_build.yml"
-      - "src/main/csharp/net/eagle0/clients/win/installer/**"
+      - "src/main/go/net/eagle0/clients/win/installer/**"
+  workflow_dispatch:
 
 permissions:
   contents: read
+  actions: write  # Required to delete artifacts after deploy
 
 jobs:
   build-installer:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
       - uses: actions/checkout@v4
@@ -24,34 +26,47 @@ jobs:
           lfs: false
           clean: false
 
-      - name: Setup .NET 8
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '8.0.x'
+      - name: Build Go installer for Windows
+        env:
+          MANIFEST_PUBLIC_KEY: ${{ secrets.MANIFEST_PUBLIC_KEY }}
+        run: |
+          # Require manifest public key for production builds
+          if [ -z "$MANIFEST_PUBLIC_KEY" ]; then
+            echo "ERROR: MANIFEST_PUBLIC_KEY secret is not set"
+            echo "The installer requires a public key for manifest signature verification"
+            exit 1
+          fi
 
-      - name: Restore dependencies
-        run: dotnet restore src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/EagleInstaller.csproj
+          # Build Windows installer with WebView GUI (uses CGO cross-compilation)
+          # Use --action_env to pass the signing key into the genrule sandbox
+          bazel build //src/main/go/net/eagle0/clients/win/installer:eagle_installer_windows_amd64_webview --stamp --action_env=MANIFEST_PUBLIC_KEY
 
-      - name: Build installer
-        run: dotnet publish src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/EagleInstaller.csproj -c Release -r win-x64 --self-contained true --output ./installer-output
+          # Copy to output directory
+          rm -rf ./installer-output
+          mkdir -p ./installer-output
+          cp bazel-bin/src/main/go/net/eagle0/clients/win/installer/Eagle0.exe ./installer-output/Eagle0.exe
+
+          echo "Go installer size: $(ls -lh ./installer-output/Eagle0.exe | awk '{print $5}')"
 
       - name: Archive installer binary
         if: success() || failure()
         uses: actions/upload-artifact@v4
         with:
           name: eagle-installer
-          path: ./installer-output/EagleInstaller.exe
+          path: ./installer-output/
+          retention-days: 1
 
       - name: Verify installer exists
         if: success()
         run: |
-          if [ ! -f "./installer-output/EagleInstaller.exe" ]; then
-            echo "ERROR: EagleInstaller.exe not found at expected location"
-            echo "Directory contents:"
-            ls -la ./installer-output/
+          echo "=== Installer output directory ==="
+          ls -lh ./installer-output/
+
+          if [ ! -f "./installer-output/Eagle0.exe" ]; then
+            echo "ERROR: Eagle0.exe not found"
             exit 1
           fi
-          echo "Installer found at correct location"
+          echo "Installer found"
 
       - name: Deploy installer
         if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
@@ -59,24 +74,52 @@ jobs:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
         run: |
-          INSTALLER_PATH="$(pwd)/installer-output/EagleInstaller.exe"
-          echo "Using absolute path: $INSTALLER_PATH"
-          bazel run //src/main/go/net/eagle0/build/installer_build_handler:installer_build_handler -- "$INSTALLER_PATH"
+          INSTALLER_PATH="$(pwd)/installer-output/Eagle0.exe"
+          echo "Deploying Go installer to installer/Eagle0.exe"
+          bazel run //src/main/go/net/eagle0/build/installer_build_handler:installer_build_handler -- "$INSTALLER_PATH" "installer/Eagle0.exe"
 
-      - name: Update unified manifest
+      - name: Update manifest
         if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
+          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
         run: |
-          # Create installer manifest content  
-          INSTALLER_SHA=$(sha256sum ./installer-output/EagleInstaller.exe | cut -d' ' -f1)
+          INSTALLER_SHA=$(sha256sum ./installer-output/Eagle0.exe | cut -d' ' -f1)
           echo "installer_version=$INSTALLER_SHA" > /tmp/installer_manifest.txt
-          echo "installer_url=installer/EagleInstaller.exe" >> /tmp/installer_manifest.txt
-          
-          echo "=== Installer manifest content ==="
+          echo "installer_url=installer/Eagle0.exe" >> /tmp/installer_manifest.txt
+
+          echo "=== Manifest content ==="
           cat /tmp/installer_manifest.txt
-          echo "=================================="
-          
-          # Update the unified manifest
-          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- installer /tmp/installer_manifest.txt
+          echo "========================"
+
+          # Write signing key to temp file (if available)
+          SIGNING_ARGS=""
+          if [ -n "$MANIFEST_SIGNING_KEY" ]; then
+            echo "$MANIFEST_SIGNING_KEY" > /tmp/manifest_signing_key
+            chmod 600 /tmp/manifest_signing_key
+            SIGNING_ARGS="/tmp/manifest_signing_key"
+            echo "Manifest signing key available"
+          else
+            echo "Warning: MANIFEST_SIGNING_KEY not set, manifest will be unsigned"
+          fi
+
+          # Update the v2 manifest at installer/v2/eagle0_manifest.txt
+          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- installer-v2 /tmp/installer_manifest.txt $SIGNING_ARGS
+
+          rm -f /tmp/manifest_signing_key
+
+      - name: Delete all installer artifacts
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete ALL eagle-installer artifacts to free up storage
+          echo "Fetching all eagle-installer artifacts..."
+          artifact_ids=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
+            --paginate -q '.artifacts[] | select(.name == "eagle-installer") | .id')
+          for id in $artifact_ids; do
+            echo "Deleting artifact ID: $id"
+            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id" || true
+          done
+          echo "Cleanup complete"

.github/workflows/ios_addressables_build.yml

@@ -0,0 +1,86 @@
+name: iOS Addressables Build
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - ".github/workflows/ios_addressables_build.yml"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/AddressableAssetsData/**"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Music/**"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Editor/BuildScript.cs"
+      - "ci/github_actions/build_ios_addressables.sh"
+      - "ci/github_actions/upload_addressables.sh"
+  pull_request:
+    paths:
+      - ".github/workflows/ios_addressables_build.yml"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/AddressableAssetsData/**"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Music/**"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Editor/BuildScript.cs"
+      - "ci/github_actions/build_ios_addressables.sh"
+      - "ci/github_actions/upload_addressables.sh"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  # Runner-specific build directory to allow parallel builds on multiple runners
+  EAGLE0_BUILD_DIR: /tmp/eagle0-${{ github.run_id }}
+
+jobs:
+  build-ios-addressables:
+    runs-on: [self-hosted, macOS, unity-mac]
+
+    steps:
+      - name: Cleanup stale PR refs
+        run: |
+          # Prune stale PR refs from previous runs. These can accumulate on self-hosted runners
+          # and cause "reference broken" errors during checkout. Must be done
+          # before checkout to prevent "missing object" errors.
+          if [ -d ".git" ]; then
+            echo "Pruning stale PR refs..."
+            git for-each-ref --format='%(refname)' refs/remotes/pull/ 2>/dev/null | \
+              xargs -r git update-ref -d 2>/dev/null || true
+          fi
+      - uses: actions/checkout@v4
+        with:
+          lfs: true
+          clean: true
+
+      - name: Pull LFS files
+        run: git lfs pull
+
+      - name: Ensure Unity version installed
+        run: ./ci/github_actions/ensure_unity_installed.sh ios
+
+      - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: ios
+        run: ./ci/github_actions/restore_library.sh
+
+      - name: Build iOS Addressables
+        run: ./ci/github_actions/build_ios_addressables.sh "$EAGLE0_BUILD_DIR/editor_ios_addressables.log"
+
+      - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: ios
+        run: ./ci/github_actions/persist_library.sh
+
+      - name: Upload Addressables to CDN
+        if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh iOS
+
+      - name: Archive Build Log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: editor_ios_addressables.log
+          path: ${{ env.EAGLE0_BUILD_DIR }}/editor_ios_addressables.log
+          retention-days: 5
+      - name: Cleanup build directory
+        if: always()
+        run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"

.github/workflows/ios_testflight.yml

@@ -0,0 +1,213 @@
+name: iOS TestFlight
+
+on:
+  workflow_dispatch:
+    inputs:
+      skip_upload:
+        description: 'Skip TestFlight upload (build and archive only)'
+        required: false
+        default: 'false'
+        type: boolean
+
+permissions:
+  contents: read
+  actions: write
+
+env:
+  # Runner-specific build directory to allow parallel builds on multiple runners
+  EAGLE0_BUILD_DIR: /tmp/eagle0-${{ github.run_id }}
+  # Runner-specific keychain to avoid conflicts when multiple runners sign simultaneously
+  KEYCHAIN_NAME: ios-build-${{ github.run_id }}.keychain
+
+jobs:
+  build-unity:
+    runs-on: [self-hosted, macOS, unity-mac]
+    outputs:
+      xcode_project_path: ${{ steps.build.outputs.xcode_project_path }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: true
+          clean: true
+          fetch-depth: 0
+
+      - name: Pull LFS files
+        run: git lfs pull
+
+      - name: Ensure Unity version installed
+        run: ./ci/github_actions/ensure_unity_installed.sh ios
+
+      - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: ios
+        run: ./ci/github_actions/restore_library.sh
+
+      - name: Build iOS Unity Project
+        id: build
+        run: |
+          ./ci/github_actions/build_unity_ios.sh "$EAGLE0_BUILD_DIR/eagle0iOS"
+          echo "xcode_project_path=$EAGLE0_BUILD_DIR/eagle0iOS" >> $GITHUB_OUTPUT
+
+      - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: ios
+        run: ./ci/github_actions/persist_library.sh
+
+      - name: Upload Addressables to CDN
+        if: success()
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh iOS
+
+      - name: Zip Xcode project for artifact
+        run: |
+          cd $EAGLE0_BUILD_DIR
+          # Use tar for speed - Xcode projects have many small files
+          tar -czf eagle0iOS.tar.gz eagle0iOS
+
+      - name: Upload Xcode project
+        uses: actions/upload-artifact@v4
+        with:
+          name: xcode-project-${{ github.run_id }}
+          path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0iOS.tar.gz
+          retention-days: 1
+
+      - name: Archive Build Log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: editor_ios.log
+          path: ${{ env.EAGLE0_BUILD_DIR }}/editor_ios.log
+          retention-days: 5
+      - name: Cleanup build directory
+        if: always()
+        run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"
+
+  archive-and-upload:
+    needs: build-unity
+    runs-on: [self-hosted, macOS, unity-mac]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            ci
+            scripts
+
+      - name: Clean download directory
+        run: rm -rf $EAGLE0_BUILD_DIR/eagle0iOS
+
+      - name: Download Xcode project
+        uses: actions/download-artifact@v4
+        with:
+          name: xcode-project-${{ github.run_id }}
+          path: ${{ env.EAGLE0_BUILD_DIR }}
+
+      - name: Extract Xcode project
+        run: |
+          cd $EAGLE0_BUILD_DIR
+          tar -xzf eagle0iOS.tar.gz
+          rm eagle0iOS.tar.gz
+          ls -la eagle0iOS/
+
+      - name: Install Signing Certificate
+        env:
+          IOS_CERTIFICATE: ${{ secrets.IOS_CERTIFICATE }}
+          IOS_CERTIFICATE_PWD: ${{ secrets.IOS_CERTIFICATE_PWD }}
+        run: |
+          # Generate random keychain password
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV
+
+          # Decode certificate
+          echo "$IOS_CERTIFICATE" | base64 --decode > certificate.p12
+
+          # Delete any existing keychain from previous runs
+          security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
+
+          # Create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
+          security default-keychain -s "$KEYCHAIN_NAME"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
+          security set-keychain-settings -t 3600 -u "$KEYCHAIN_NAME"
+
+          # Import certificate
+          security import certificate.p12 -k "$KEYCHAIN_NAME" -P "$IOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
+
+          # Add keychain to search list
+          security list-keychains -d user -s "$KEYCHAIN_NAME" login.keychain
+
+          rm certificate.p12
+
+      - name: Install Provisioning Profile
+        env:
+          IOS_PROVISIONING_PROFILE: ${{ secrets.IOS_PROVISIONING_PROFILE }}
+        run: |
+          # Decode provisioning profile
+          echo "$IOS_PROVISIONING_PROFILE" | base64 --decode > profile.mobileprovision
+
+          # Extract UUID from provisioning profile
+          PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin <<< $(security cms -D -i profile.mobileprovision))
+          echo "PROFILE_UUID=$PROFILE_UUID" >> $GITHUB_ENV
+
+          # Install to standard location
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp profile.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/$PROFILE_UUID.mobileprovision
+
+          rm profile.mobileprovision
+          echo "Installed provisioning profile: $PROFILE_UUID"
+
+      - name: Archive and Export IPA
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          chmod +x ./ci/github_actions/archive_ios.sh
+          ./ci/github_actions/archive_ios.sh "$EAGLE0_BUILD_DIR/eagle0iOS" "$EAGLE0_BUILD_DIR/archive" "$APPLE_TEAM_ID" "$PROFILE_UUID"
+
+      - name: Upload to TestFlight
+        if: ${{ github.event.inputs.skip_upload != 'true' }}
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
+        run: |
+          chmod +x ./ci/github_actions/upload_testflight.sh
+          ./ci/github_actions/upload_testflight.sh "$EAGLE0_BUILD_DIR/archive/eagle0.ipa"
+
+      - name: Upload IPA artifact
+        # Only keep artifact if we skipped TestFlight upload (for debugging)
+        if: success() && github.event.inputs.skip_upload == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: eagle0-ios-${{ github.run_id }}
+          path: ${{ env.EAGLE0_BUILD_DIR }}/archive/eagle0.ipa
+          retention-days: 1
+
+      - name: Cleanup Keychain
+        if: always()
+        run: |
+          security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
+      - name: Cleanup build directory
+        if: always()
+        run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"
+
+  cleanup:
+    needs: [build-unity, archive-and-upload]
+    if: always()
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Delete intermediate artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          artifact_name="xcode-project-${{ github.run_id }}"
+          echo "Deleting artifact: $artifact_name"
+          artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+            -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+          if [ -n "$artifact_id" ]; then
+            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+          fi

.github/workflows/mac_build.yml

@@ -6,70 +6,138 @@ on:
     paths:
       - ".github/workflows/mac_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
+      - "src/main/go/net/eagle0/build/mac_build_handler/**"
       - "scripts/build_protos.sh"
       - "scripts/build_mac_plugin.sh"
       - "scripts/inject_sparkle.sh"
       - "scripts/codesign_mac_app.sh"
-      - "scripts/notarize_mac_app.sh"
+      - "scripts/notarize_submit.sh"
+      - "scripts/notarize_wait.sh"
       - "ci/github_actions/build_mac.sh"
       - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/upload_addressables.sh"
+      - "ci/github_actions/ensure_unity_installed.sh"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
       - "ci/mac/**"
   pull_request:
     paths:
       - ".github/workflows/mac_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
+      - "src/main/go/net/eagle0/build/mac_build_handler/**"
       - "scripts/build_mac_plugin.sh"
       - "scripts/inject_sparkle.sh"
       - "scripts/codesign_mac_app.sh"
-      - "scripts/notarize_mac_app.sh"
+      - "scripts/notarize_submit.sh"
+      - "scripts/notarize_wait.sh"
       - "ci/github_actions/build_mac.sh"
       - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/upload_addressables.sh"
+      - "ci/github_actions/ensure_unity_installed.sh"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
       - "ci/mac/**"
   workflow_dispatch:
     inputs:
-      skip_notarization:
-        description: 'Skip notarization (for testing)'
+      skip_signing:
+        description: 'Skip code signing, notarization, and deploy (build only)'
         required: false
         default: 'false'
         type: boolean
 
 permissions:
   contents: read
+  actions: write  # Required to delete artifacts after deploy
+
+env:
+  # Runner-specific build directory to allow parallel builds on multiple runners
+  EAGLE0_BUILD_DIR: /tmp/eagle0-${{ github.run_id }}
+  # Runner-specific keychain to avoid conflicts when multiple runners sign simultaneously
+  KEYCHAIN_NAME: build-${{ github.run_id }}.keychain
 
 jobs:
-  mac-unity:
-    runs-on: self-hosted
+  build-and-sign:
+    runs-on: [self-hosted, macOS, unity-mac]
+    outputs:
+      submission_id: ${{ steps.notarize-submit.outputs.submission_id }}
+      should_deploy: ${{ steps.check-deploy.outputs.should_deploy }}
 
     steps:
+      - name: Prune stale PR refs
+        run: |
+          # Self-hosted runners persist .git between runs. When a PR is updated,
+          # old local refs (refs/remotes/pull/*/merge) may point to commits whose
+          # objects were never fetched or have been pruned. Remove these stale refs
+          # before checkout to prevent "missing object" errors.
+          if [ -d ".git" ]; then
+            echo "Pruning stale PR refs..."
+            git for-each-ref --format='%(refname)' refs/remotes/pull/ 2>/dev/null | \
+              xargs -r git update-ref -d 2>/dev/null || true
+          fi
       - uses: actions/checkout@v4
         with:
           lfs: true
-          clean: false
+          clean: true  # Remove untracked files like old SparklePlugin.bundle
           fetch-depth: 0  # For version numbering from git history
 
       - name: Pull LFS files
         run: git lfs pull
 
+      - name: Ensure Unity version installed
+        run: ./ci/github_actions/ensure_unity_installed.sh mac
+
       - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: mac
         run: ./ci/github_actions/restore_library.sh
 
       - name: Build Mac Unity
-        run: ./ci/github_actions/build_unity_mac.sh "/tmp/eagle0/eagle0MAC"
+        run: ./ci/github_actions/build_unity_mac.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC"
 
       - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: mac
         run: ./ci/github_actions/persist_library.sh
 
+      - name: Upload Addressables to CDN
+        if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh StandaloneOSX
+
       - name: Inject Sparkle Framework
         if: success()
         env:
           SPARKLE_EDDSA_PUBLIC_KEY: ${{ secrets.SPARKLE_EDDSA_PUBLIC_KEY }}
         run: |
           chmod +x ./scripts/inject_sparkle.sh
-          ./scripts/inject_sparkle.sh "/tmp/eagle0/eagle0MAC/eagle0.app"
+          ./scripts/inject_sparkle.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app"
+
+      - name: Check if should deploy
+        id: check-deploy
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.skip_signing }}" == "true" ]]; then
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+          else
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+          fi
 
       - name: Import Code Signing Certificate
-        if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
         env:
           MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
           MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
@@ -81,40 +149,162 @@ jobs:
           # Decode certificate
           echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12
 
+          # Delete any existing keychain from previous runs
+          security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
+
           # Create temporary keychain
-          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain || true
-          security default-keychain -s build.keychain
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
+          security default-keychain -s "$KEYCHAIN_NAME"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
 
           # Import certificate
-          security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
+          echo "=== Importing certificate ==="
+          security import certificate.p12 -k "$KEYCHAIN_NAME" -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/security
 
           # Allow codesign to access keychain
-          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
+          echo "=== Setting key partition list ==="
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
+
+          # Add keychain to search list (required for codesign to find certificates)
+          echo "=== Adding keychain to search list ==="
+          security list-keychains -d user -s "$KEYCHAIN_NAME" login.keychain
+
+          # Debug: Check what's in the keychain after import
+          echo "=== Debug: Identities in build keychain ==="
+          KEYCHAIN_PATH="$HOME/Library/Keychains/$KEYCHAIN_NAME-db"
+          security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true
+          echo "=== Debug: All available identities ==="
+          security find-identity -v -p codesigning || true
 
           # Clean up
           rm certificate.p12
 
       - name: Code Sign App
-        if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
         env:
           SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
         run: |
           chmod +x ./scripts/codesign_mac_app.sh
-          ./scripts/codesign_mac_app.sh "/tmp/eagle0/eagle0MAC/eagle0.app" "ci/mac/eagle0.entitlements"
+          ./scripts/codesign_mac_app.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app" "ci/mac/eagle0.entitlements"
 
-      - name: Notarize App
-        if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.event.inputs.skip_notarization != 'true'
+      - name: Submit for Notarization
+        id: notarize-submit
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
           TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
-          chmod +x ./scripts/notarize_mac_app.sh
-          ./scripts/notarize_mac_app.sh "/tmp/eagle0/eagle0MAC/eagle0.app"
+          chmod +x ./scripts/notarize_submit.sh
+          ./scripts/notarize_submit.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app" >> $GITHUB_OUTPUT
+
+      - name: Cleanup Keychain
+        if: always()
+        run: |
+          security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
+
+      - name: Zip signed app for artifact
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        run: |
+          cd ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+          ditto -c -k --keepParent eagle0.app eagle0.app.zip
+
+      - name: Upload signed app
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: signed-mac-app-${{ github.run_id }}
+          path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app.zip
+          retention-days: 1
+
+      - name: Archive Build Log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: editor_mac.log
+          path: ${{ env.EAGLE0_BUILD_DIR }}/editor_mac.log
+          retention-days: 5
+      - name: Cleanup build directory
+        if: always()
+        run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"
+
+  wait-notarization:
+    needs: build-and-sign
+    if: needs.build-and-sign.outputs.should_deploy == 'true'
+    runs-on: [self-hosted, macOS, notarize]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: scripts
+
+      - name: Clean download directory
+        run: rm -rf ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+
+      - name: Download signed app
+        uses: actions/download-artifact@v4
+        with:
+          name: signed-mac-app-${{ github.run_id }}
+          path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+
+      - name: Unzip signed app
+        run: |
+          cd ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+          ditto -x -k eagle0.app.zip .
+          rm eagle0.app.zip
+          ls -la ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app/
+
+      - name: Wait for Notarization and Staple
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
+          TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          chmod +x ./scripts/notarize_wait.sh
+          ./scripts/notarize_wait.sh "${{ needs.build-and-sign.outputs.submission_id }}" "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app"
+
+      - name: Zip notarized app for artifact
+        run: |
+          cd ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+          rm -f eagle0.app.zip
+          ditto -c -k --keepParent eagle0.app eagle0.app.zip
+
+      - name: Upload notarized app
+        uses: actions/upload-artifact@v4
+        with:
+          name: notarized-mac-app-${{ github.run_id }}
+          path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app.zip
+          retention-days: 1
+      - name: Cleanup build directory
+        if: always()
+        run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"
+
+  deploy:
+    needs: [build-and-sign, wait-notarization]
+    if: needs.build-and-sign.outputs.should_deploy == 'true'
+    runs-on: [self-hosted, macOS, unity-mac]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # For version numbering
+
+      - name: Clean download directory
+        run: rm -rf ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+
+      - name: Download notarized app
+        uses: actions/download-artifact@v4
+        with:
+          name: notarized-mac-app-${{ github.run_id }}
+          path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+
+      - name: Unzip notarized app
+        run: |
+          cd ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
+          ditto -x -k eagle0.app.zip .
+          rm eagle0.app.zip
 
       - name: Deploy Mac Build
-        if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
@@ -125,25 +315,80 @@ jobs:
           echo "$SPARKLE_EDDSA_PRIVATE_KEY" > "$SPARKLE_PRIVATE_KEY_PATH"
           chmod 600 "$SPARKLE_PRIVATE_KEY_PATH"
 
-          VERSION=$(git describe --tags --always)
-          BUILD_NUMBER=$(git rev-list --count HEAD)
+          # Install dmgbuild (creates .DS_Store programmatically, no AppleScript needed)
+          pip3 install dmgbuild
+
+          # Background image for styled DMG
+          BACKGROUND_PATH="$(pwd)/ci/mac/dmg/background.png"
+
+          # Read version from the built app's Info.plist to ensure appcast matches the actual app
+          APP_PATH="${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app"
+          BUILD_NUMBER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$APP_PATH/Contents/Info.plist")
+          VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$APP_PATH/Contents/Info.plist")
 
           bazel run //src/main/go/net/eagle0/build/mac_build_handler:mac_build_handler -- \
-            "/tmp/eagle0/eagle0MAC/eagle0.app" \
+            "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app" \
             "$VERSION" \
             "$BUILD_NUMBER" \
+            "$BACKGROUND_PATH" \
             "$SPARKLE_PRIVATE_KEY_PATH"
 
           rm "$SPARKLE_PRIVATE_KEY_PATH"
 
-      - name: Cleanup Keychain
-        if: always()
-        run: |
-          security delete-keychain build.keychain 2>/dev/null || true
+          # Export version for notify step
+          echo "DEPLOYED_VERSION=$VERSION" >> $GITHUB_ENV
 
-      - name: Archive Build Log
-        if: success() || failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: editor_mac.log
-          path: /tmp/eagle0/editor_mac.log
+      - name: Notify clients of update
+        if: success()
+        env:
+          NOTIFY_SECRET: ${{ secrets.EAGLE_NOTIFY_SECRET }}
+        run: |
+          # Wait for CDN cache to clear
+          sleep 60
+
+          # Notify via admin server (required=false for normal deploys)
+          curl -X POST "https://admin.eagle0.net/notify-update?platform=mac&version=$DEPLOYED_VERSION&required=false" \
+            -H "X-Notify-Secret: $NOTIFY_SECRET" \
+            --fail --silent --show-error || echo "Warning: Failed to notify clients (non-fatal)"
+
+      - name: Delete this run's Mac app artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete this run's artifacts (names include run ID to avoid conflicts)
+          for artifact_name in signed-mac-app-${{ github.run_id }} notarized-mac-app-${{ github.run_id }}; do
+            echo "Deleting artifact: $artifact_name"
+            artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+              -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+            if [ -n "$artifact_id" ]; then
+              echo "Deleting artifact ID: $artifact_id"
+              gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+            fi
+          done
+          echo "Cleanup complete"
+      - name: Cleanup build directory
+        if: always()
+        run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"
+
+  # Cleanup job runs regardless of success/failure to prevent artifact accumulation
+  cleanup:
+    needs: [build-and-sign, wait-notarization, deploy]
+    if: always()
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Delete this run's Mac app artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete this run's artifacts (names include run ID to avoid conflicts)
+          for artifact_name in signed-mac-app-${{ github.run_id }} notarized-mac-app-${{ github.run_id }}; do
+            echo "Deleting artifact: $artifact_name"
+            artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+              -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+            if [ -n "$artifact_id" ]; then
+              echo "Deleting artifact ID: $artifact_id"
+              gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+            fi
+          done
+          echo "Cleanup complete"

.github/workflows/registry_cleanup.yml

@@ -46,26 +46,26 @@ jobs:
           for REPO in $REPOS; do
             echo "=== Processing repository: ${REPO} ==="
 
-            # Get all manifests with their tags and dates
-            # Filter out header row and empty lines
-            MANIFESTS=$(doctl registry repository list-manifests "${REPO}" --format Digest,UpdatedAt,Tags --no-header 2>/dev/null | grep -v '^Digest' | grep -v '^$' || echo "")
+            # Get all manifests with their tags and dates using JSON output for reliable parsing
+            MANIFESTS_JSON=$(doctl registry repository list-manifests "${REPO}" --output json 2>/dev/null || echo "[]")
 
-            if [ -z "$MANIFESTS" ]; then
+            if [ "$MANIFESTS_JSON" = "[]" ] || [ -z "$MANIFESTS_JSON" ]; then
               echo "  No manifests found"
               continue
             fi
 
-            echo "$MANIFESTS" | while read -r DIGEST UPDATED_AT TAGS; do
+            # Parse JSON and process each manifest
+            echo "$MANIFESTS_JSON" | jq -r '.[] | "\(.digest) \(.updated_at) \(.tags // [] | join(","))"' | while read -r DIGEST UPDATED_AT TAGS; do
               # Skip if no digest or if it doesn't look like a valid digest (sha256:...)
               if [ -z "$DIGEST" ] || ! echo "$DIGEST" | grep -q '^sha256:'; then
                 continue
               fi
 
-              # Parse the date
+              # Parse the date (ISO 8601 format from JSON)
               MANIFEST_DATE=$(date -d "$UPDATED_AT" +%s 2>/dev/null || echo "0")
 
               # Skip protected tags (latest, arm64-latest)
-              if echo "$TAGS" | grep -qE '(^|,)(latest|arm64-latest)(,|$)'; then
+              if echo ",$TAGS," | grep -qE ',(latest|arm64-latest),'; then
                 echo "  KEEP: ${DIGEST:0:20}... (protected tag: $TAGS)"
                 continue
               fi

.github/workflows/shardok_arm64_build.yml

@@ -24,7 +24,7 @@ permissions:
 
 jobs:
   build-shardok-arm64:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     outputs:
       image_tag: ${{ steps.push-shardok.outputs.image_tag }}
     steps:
@@ -159,7 +159,7 @@ jobs:
           echo "Also tagged as: registry.digitalocean.com/eagle0/shardok-server:arm64-latest"
 
   deploy-hetzner:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     needs: [build-shardok-arm64]
     if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
     environment: production

.github/workflows/shardok_build.yml

@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
       - name: Checkout repository

.github/workflows/unity_build.yml

@@ -6,67 +6,146 @@ on:
     paths:
       - ".github/workflows/unity_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "scripts/build_protos.sh"
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
       - "ci/github_actions/restore_library.sh"
       - "ci/github_actions/persist_library.sh"
+      - "ci/github_actions/upload_addressables.sh"
+      - "ci/github_actions/ensure_unity_installed.sh"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
       - "MODULE.bazel"
       - "WORKSPACE"
-      - "src/main/proto/net/eagle0/eagle/**/BUILD.bazel"
+  workflow_dispatch:
   pull_request:
     paths:
       - ".github/workflows/unity_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "scripts/build_protos.sh"
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
       - "ci/github_actions/restore_library.sh"
       - "ci/github_actions/persist_library.sh"
+      - "ci/github_actions/upload_addressables.sh"
+      - "ci/github_actions/ensure_unity_installed.sh"
+      - "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
       - "MODULE.bazel"
       - "WORKSPACE"
-      - "src/main/proto/**/BUILD.bazel"
 
 permissions:
   contents: read
 
+env:
+  # Runner-specific build directory to allow parallel builds on multiple runners
+  EAGLE0_BUILD_DIR: /tmp/eagle0-${{ github.run_id }}
+
 jobs:
   windows-unity:
-    runs-on: self-hosted
+    runs-on: [self-hosted, macOS, unity-windows]
 
     steps:
+      - name: Prune stale PR refs
+        run: |
+          # Self-hosted runners persist .git between runs. When a PR is updated,
+          # old local refs (refs/remotes/pull/*/merge) may point to commits whose
+          # objects were never fetched or have been pruned. Remove these stale refs
+          # before checkout to prevent "missing object" errors.
+          if [ -d ".git" ]; then
+            echo "Pruning stale PR refs..."
+            git for-each-ref --format='%(refname)' refs/remotes/pull/ 2>/dev/null | \
+              xargs -r git update-ref -d 2>/dev/null || true
+          fi
       - uses: actions/checkout@v4
         with:
           lfs: true
-          clean: false
+          clean: true  # Remove untracked files from previous builds
       - name: Pull lfs files
         run: git lfs pull
+      - name: Ensure Unity version installed
+        run: ./ci/github_actions/ensure_unity_installed.sh windows
       - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: windows
         run: ./ci/github_actions/restore_library.sh
       - name: Build Windows unity
-        run: ./ci/github_actions/build_unity.sh "/tmp/eagle0/eagle0WIN"
+        run: ./ci/github_actions/build_unity.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0WIN"
       - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: windows
         run: ./ci/github_actions/persist_library.sh
+      - name: Upload Addressables to CDN
+        if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh StandaloneWindows64
       - name: Deploy Windows unity
         if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
-        run: bazel run //src/main/go/net/eagle0/build/unity3d_windows_build_handler:unity3d_windows_build_handler -- "/tmp/eagle0/eagle0WIN" "/tmp/unity_manifest.txt"
+        run: bazel run //src/main/go/net/eagle0/build/unity3d_windows_build_handler:unity3d_windows_build_handler -- "${{ env.EAGLE0_BUILD_DIR }}/eagle0WIN" "/tmp/unity_manifest.txt"
 
       - name: Update unified manifest
         if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
-        run: bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- unity3d /tmp/unity_manifest.txt
+          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
+        run: |
+          # Write signing key to temp file (if available)
+          SIGNING_ARGS=""
+          if [ -n "$MANIFEST_SIGNING_KEY" ]; then
+            echo "$MANIFEST_SIGNING_KEY" > /tmp/manifest_signing_key
+            chmod 600 /tmp/manifest_signing_key
+            SIGNING_ARGS="/tmp/manifest_signing_key"
+            echo "Manifest signing key available"
+          else
+            echo "Warning: MANIFEST_SIGNING_KEY not set, manifest will be unsigned"
+          fi
+
+          # Update the v2 manifest at installer/v2/eagle0_manifest.txt
+          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- unity3d-v2 /tmp/unity_manifest.txt $SIGNING_ARGS
+
+          # Cleanup
+          rm -f /tmp/manifest_signing_key
+
+      - name: Notify clients of update
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          NOTIFY_SECRET: ${{ secrets.EAGLE_NOTIFY_SECRET }}
+        run: |
+          # Wait for CDN cache to clear
+          sleep 60
+
+          # Get version from manifest
+          VERSION=$(grep "^version=" /tmp/unity_manifest.txt | cut -d= -f2 || date +%Y.%m.%d)
+
+          # Notify via admin server (required=false for normal deploys)
+          curl -X POST "https://admin.eagle0.net/notify-update?platform=windows&version=$VERSION&required=false" \
+            -H "X-Notify-Secret: $NOTIFY_SECRET" \
+            --fail --silent --show-error || echo "Warning: Failed to notify clients (non-fatal)"
+
       - name: Archive build log
         if: success() || failure()
         uses: actions/upload-artifact@v4
         with:
           name: editor_win.log
-          path: /tmp/eagle0/editor_win.log
+          path: ${{ env.EAGLE0_BUILD_DIR }}/editor_win.log
+          retention-days: 5
+      - name: Cleanup build directory
+        if: always()
+        run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"

.gitignore

@@ -38,3 +38,4 @@ scripts/refresh_name_layers/refresh_name_layers.zip
 api_keys.txt
 
 src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/Packages/com.unity.dedicated-server/
+node_modules/

BUILD.bazel

@@ -32,3 +32,15 @@ nogo(
     vet = True,
     visibility = ["//visibility:public"],
 )
+
+# Dependency constraint tests
+# These verify architectural boundaries are maintained
+sh_test(
+    name = "build_deps_test",
+    srcs = ["scripts/check_build_deps.sh"],
+    args = ["--ci"],
+    tags = [
+        "local",  # Needs bazel query access
+        "no-sandbox",
+    ],
+)

CLAUDE.md

@@ -4,14 +4,18 @@
 
 **NEVER push directly to main/master.** No exceptions. Not for "small changes." Not for docs. Not ever.
 
+**NEVER merge PRs.** You create PRs. The user merges them. No exceptions.
+
 **ALWAYS use this workflow:**
 1. Create a feature branch from origin/main
 2. Commit to that branch
 3. Create a PR with `gh pr create`
-4. Wait for user to merge
+4. Wait for user to merge (DO NOT run `gh pr merge`)
 
 If you catch yourself about to run `git push origin main` or `git push origin <branch>:main`, STOP. You are about to violate a critical rule. Create a PR instead.
 
+If you catch yourself about to run `gh pr merge`, STOP. Only the user merges PRs.
+
 ---
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

DEPROTO_PLAN.md

@@ -1,213 +0,0 @@
-# Deproto Migration Plan
-
-This document tracks the migration from protobuf types to native Scala models inside the Eagle game engine.
-
-## Architectural Decisions
-
-1. **Keep proto for persistence**: Yes - protobuf is used for persisting game state
-2. **Keep proto for Shardok communication**: Yes - protobuf is used for Eagle-Shardok gRPC communication
-3. **Use Scala views inside the library**: Yes - use native Scala types like `ProvinceView`, `FactionView`, `HeroView`, etc. within the library code
-
-## Recent Completed Work
-
-### GameState Round-Trip Elimination (PRs #4913, #4914, #4915)
-
-Eliminated wasteful Scala→proto→Scala conversions in the hot path:
-
-1. **LLM Pipeline** (#4913): `LlmRequestWithGameState` now uses Scala `GameState` instead of proto. All ~38 prompt generators updated to use Scala model types (`FactionT`, `HeroT`, `ProvinceT`).
-
-2. **ActionWithResultingState Caching** (#4914): Added `precomputedScalaState: Option[GameState]` to cache Scala state when available, avoiding `fromProto()` conversion in `stateAfter()`.
-
-3. **PostResults Simplification** (#4915): Changed `PostResults.gameState` from proto to `Option[GameState]` (Scala), eliminating `toProto()` calls when creating PostResults.
-
-## Migration Pattern
-
-The codebase follows a **Legacy* pattern** for separating proto-dependent and protoless code:
-
-- **Protoless utilities**: `FactionUtils`, `HeroUtils`, `ProvinceUtils`, `ProvinceDistances`, etc.
-- **Proto-dependent utilities**: `LegacyFactionUtils`, `LegacyHeroUtils`, `LegacyProvinceUtils`, `LegacyProvinceDistances`, etc.
-
-When migrating a file:
-1. Create a `Legacy*` version containing the proto-dependent methods
-2. Keep the original file name for protoless methods
-3. Update callers to use the appropriate version based on their context
-
-## Migration Status
-
-### Fully Protoless (no proto imports)
-
-**Utilities:**
-- [x] `FactionUtils` - has protoless `ownedNeighbors` method
-- [x] `ProvinceDistances` - split into protoless + `LegacyProvinceDistances`
-- [x] `SwornBrotherChooser` - fully protoless (removed `bestChoiceProto`)
-
-**Command Selectors (all use native GameState):**
-- [x] `AllianceOfferCommandSelector`
-- [x] `AlmsCommandSelector`
-- [x] `AttackCommandChooser`
-- [x] `ExpandCommandSelector`
-- [x] `HeroGiftCommandSelector`
-- [x] `ImproveCommandSelector`
-- [x] `MarchTowardProvinceCommandChooser` - in AI folder, uses native GameState (callers convert)
-- [x] `OrganizeCommandSelector`
-- [x] `RansomOfferHelpers`
-- [x] `SeekMoreLeadersCommandChooser` - in AI folder, uses native GameState
-- [x] `TruceOfferCommandSelector`
-- [x] `TrustForDiplomacy`
-
-**Quest Command Selectors (all protoless):**
-- [x] `AllianceQuestCommandChooser`
-- [x] `AlmsAcrossRealmQuestCommandChooser`
-- [x] `AlmsToProvinceQuestCommandChooser`
-- [x] `DismissSpecificVassalCommandChooser`
-- [x] `GiveToHeroesAcrossRealmQuestCommandChooser`
-- [x] `GiveToHeroesInProvinceQuestCommandChooser`
-- [x] `ImproveQuestCommandChooser`
-- [x] `QuestCommandChooser`
-- [x] `TruceCountQuestCommandChooser`
-- [x] `TruceWithFactionQuestCommandChooser`
-
-### Fully Protoless
-
-- [x] `AIClientUtils` - has protoless overloads (`takenHeroIdsForMarchTowardFocus`, `mostPowerfulHeroes`)
-- [x] `AttackCommandChooser` - uses Scala `GameState` and `BattalionViewC` (Scala view type)
-- [x] `BattalionPower` - has `estimatedPower(BattalionViewC)` for recon data with optional stats
-- [x] `CommandChoiceHelpers` - fully protoless, uses Scala `GameState` throughout
-- [x] `ProvinceGoldSurplusCalculator` - fully protoless (callers use converters)
-- [x] `HeroSelector` - fully protoless (removed dead `minimallyFatiguedHeroesProto`)
-
-### AI Layer ✅ COMPLETE
-
-All AI and command chooser code is now fully protoless:
-- [x] `AttackDecisionCommandChooser` - uses Scala GameState
-- [x] `CommandChooser` - trait uses Scala GameState
-- [x] `FulfillQuestsCommandSelector` - uses Scala GameState
-- [x] `MidGameAIClient` - uses Scala GameState internally
-
-### Still Using Proto GameState (Boundary Code)
-
-These files use proto GameState because they're at system boundaries:
-
-**View Filters (client projection):**
-- `view_filters/GameStateViewFilter` - has Scala overload, uses Scala sub-filters
-- `view_filters/ProvinceViewFilter` - has Scala overloads for some methods
-- `view_filters/FactionViewFilter` - has Scala overload
-- `view_filters/HeroViewFilter` - has Scala overload
-- `view_filters/BattalionNameFilter` - has Scala overload
-- `view_filters/BattleFilter` - has Scala overload
-
-**Legacy Utilities (to be deprecated):**
-- `LegacyProvinceDistances`, `LegacyFactionUtils`, `LegacyHeroUtils`, etc.
-- Used by code that still needs proto GameState
-
-**Persistence/Action System:**
-- `ActionResultTApplier`, `ActionResultProtoApplier` - apply results to proto state
-- `ActionWithResultingState` - caches both proto and Scala state
-
-**Shardok Interface (gRPC boundary):**
-- `ShardokInterfaceGrpcClient`, `ShardokInterfaceProxy` - must use proto for C++ communication
-
-## Next Steps
-
-### Phase 1-3: AI Layer ✅ COMPLETE
-
-The entire AI decision-making layer is now protoless.
-
-### Phase 4: View Filters ✅ COMPLETE
-
-The view_filters package migration is complete:
-
-**Completed:**
-- [x] `GameStateViewFilter` - added Scala GameState overload (uses Scala sub-filters)
-- [x] `ProvinceViewFilter` - already has Scala overloads for server-side views
-- [x] `HumanPlayerClientConnectionState` - updated to pass Scala GameState directly
-- [x] `HeroViewFilter` - added Scala overload
-- [x] `FactionViewFilter` - added Scala overload
-- [x] `Visibility` - added Scala overloads
-
-**Still Using Proto:**
-- [x] `BattalionNameFilter` - has Scala overload
-- [x] `BattleFilter` - has Scala overload
-- [ ] `ActionResultFilter` - uses proto internally (boundary code)
-
-**Strategy:**
-1. Add Scala GameState overloads to view filter methods
-2. Update callers to pass Scala GameState where available
-3. Eventually deprecate proto versions
-
-### Phase 5: Legacy Utility Cleanup (IN PROGRESS)
-
-Remove Legacy* utilities by migrating remaining callers:
-1. Identify callers of each Legacy* util
-2. Update callers to use protoless versions
-3. Delete Legacy* files when no longer needed
-
-**Deleted (no production callers):**
-- [x] `LegacyProvinceDistances` - deleted (no callers)
-- [x] `LegacyBattalionSuitability` - deleted (no callers)
-- [x] `LegacyFoodConsumptionUtils` - deleted (no callers)
-- [x] `LegacyHandleRiotUtils` - deleted (no callers)
-
-**Refactored to Thin Wrappers (delegating to protoless versions):**
-- [x] `LegacyRansomValidity` - already a thin wrapper delegating to `RansomValidity`
-- [x] `LegacyRecruitmentOdds` - refactored to delegate to `RecruitmentOdds`
-
-**Parallel Implementations (proto mirrors protoless):**
-- [x] `FactionUtils` / `LegacyFactionUtils` - both have matching APIs; LegacyFactionUtils used by boundary code (24+ callers)
-- [x] `HeroUtils` / `LegacyHeroUtils` - both have matching APIs; LegacyHeroUtils used by boundary code (10 callers)
-- [x] `ProvinceUtils` / `LegacyProvinceUtils` - both have matching APIs; LegacyProvinceUtils used by boundary code (20 callers: availability factories, view filters)
-
-**Parallel Implementations (awaiting migration of callers):**
-- [x] `BattalionUtils` / `LegacyBattalionUtils` - both have matching core methods; LegacyBattalionUtils used by boundary code (4 callers)
-- [x] `BattalionViewFilter` / `LegacyBattalionViewFilter` - protoless version exists; Legacy used by view filters, action appliers (3 callers)
-- [x] `BattalionTypeFinder` / `LegacyBattalionTypeFinder` - protoless version exists; Legacy used by validators (1 caller: RuntimeValidator)
-
-### Recent Caller Migration
-
-**CheckForFulfilledQuestsAction** - migrated to use protoless `BattalionTypeFinder`:
-- Changed `battalionTypes` parameter from proto `Vector[BattalionType]` to Scala `Vector[BattalionType]`
-- Updated callers (EngineImpl, EndVassalCommandsPhaseAction) to pass Scala types directly
-- Eliminated wasteful `BattalionTypeConverter.toProto()` conversions
-
-**ExpandedUnaffiliatedHeroUtils** - added Scala overload:
-- New overload takes Scala `GameState` and `UnaffiliatedHeroT` directly
-- Added `UnaffiliatedHeroConverter.unaffiliatedHeroTypeToProto()` helper for efficient enum conversion
-- Proto overload retained for backward compatibility
-
-**AvailablePleaseRecruitMeCommandFactory** - eliminated wasteful proto conversions:
-- Now uses `ExpandedUnaffiliatedHeroUtils.expandedUnaffiliatedHero(ScalaGameState, UnaffiliatedHeroT)` directly
-- Removed `GameStateConverter.toProto()` and `UnaffiliatedHeroConverter.toProto()` calls
-- Factory is now fully protoless internally (still returns proto types for API boundary)
-
-**ProvinceViewFilter** - added Scala overload with faction filtering:
-- New `filteredProvinceView(province: ProvinceT, gs: ScalaGameState, factionId: FactionId)` overload
-- Uses protoless `FactionUtils.hasAlliance`, `Visibility.hasFullVisibility`, and `ProvinceUtils.incomingOthers`
-- Handles reconned provinces directly from Scala `FactionT.reconnedProvinces` (already Scala type)
-- Added helper methods: `fullProvinceInfoScala`, `maybeIncomingAttackersScala`, `unaffiliatedHeroInfoScala`
-- Events still converted to proto at the end (ProvinceView.knownEvents uses proto events)
-
-**GameStateViewFilter** - eliminated GameStateConverter.toProto() call:
-- Scala overload now fully protoless internally
-- Uses the new ProvinceViewFilter Scala overload with faction filtering
-- Converts `battalionTypes` and `chronicleEntries` to proto only at output boundary
-
-## Key Files
-
-### Protoless Model Types
-
-- `src/main/scala/net/eagle0/eagle/model/state/game_state/GameState.scala` - native Scala GameState
-- `src/main/scala/net/eagle0/eagle/model/state/province/ProvinceView.scala` - province view type
-- `src/main/scala/net/eagle0/eagle/model/state/faction/FactionView.scala` - faction view type
-- `src/main/scala/net/eagle0/eagle/model/state/hero/HeroView.scala` - hero view type
-
-### Proto Converters
-
-- `src/main/scala/net/eagle0/eagle/model/proto_converters/game_state/` - converts between proto and Scala types
-
-## Notes
-
-- The AI client code (`src/main/scala/net/eagle0/eagle/ai/`) is now fully protoless
-- Proto GameState is still needed at boundaries: persistence, gRPC to Shardok
-- `PerformUnaffiliatedHeroesAction` and the LLM pipeline use protoless `GameState`
-- `GameStateViewFilter` Scala overload is now fully protoless internally (converts to proto only at output)
-- `ProvinceViewFilter` has Scala overloads for all three modes: no filtering, faction filtering, and withdrawn-from view

MODULE.bazel

@@ -7,14 +7,14 @@ NETTY_VERSION = "4.1.110.Final"
 
 SCALAPB_VERSION = "1.0.0-alpha.1"
 
-AWS_SDK_VERSION = "2.28.1"
+AWS_SDK_VERSION = "2.41.18"
 
 #
 # Core Build Tools
 #
 
-bazel_dep(name = "bazel_skylib", version = "1.8.1")
-bazel_dep(name = "rules_pkg", version = "1.1.0")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
+bazel_dep(name = "rules_pkg", version = "1.2.0")
 
 #
 # Language Support - Scala
@@ -47,14 +47,14 @@ llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
 # Native toolchain (macOS -> macOS, Linux -> Linux)
 llvm.toolchain(
     name = "llvm_toolchain",
-    llvm_version = "20.1.2",
+    llvm_version = "20.1.4",
 )
 
 # Cross-compilation toolchain (macOS -> Linux x86_64)
 # Uses the same LLVM distribution but with a Linux sysroot
 llvm.toolchain(
     name = "llvm_toolchain_linux",
-    llvm_version = "20.1.2",
+    llvm_version = "20.1.4",
 )
 
 # Linux x86_64 sysroot for cross-compilation
@@ -67,7 +67,7 @@ llvm.sysroot(
 # Cross-compilation toolchain (macOS -> Linux ARM64)
 llvm.toolchain(
     name = "llvm_toolchain_linux_arm64",
-    llvm_version = "20.1.2",
+    llvm_version = "20.1.4",
 )
 
 # Linux ARM64 sysroot for cross-compilation
@@ -102,11 +102,12 @@ sysroot(
 # Language Support - Go
 #
 
-bazel_dep(name = "rules_go", version = "0.56.1", repo_name = "io_bazel_rules_go")
-bazel_dep(name = "gazelle", version = "0.45.0", repo_name = "bazel_gazelle")
+bazel_dep(name = "rules_go", version = "0.59.0", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "gazelle", version = "0.47.0", repo_name = "bazel_gazelle")
 
 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(version = "1.23.3")
+use_repo(go_sdk, "go_default_sdk")
 
 go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//:go.mod")
@@ -118,8 +119,10 @@ use_repo(
     "com_github_aws_aws_sdk_go_v2_service_s3",
     "com_github_golang_jwt_jwt_v5",
     "com_github_google_uuid",
+    "com_github_webview_webview_go",
     "org_golang_google_grpc",
     "org_golang_google_protobuf",
+    "org_golang_x_sys",
 )
 
 #
@@ -130,6 +133,13 @@ bazel_dep(name = "apple_support", version = "1.21.1", repo_name = "build_bazel_a
 bazel_dep(name = "rules_apple", version = "4.3.3", repo_name = "build_bazel_rules_apple")
 bazel_dep(name = "rules_swift", version = "2.4.0", repo_name = "build_bazel_rules_swift")
 
+# Register Apple CC toolchain for Objective-C compilation
+apple_cc_configure = use_extension(
+    "@build_bazel_apple_support//crosstool:setup.bzl",
+    "apple_cc_configure_extension",
+)
+use_repo(apple_cc_configure, "local_config_apple_cc")
+
 #
 # Protocol Buffers & RPC
 #
@@ -137,7 +147,7 @@ bazel_dep(name = "rules_swift", version = "2.4.0", repo_name = "build_bazel_rule
 bazel_dep(name = "protobuf", version = "29.2", repo_name = "com_google_protobuf")
 bazel_dep(name = "grpc", version = "1.71.0")
 bazel_dep(name = "grpc-java", version = "1.71.0")
-bazel_dep(name = "flatbuffers", version = "25.2.10")
+bazel_dep(name = "flatbuffers", version = "25.9.23")
 
 #
 # Testing
@@ -149,8 +159,8 @@ bazel_dep(name = "googletest", version = "1.17.0")
 # Container Images (OCI)
 #
 
-bazel_dep(name = "rules_oci", version = "2.2.6")
-bazel_dep(name = "aspect_bazel_lib", version = "2.16.0")
+bazel_dep(name = "rules_oci", version = "2.2.7")
+bazel_dep(name = "aspect_bazel_lib", version = "2.22.4")
 
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 
@@ -186,7 +196,7 @@ use_repo(oci, "alpine_linux", "alpine_linux_linux_amd64", "eclipse_temurin_17",
 # Java/Scala Dependencies
 #
 
-bazel_dep(name = "rules_jvm_external", version = "6.3")
+bazel_dep(name = "rules_jvm_external", version = "6.9")
 
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.install(
@@ -248,7 +258,7 @@ maven.install(
         "com.nimbusds:nimbus-jose-jwt:9.37.3",
 
         # Error tracking
-        "io.sentry:sentry:7.19.0",
+        "io.sentry:sentry:8.31.0",
     ],
     duplicate_version_warning = "error",
     fail_if_repin_required = True,
@@ -293,14 +303,25 @@ http_archive(
     ],
 )
 
+# Sparkle framework for macOS auto-updates
+SPARKLE_VERSION = "2.6.4"
+
+http_archive(
+    name = "sparkle",
+    build_file = "@//external:BUILD.sparkle",
+    sha256 = "50612a06038abc931f16011d7903b8326a362c1074dabccb718404ce8e585f0b",
+    strip_prefix = "",
+    url = "https://github.com/sparkle-project/Sparkle/releases/download/%s/Sparkle-%s.tar.xz" % (SPARKLE_VERSION, SPARKLE_VERSION),
+)
+
 # Busybox static binary for Docker health checks (provides nc, wget, etc.)
-# Primary: GitHub release mirror (reliable)
+# Primary: DigitalOcean Spaces (public, reliable)
 # Fallback: busybox.net (can be unreliable/slow)
 http_file(
     name = "busybox_x86_64",
     sha256 = "6e123e7f3202a8c1e9b1f94d8941580a25135382b99e8d3e34fb858bba311348",
     urls = [
-        "https://github.com/nolen777/eagle0/releases/download/busybox-1.35.0/busybox-1.35.0-x86_64-linux-musl",
+        "https://eagle0-sysroot.sfo3.digitaloceanspaces.com/busybox/busybox-1.35.0-x86_64-linux-musl",
         "https://busybox.net/downloads/binaries/1.35.0-x86_64-linux-musl/busybox",
     ],
     downloaded_file_path = "busybox",
@@ -318,6 +339,19 @@ http_file(
     executable = True,
 )
 
+# LLVM MinGW toolchain for Windows cross-compilation from macOS
+# This provides a complete toolchain for building Windows executables including
+# the MinGW-w64 libraries needed for CGO cross-compilation
+LLVM_MINGW_VERSION = "20250305"
+
+http_archive(
+    name = "llvm_mingw",
+    build_file = "@//external:BUILD.llvm_mingw",
+    sha256 = "32c24fc62fc8b9f8a900bf2c730b78b36767688f816f9d21e97a168289ff44e0",
+    strip_prefix = "llvm-mingw-%s-ucrt-macos-14.4.1-universal" % LLVM_MINGW_VERSION,
+    urls = ["https://github.com/fathonix/llvm-mingw-arm64ec-macos/releases/download/%s/llvm-mingw-%s-ucrt-macos-14.4.1-universal.tar.xz" % (LLVM_MINGW_VERSION, LLVM_MINGW_VERSION)],
+)
+
 #
 # Toolchain Registration
 #

MODULE.bazel.lock

@@ -27,9 +27,9 @@
     "https://bcr.bazel.build/modules/aspect_bazel_lib/1.40.3/MODULE.bazel": "668e6bcb4d957fc0e284316dba546b705c8d43c857f87119619ee83c4555b859",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.11.0/MODULE.bazel": "cb1ba9f9999ed0bc08600c221f532c1ddd8d217686b32ba7d45b0713b5131452",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.14.0/MODULE.bazel": "2b31ffcc9bdc8295b2167e07a757dbbc9ac8906e7028e5170a3708cecaac119f",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.16.0/MODULE.bazel": "852f9ebbda017572a7c113a2434592dd3b2f55cd9a0faea3d4be5a09a59e4900",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.19.3/MODULE.bazel": "253d739ba126f62a5767d832765b12b59e9f8d2bc88cc1572f4a73e46eb298ca",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.19.3/source.json": "ffab9254c65ba945f8369297ad97ca0dec213d3adc6e07877e23a48624a8b456",
+    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.22.4/MODULE.bazel": "a05cbd9bc16712a58dc27ffe0dceaefd0da59a9bd87a227379b2a934b26a39ab",
+    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.22.4/source.json": "9780bc57f521968ee82b7c3e85b7d0c71518fb7ce83ed7a9e5077ce20923207b",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.7.2/MODULE.bazel": "780d1a6522b28f5edb7ea09630748720721dfe27690d65a2d33aa7509de77e07",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.7.7/MODULE.bazel": "491f8681205e31bb57892d67442ce448cda4f472a8e6b3dc062865e29a64f89c",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.8.1/MODULE.bazel": "812d2dd42f65dca362152101fbec418029cc8fd34cbad1a2fde905383d705838",
@@ -39,11 +39,11 @@
     "https://bcr.bazel.build/modules/aspect_rules_js/1.33.1/MODULE.bazel": "db3e7f16e471cf6827059d03af7c21859e7a0d2bc65429a3a11f005d46fc501b",
     "https://bcr.bazel.build/modules/aspect_rules_js/1.39.0/MODULE.bazel": "aece421d479e3c31dc3e5f6d49a12acc2700457c03c556650ec7a0ff23fc0d95",
     "https://bcr.bazel.build/modules/aspect_rules_js/2.0.0/MODULE.bazel": "b45b507574aa60a92796e3e13c195cd5744b3b8aff516a9c0cb5ae6a048161c5",
-    "https://bcr.bazel.build/modules/aspect_rules_js/2.1.3/MODULE.bazel": "47cc48eec374d69dced3cf9b9e5926beac2f927441acfb1a3568bbb709b25666",
-    "https://bcr.bazel.build/modules/aspect_rules_js/2.1.3/source.json": "6b0fe67780c101430be087381b7a79d75eeebe1a1eae6a2cee937713603634ac",
+    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/MODULE.bazel": "74bf20a7a6bd5f2be09607fdb4196cfd6f203422ea271752ec2b1afe95426101",
+    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/source.json": "411ec9d79d6f5fe8a083359588c21d01a5b48d88a2cbd334a4c90365015b7836",
     "https://bcr.bazel.build/modules/aspect_rules_lint/0.12.0/MODULE.bazel": "e767c5dbfeb254ec03275a7701b5cfde2c4d2873676804bc7cb27ddff3728fed",
-    "https://bcr.bazel.build/modules/aspect_rules_ts/3.4.0/MODULE.bazel": "5b554d5de90d96ee14117527c0519037713dd33884f3212eae391beccb2e94ff",
-    "https://bcr.bazel.build/modules/aspect_rules_ts/3.4.0/source.json": "9ada3722b716853b6dccdb7b650d8e776a23bc8a190de0c59bd15f21afea6f8a",
+    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/MODULE.bazel": "d0045b5eabb012be550a609589b3e5e47eba682344b19cfd9365d4d896ed07df",
+    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/source.json": "5593e3f1cd0dd5147f7748e163307fd5c2e1077913d6945b58739ad8d770a290",
     "https://bcr.bazel.build/modules/bazel_features/0.1.0/MODULE.bazel": "47011d645b0f949f42ee67f2e8775188a9cf4a0a1528aa2fa4952f2fd00906fd",
     "https://bcr.bazel.build/modules/bazel_features/1.1.0/MODULE.bazel": "cfd42ff3b815a5f39554d97182657f8c4b9719568eb7fded2b9135f084bf760b",
     "https://bcr.bazel.build/modules/bazel_features/1.1.1/MODULE.bazel": "27b8c79ef57efe08efccbd9dd6ef70d61b4798320b8d3c134fd571f78963dbcd",
@@ -57,12 +57,15 @@
     "https://bcr.bazel.build/modules/bazel_features/1.27.0/MODULE.bazel": "621eeee06c4458a9121d1f104efb80f39d34deff4984e778359c60eaf1a8cb65",
     "https://bcr.bazel.build/modules/bazel_features/1.28.0/MODULE.bazel": "4b4200e6cbf8fa335b2c3f43e1d6ef3e240319c33d43d60cc0fbd4b87ece299d",
     "https://bcr.bazel.build/modules/bazel_features/1.3.0/MODULE.bazel": "cdcafe83ec318cda34e02948e81d790aab8df7a929cec6f6969f13a489ccecd9",
+    "https://bcr.bazel.build/modules/bazel_features/1.30.0/MODULE.bazel": "a14b62d05969a293b80257e72e597c2da7f717e1e69fa8b339703ed6731bec87",
     "https://bcr.bazel.build/modules/bazel_features/1.34.0/MODULE.bazel": "e8475ad7c8965542e0c7aac8af68eb48c4af904be3d614b6aa6274c092c2ea1e",
     "https://bcr.bazel.build/modules/bazel_features/1.38.0/MODULE.bazel": "f9b8a9c890ebd216b4049fd12a31d3c2602e3403c7af636b04fbbd7453edc9c9",
     "https://bcr.bazel.build/modules/bazel_features/1.38.0/source.json": "31ba776c122b54a2885e23651642e32f087a87bf025465f8040751894b571277",
     "https://bcr.bazel.build/modules/bazel_features/1.4.1/MODULE.bazel": "e45b6bb2350aff3e442ae1111c555e27eac1d915e77775f6fdc4b351b758b5d7",
     "https://bcr.bazel.build/modules/bazel_features/1.9.0/MODULE.bazel": "885151d58d90d8d9c811eb75e3288c11f850e1d6b481a8c9f766adee4712358b",
     "https://bcr.bazel.build/modules/bazel_features/1.9.1/MODULE.bazel": "8f679097876a9b609ad1f60249c49d68bfab783dd9be012faf9d82547b14815a",
+    "https://bcr.bazel.build/modules/bazel_lib/3.0.0/MODULE.bazel": "22b70b80ac89ad3f3772526cd9feee2fa412c2b01933fea7ed13238a448d370d",
+    "https://bcr.bazel.build/modules/bazel_lib/3.0.0/source.json": "895f21909c6fba01d7c17914bb6c8e135982275a1b18cdaa4e62272217ef1751",
     "https://bcr.bazel.build/modules/bazel_skylib/1.0.3/MODULE.bazel": "bcb0fd896384802d1ad283b4e4eb4d718eebd8cb820b0a2c3a347fb971afd9d8",
     "https://bcr.bazel.build/modules/bazel_skylib/1.1.1/MODULE.bazel": "1add3e7d93ff2e6998f9e118022c84d163917d912f5afafb3058e3d2f1545b5e",
     "https://bcr.bazel.build/modules/bazel_skylib/1.2.0/MODULE.bazel": "44fe84260e454ed94ad326352a698422dbe372b21a1ac9f3eab76eb531223686",
@@ -77,7 +80,8 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.1/MODULE.bazel": "3120d80c5861aa616222ec015332e5f8d3171e062e3e804a2a0253e1be26e59b",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/MODULE.bazel": "88ade7293becda963e0e3ea33e7d54d3425127e0a326e0d17da085a5f1f03ff6",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/MODULE.bazel": "69ad6927098316848b34a9142bcc975e018ba27f08c4ff403f50c1b6e646ca67",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/source.json": "34a3c8bcf233b835eb74be9d628899bb32999d3e0eadef1947a0a562a2b16ffb",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/MODULE.bazel": "72997b29dfd95c3fa0d0c48322d05590418edef451f8db8db5509c57875fb4b7",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/source.json": "7ad77c1e8c1b84222d9b3f3cae016a76639435744c19330b0b37c0a3c9da7dc0",
     "https://bcr.bazel.build/modules/bazel_worker_api/0.0.6/MODULE.bazel": "fd1f9432ca04c947e91b500df69ce7c5b6dbfe1bc45ab1820338205dae3383a6",
     "https://bcr.bazel.build/modules/bazel_worker_api/0.0.6/source.json": "5d68545f224904745a3cabd35aea6bc2b6cc5a78b7f49f3f69660eab2eeeb273",
     "https://bcr.bazel.build/modules/boringssl/0.0.0-20211025-d4f1ab9/MODULE.bazel": "6ee6353f8b1a701fe2178e1d925034294971350b6d3ac37e67e5a7d463267834",
@@ -104,8 +108,8 @@
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20241214-918efc9/MODULE.bazel": "24e05f6f52f37be63a795192848555a2c8c855e7814dbc1ed419fb04a7005464",
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20250128-4de3c74/MODULE.bazel": "1fe72489212c530086e3ffb0e018b2bfef4663200ca03571570f9f006bef1d75",
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20250128-4de3c74/source.json": "028519164a2e24563f4b43d810fdedc702daed90e71e7042d45ba82ad807b46f",
-    "https://bcr.bazel.build/modules/flatbuffers/25.2.10/MODULE.bazel": "dab15cafe8512d2c4a8daa44c2d7968c5c79f01e220d40076cdc260bf58605e2",
-    "https://bcr.bazel.build/modules/flatbuffers/25.2.10/source.json": "7eae7ea3eb913b9802426e4d5df11d6c6072a3573a548f8cabf1e965f5cca4d0",
+    "https://bcr.bazel.build/modules/flatbuffers/25.9.23/MODULE.bazel": "32753ba60bf3bacfe7737c0f3e8e3e55624b19af5d398c485580d57492d145d8",
+    "https://bcr.bazel.build/modules/flatbuffers/25.9.23/source.json": "a2116f0017f6896353fd3abf65ef2b89b0a257e8a87f395c5000f53934829f31",
     "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/MODULE.bazel": "cdf8cbe5ee750db04b78878c9633cc76e80dcf4416cbe982ac3a9222f80713c8",
     "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/source.json": "fa7b512dfcb5eafd90ce3959cf42a2a6fe96144ebbb4b3b3928054895f2afac2",
     "https://bcr.bazel.build/modules/gazelle/0.27.0/MODULE.bazel": "3446abd608295de6d90b4a8a118ed64a9ce11dcb3dda2dc3290a22056bd20996",
@@ -115,8 +119,8 @@
     "https://bcr.bazel.build/modules/gazelle/0.34.0/MODULE.bazel": "abdd8ce4d70978933209db92e436deb3a8b737859e9354fb5fd11fb5c2004c8a",
     "https://bcr.bazel.build/modules/gazelle/0.36.0/MODULE.bazel": "e375d5d6e9a6ca59b0cb38b0540bc9a05b6aa926d322f2de268ad267a2ee74c0",
     "https://bcr.bazel.build/modules/gazelle/0.37.0/MODULE.bazel": "d1327ba0907d0275ed5103bfbbb13518f6c04955b402213319d0d6c0ce9839d4",
-    "https://bcr.bazel.build/modules/gazelle/0.45.0/MODULE.bazel": "ecd19ebe9f8e024e1ccffb6d997cc893a974bcc581f1ae08f386bdd448b10687",
-    "https://bcr.bazel.build/modules/gazelle/0.45.0/source.json": "111d182facc5f5e80f0b823d5f077b74128f40c3fd2eccc89a06f34191bd3392",
+    "https://bcr.bazel.build/modules/gazelle/0.47.0/MODULE.bazel": "b61bb007c4efad134aa30ee7f4a8e2a39b22aa5685f005edaa022fbd1de43ebc",
+    "https://bcr.bazel.build/modules/gazelle/0.47.0/source.json": "aeb2e5df14b7fb298625d75d08b9c65bdb0b56014c5eb89da9e5dd0572280ae6",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.2/MODULE.bazel": "a70cf1bba851000ba93b58ae2f6d76490a9feb74192e57ab8e8ff13c34ec50cb",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.4/MODULE.bazel": "c6d54a11dcf64ee63545f42561eda3fd94c1b5f5ebe1357011de63ae33739d5e",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.5/MODULE.bazel": "9ba9b31b984022828a950e3300410977eda2e35df35584c6b0b2d0c2e52766b7",
@@ -176,6 +180,7 @@
     "https://bcr.bazel.build/modules/opentracing-cpp/1.6.0/MODULE.bazel": "b3925269f63561b8b880ae7cf62ccf81f6ece55b62cd791eda9925147ae116ec",
     "https://bcr.bazel.build/modules/opentracing-cpp/1.6.0/source.json": "da1cb1add160f5e5074b7272e9db6fd8f1b3336c15032cd0a653af9d2f484aed",
     "https://bcr.bazel.build/modules/package_metadata/0.0.2/MODULE.bazel": "fb8d25550742674d63d7b250063d4580ca530499f045d70748b1b142081ebb92",
+    "https://bcr.bazel.build/modules/package_metadata/0.0.3/MODULE.bazel": "77890552ecea9e284b5424c9de827a58099348763a4359e975c359a83d4faa83",
     "https://bcr.bazel.build/modules/package_metadata/0.0.5/MODULE.bazel": "ef4f9439e3270fdd6b9fd4dbc3d2f29d13888e44c529a1b243f7a31dfbc2e8e4",
     "https://bcr.bazel.build/modules/package_metadata/0.0.5/source.json": "2326db2f6592578177751c3e1f74786b79382cd6008834c9d01ec865b9126a85",
     "https://bcr.bazel.build/modules/platforms/0.0.10/MODULE.bazel": "8cb8efaf200bdeb2150d93e162c40f388529a25852b332cec879373771e48ed5",
@@ -229,9 +234,9 @@
     "https://bcr.bazel.build/modules/rules_android/0.1.1/MODULE.bazel": "48809ab0091b07ad0182defb787c4c5328bd3a278938415c00a7b69b50c4d3a8",
     "https://bcr.bazel.build/modules/rules_android/0.1.1/source.json": "e6986b41626ee10bdc864937ffb6d6bf275bb5b9c65120e6137d56e6331f089e",
     "https://bcr.bazel.build/modules/rules_apple/3.16.0/MODULE.bazel": "0d1caf0b8375942ce98ea944be754a18874041e4e0459401d925577624d3a54a",
-    "https://bcr.bazel.build/modules/rules_apple/3.16.1/MODULE.bazel": "8294474defa70af2534a558ab905c083d69203344145e6f7d544d5098611ec7d",
-    "https://bcr.bazel.build/modules/rules_apple/3.16.1/source.json": "9190fd9d34a5d048bfbba8a530a57f2c2bf3f61e5634a9ab0b6ab005458857f9",
     "https://bcr.bazel.build/modules/rules_apple/3.5.1/MODULE.bazel": "3d1bbf65ad3692003d36d8a29eff54d4e5c1c5f4bfb60f79e28646a924d9101c",
+    "https://bcr.bazel.build/modules/rules_apple/4.3.3/MODULE.bazel": "c5c2c4adeeac5f3f2f9b7f16abfa8be7ffefa596171d0d92bed4cae9ade0a498",
+    "https://bcr.bazel.build/modules/rules_apple/4.3.3/source.json": "3cb1d69c8243ffcc42ecbf84ae8b9cccd7b1e2f091b0aee5a3e9c9a45267f312",
     "https://bcr.bazel.build/modules/rules_buf/0.1.1/MODULE.bazel": "6189aec18a4f7caff599ad41b851ab7645d4f1e114aa6431acf9b0666eb92162",
     "https://bcr.bazel.build/modules/rules_cc/0.0.1/MODULE.bazel": "cb2aa0747f84c6c3a78dad4e2049c154f08ab9d166b1273835a8174940365647",
     "https://bcr.bazel.build/modules/rules_cc/0.0.10/MODULE.bazel": "ec1705118f7eaedd6e118508d3d26deba2a4e76476ada7e0e3965211be012002",
@@ -246,6 +251,8 @@
     "https://bcr.bazel.build/modules/rules_cc/0.0.8/MODULE.bazel": "964c85c82cfeb6f3855e6a07054fdb159aced38e99a5eecf7bce9d53990afa3e",
     "https://bcr.bazel.build/modules/rules_cc/0.0.9/MODULE.bazel": "836e76439f354b89afe6a911a7adf59a6b2518fafb174483ad78a2a2fde7b1c5",
     "https://bcr.bazel.build/modules/rules_cc/0.1.1/MODULE.bazel": "2f0222a6f229f0bf44cd711dc13c858dad98c62d52bd51d8fc3a764a83125513",
+    "https://bcr.bazel.build/modules/rules_cc/0.1.2/MODULE.bazel": "557ddc3a96858ec0d465a87c0a931054d7dcfd6583af2c7ed3baf494407fd8d0",
+    "https://bcr.bazel.build/modules/rules_cc/0.1.5/MODULE.bazel": "88dfc9361e8b5ae1008ac38f7cdfd45ad738e4fa676a3ad67d19204f045a1fd8",
     "https://bcr.bazel.build/modules/rules_cc/0.2.14/MODULE.bazel": "353c99ed148887ee89c54a17d4100ae7e7e436593d104b668476019023b58df8",
     "https://bcr.bazel.build/modules/rules_cc/0.2.14/source.json": "55d0a4587c5592fad350f6e698530f4faf0e7dd15e69d43f8d87e220c78bea54",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.10.1/MODULE.bazel": "b9527010e5fef060af92b6724edb3691970a5b1f76f74b21d39f7d433641be60",
@@ -263,8 +270,8 @@
     "https://bcr.bazel.build/modules/rules_go/0.48.0/MODULE.bazel": "d00ebcae0908ee3f5e6d53f68677a303d6d59a77beef879598700049c3980a03",
     "https://bcr.bazel.build/modules/rules_go/0.50.1/MODULE.bazel": "b91a308dc5782bb0a8021ad4330c81fea5bda77f96b9e4c117b9b9c8f6665ee0",
     "https://bcr.bazel.build/modules/rules_go/0.53.0/MODULE.bazel": "a4ed760d3ac0dbc0d7b967631a9a3fd9100d28f7d9fcf214b4df87d4bfff5f9a",
-    "https://bcr.bazel.build/modules/rules_go/0.56.1/MODULE.bazel": "d5b835c548ac917345f1780cd2da52edc1130a908fe091c92096895303ae78a0",
-    "https://bcr.bazel.build/modules/rules_go/0.56.1/source.json": "0c902f7272e8d4e47e459af97be472bc19dadbbe6023a0719d1adce8483ac75a",
+    "https://bcr.bazel.build/modules/rules_go/0.59.0/MODULE.bazel": "b7e43e7414a3139a7547d1b4909b29085fbe5182b6c58cbe1ed4c6272815aeae",
+    "https://bcr.bazel.build/modules/rules_go/0.59.0/source.json": "1df17bb7865cfc029492c30163cee891d0dd8658ea0d5bfdf252c4b6db5c1ef6",
     "https://bcr.bazel.build/modules/rules_java/4.0.0/MODULE.bazel": "5a78a7ae82cd1a33cef56dc578c7d2a46ed0dca12643ee45edbb8417899e6f74",
     "https://bcr.bazel.build/modules/rules_java/5.1.0/MODULE.bazel": "324b6478b0343a3ce7a9add8586ad75d24076d6d43d2f622990b9c1cfd8a1b15",
     "https://bcr.bazel.build/modules/rules_java/5.3.5/MODULE.bazel": "a4ec4f2db570171e3e5eb753276ee4b389bae16b96207e9d3230895c99644b86",
@@ -292,7 +299,8 @@
     "https://bcr.bazel.build/modules/rules_jvm_external/6.0/MODULE.bazel": "37c93a5a78d32e895d52f86a8d0416176e915daabd029ccb5594db422e87c495",
     "https://bcr.bazel.build/modules/rules_jvm_external/6.1/MODULE.bazel": "75b5fec090dbd46cf9b7d8ea08cf84a0472d92ba3585b476f44c326eda8059c4",
     "https://bcr.bazel.build/modules/rules_jvm_external/6.3/MODULE.bazel": "c998e060b85f71e00de5ec552019347c8bca255062c990ac02d051bb80a38df0",
-    "https://bcr.bazel.build/modules/rules_jvm_external/6.3/source.json": "6f5f5a5a4419ae4e37c35a5bb0a6ae657ed40b7abc5a5189111b47fcebe43197",
+    "https://bcr.bazel.build/modules/rules_jvm_external/6.9/MODULE.bazel": "07c5db05527db7744a54fcffd653e1550d40e0540207a7f7e6d0a4de5bef8274",
+    "https://bcr.bazel.build/modules/rules_jvm_external/6.9/source.json": "b12970214f3cc144b26610caeb101fa622d910f1ab3d98f0bae1058edbd00bd4",
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.0/MODULE.bazel": "ef85697305025e5a61f395d4eaede272a5393cee479ace6686dba707de804d59",
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/MODULE.bazel": "d269a01a18ee74d0335450b10f62c9ed81f2321d7958a2934e44272fe82dcef3",
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/source.json": "2faa4794364282db7c06600b7e5e34867a564ae91bda7cae7c29c64e9466b7d5",
@@ -306,12 +314,12 @@
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.0/MODULE.bazel": "45345e4aba35dd6e4701c1eebf5a4e67af4ed708def9ebcdc6027585b34ee52d",
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.3/MODULE.bazel": "b66eadebd10f1f1b25f52f95ab5213a57e82c37c3f656fcd9a57ad04d2264ce7",
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.3/source.json": "45bd343155bdfed2543f0e39b80ff3f6840efc31975da4b5795797f4c94147ad",
-    "https://bcr.bazel.build/modules/rules_oci/2.2.6/MODULE.bazel": "2ba6ddd679269e00aeffe9ca04faa2d0ca4129650982c9246d0d459fe2da47d9",
-    "https://bcr.bazel.build/modules/rules_oci/2.2.6/source.json": "94e7decb8f95d9465b0bbea71c65064cd16083be1350c7468f131818641dc4a5",
+    "https://bcr.bazel.build/modules/rules_oci/2.2.7/MODULE.bazel": "f6150e4b224d459f7f6523ef65967464ca4efdd266c7fbf2f5a2a51011957e0c",
+    "https://bcr.bazel.build/modules/rules_oci/2.2.7/source.json": "b099f02af330f47f19dc67fc9300ef6e1937a8c86882690db0e7a2fcea8c7f6b",
     "https://bcr.bazel.build/modules/rules_pkg/0.7.0/MODULE.bazel": "df99f03fc7934a4737122518bb87e667e62d780b610910f0447665a7e2be62dc",
     "https://bcr.bazel.build/modules/rules_pkg/1.0.1/MODULE.bazel": "5b1df97dbc29623bccdf2b0dcd0f5cb08e2f2c9050aab1092fd39a41e82686ff",
-    "https://bcr.bazel.build/modules/rules_pkg/1.1.0/MODULE.bazel": "9db8031e71b6ef32d1846106e10dd0ee2deac042bd9a2de22b4761b0c3036453",
-    "https://bcr.bazel.build/modules/rules_pkg/1.1.0/source.json": "fef768df13a92ce6067e1cd0cdc47560dace01354f1d921cfb1d632511f7d608",
+    "https://bcr.bazel.build/modules/rules_pkg/1.2.0/MODULE.bazel": "c7db3c2b407e673c7a39e3625dc05dc9f12d6682cbd82a3a5924a13b491eda7e",
+    "https://bcr.bazel.build/modules/rules_pkg/1.2.0/source.json": "9062e00845bf91a4247465d371baa837adf9b6ff44c542f73ba084f07667e1dc",
     "https://bcr.bazel.build/modules/rules_proto/4.0.0/MODULE.bazel": "a7a7b6ce9bee418c1a760b3d84f83a299ad6952f9903c67f19e4edd964894e06",
     "https://bcr.bazel.build/modules/rules_proto/5.3.0-21.7/MODULE.bazel": "e8dff86b0971688790ae75528fe1813f71809b5afd57facb44dad9e8eca631b7",
     "https://bcr.bazel.build/modules/rules_proto/6.0.0-rc1/MODULE.bazel": "1e5b502e2e1a9e825eef74476a5a1ee524a92297085015a052510b09a1a09483",
@@ -334,7 +342,8 @@
     "https://bcr.bazel.build/modules/rules_python/0.4.0/MODULE.bazel": "9208ee05fd48bf09ac60ed269791cf17fb343db56c8226a720fbb1cdf467166c",
     "https://bcr.bazel.build/modules/rules_python/0.40.0/MODULE.bazel": "9d1a3cd88ed7d8e39583d9ffe56ae8a244f67783ae89b60caafc9f5cf318ada7",
     "https://bcr.bazel.build/modules/rules_python/1.0.0/MODULE.bazel": "898a3d999c22caa585eb062b600f88654bf92efb204fa346fb55f6f8edffca43",
-    "https://bcr.bazel.build/modules/rules_python/1.0.0/source.json": "b0162a65c6312e45e7912e39abd1a7f8856c2c7e41ecc9b6dc688a6f6400a917",
+    "https://bcr.bazel.build/modules/rules_python/1.3.0/MODULE.bazel": "8361d57eafb67c09b75bf4bbe6be360e1b8f4f18118ab48037f2bd50aa2ccb13",
+    "https://bcr.bazel.build/modules/rules_python/1.3.0/source.json": "25932f917cd279c7baefa6cb1d3fa8750a7a29de522024449b19af6eab51f4a0",
     "https://bcr.bazel.build/modules/rules_rust/0.45.1/MODULE.bazel": "a69d0db3a958fab2c6520961e1b2287afcc8b36690fd31bbc4f6f7391397150d",
     "https://bcr.bazel.build/modules/rules_scala/7.1.1/MODULE.bazel": "b1f80c52ae49b27d41b9291d8b328b69247de2b7596d35d09afe6147b82cf562",
     "https://bcr.bazel.build/modules/rules_scala/7.1.1/source.json": "5038cb231d4020c5965c920681cf961a7bf137b40315025e40f3a7b6a0ac1f0f",
@@ -345,8 +354,8 @@
     "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca",
     "https://bcr.bazel.build/modules/rules_swift/1.18.0/MODULE.bazel": "a6aba73625d0dc64c7b4a1e831549b6e375fbddb9d2dde9d80c9de6ec45b24c9",
     "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046",
-    "https://bcr.bazel.build/modules/rules_swift/2.3.1/MODULE.bazel": "0b42093600d9226bcbdb31fb86d25d4204293d716fdbb2e50a1852547032a660",
-    "https://bcr.bazel.build/modules/rules_swift/2.3.1/source.json": "87d28609c37d2061db2f6fc3aae8ab7fbda9adf556cd88fbd0c7d520b8d81391",
+    "https://bcr.bazel.build/modules/rules_swift/2.4.0/MODULE.bazel": "1639617eb1ede28d774d967a738b4a68b0accb40650beadb57c21846beab5efd",
+    "https://bcr.bazel.build/modules/rules_swift/2.4.0/source.json": "a6577f57f9febbdc015a01f2a8f3487422032f134d6c61d18ed8e8ca3b9acc7c",
     "https://bcr.bazel.build/modules/stardoc/0.5.0/MODULE.bazel": "f9f1f46ba8d9c3362648eea571c6f9100680efc44913618811b58cc9c02cd678",
     "https://bcr.bazel.build/modules/stardoc/0.5.1/MODULE.bazel": "1a05d92974d0c122f5ccf09291442580317cdd859f07a8655f1db9a60374f9f8",
     "https://bcr.bazel.build/modules/stardoc/0.5.3/MODULE.bazel": "c7f6948dae6999bf0db32c1858ae345f112cacf98f174c7a8bb707e41b974f1c",
@@ -360,6 +369,7 @@
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/source.json": "32bd87e5f4d7acc57c5b2ff7c325ae3061d5e242c0c4c214ae87e0f1c13e54cb",
     "https://bcr.bazel.build/modules/tar.bzl/0.2.1/MODULE.bazel": "52d1c00a80a8cc67acbd01649e83d8dd6a9dc426a6c0b754a04fe8c219c76468",
+    "https://bcr.bazel.build/modules/tar.bzl/0.5.1/MODULE.bazel": "7c2eb3dcfc53b0f3d6f9acdfd911ca803eaf92aadf54f8ca6e4c1f3aee288351",
     "https://bcr.bazel.build/modules/tar.bzl/0.6.0/MODULE.bazel": "a3584b4edcfafcabd9b0ef9819808f05b372957bbdff41601429d5fd0aac2e7c",
     "https://bcr.bazel.build/modules/tar.bzl/0.6.0/source.json": "4a620381df075a16cb3a7ed57bd1d05f7480222394c64a20fa51bdb636fda658",
     "https://bcr.bazel.build/modules/toolchains_llvm/1.6.0/MODULE.bazel": "39603859cafb1c6830160fcd6370552e836790e6abb2bfb8d13bff53c0c10a64",
@@ -386,7 +396,7 @@
     "@@apple_support~//crosstool:setup.bzl%apple_cc_configure_extension": {
       "general": {
         "bzlTransitiveDigest": "Z3yAd66IJL0GAZUTSeMOjoHiE1SZPPwiIs/XQui5BvE=",
-        "usagesDigest": "TOb4CUri5UsTKxgIDTNzR0ddIc21eYLCRIm+jqQmjlg=",
+        "usagesDigest": "DqQsfZN5lA8z+nLEEY+EpKGzQ8M73mDm/A8lofDSyus=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -413,7 +423,7 @@
     },
     "@@aspect_rules_esbuild~//esbuild:extensions.bzl%esbuild": {
       "general": {
-        "bzlTransitiveDigest": "8jv3p0xDR/oitFeH8y0+Y5xlyrUbfsTRlc9TSwYkwl8=",
+        "bzlTransitiveDigest": "8L5Llfl6uxIWXd5GR+Qmmm04/jxp6TuJH5LFhIZIUCA=",
         "usagesDigest": "iDVoyPxUeADmfK8ssoyG3Ehq1bj6p7A43LpEiE266os=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
@@ -492,6 +502,7 @@
               "extra_build_content": "",
               "generate_bzl_library_targets": false,
               "extract_full_archive": false,
+              "exclude_package_contents": [],
               "system_tar": "auto"
             }
           },
@@ -516,11 +527,17 @@
               "package_visibility": [
                 "//visibility:public"
               ],
-              "replace_package": ""
+              "replace_package": "",
+              "exclude_package_contents": []
             }
           }
         },
         "recordedRepoMappingEntries": [
+          [
+            "aspect_bazel_lib~",
+            "bazel_lib",
+            "bazel_lib~"
+          ],
           [
             "aspect_bazel_lib~",
             "bazel_skylib",
@@ -531,6 +548,11 @@
             "bazel_tools",
             "bazel_tools"
           ],
+          [
+            "aspect_bazel_lib~",
+            "tar.bzl",
+            "tar.bzl~"
+          ],
           [
             "aspect_rules_esbuild~",
             "aspect_rules_js",
@@ -546,6 +568,11 @@
             "aspect_bazel_lib",
             "aspect_bazel_lib~"
           ],
+          [
+            "aspect_rules_js~",
+            "aspect_rules_js",
+            "aspect_rules_js~"
+          ],
           [
             "aspect_rules_js~",
             "bazel_skylib",
@@ -555,6 +582,470 @@
             "aspect_rules_js~",
             "bazel_tools",
             "bazel_tools"
+          ],
+          [
+            "bazel_lib~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "bazel_lib~",
+            "bazel_tools",
+            "bazel_tools"
+          ],
+          [
+            "tar.bzl~",
+            "aspect_bazel_lib",
+            "aspect_bazel_lib~"
+          ],
+          [
+            "tar.bzl~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "tar.bzl~",
+            "tar.bzl",
+            "tar.bzl~"
+          ]
+        ]
+      }
+    },
+    "@@aspect_rules_js~//npm:extensions.bzl%pnpm": {
+      "general": {
+        "bzlTransitiveDigest": "T22SdPzhLxF1CM+j9RD/Rq03yJ0NDfH2eE6hAbUcOII=",
+        "usagesDigest": "6rWte4KDbiluq1s7w98bc4+2NjA8w67DKHDj4+DNw/Y=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "pnpm": {
+            "bzlFile": "@@aspect_rules_js~//npm/private:npm_import.bzl",
+            "ruleClassName": "npm_import_rule",
+            "attributes": {
+              "package": "pnpm",
+              "version": "8.6.7",
+              "root_package": "",
+              "link_workspace": "",
+              "link_packages": {},
+              "integrity": "sha512-vRIWpD/L4phf9Bk2o/O2TDR8fFoJnpYrp2TKqTIZF/qZ2/rgL3qKXzHofHgbXsinwMoSEigz28sqk3pQ+yMEQQ==",
+              "url": "",
+              "commit": "",
+              "patch_args": [
+                "-p0"
+              ],
+              "patches": [],
+              "custom_postinstall": "",
+              "npm_auth": "",
+              "npm_auth_basic": "",
+              "npm_auth_username": "",
+              "npm_auth_password": "",
+              "lifecycle_hooks": [],
+              "extra_build_content": "load(\"@aspect_rules_js//js:defs.bzl\", \"js_binary\")\njs_binary(name = \"pnpm\", data = glob([\"package/**\"]), entry_point = \"package/dist/pnpm.cjs\", visibility = [\"//visibility:public\"])",
+              "generate_bzl_library_targets": false,
+              "extract_full_archive": true,
+              "exclude_package_contents": [],
+              "system_tar": "auto"
+            }
+          },
+          "pnpm__links": {
+            "bzlFile": "@@aspect_rules_js~//npm/private:npm_import.bzl",
+            "ruleClassName": "npm_import_links",
+            "attributes": {
+              "package": "pnpm",
+              "version": "8.6.7",
+              "dev": false,
+              "root_package": "",
+              "link_packages": {},
+              "deps": {},
+              "transitive_closure": {},
+              "lifecycle_build_target": false,
+              "lifecycle_hooks_env": [],
+              "lifecycle_hooks_execution_requirements": [
+                "no-sandbox"
+              ],
+              "lifecycle_hooks_use_default_shell_env": false,
+              "bins": {},
+              "package_visibility": [
+                "//visibility:public"
+              ],
+              "replace_package": "",
+              "exclude_package_contents": []
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "aspect_bazel_lib~",
+            "bazel_lib",
+            "bazel_lib~"
+          ],
+          [
+            "aspect_bazel_lib~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "aspect_bazel_lib~",
+            "bazel_tools",
+            "bazel_tools"
+          ],
+          [
+            "aspect_bazel_lib~",
+            "tar.bzl",
+            "tar.bzl~"
+          ],
+          [
+            "aspect_rules_js~",
+            "aspect_bazel_lib",
+            "aspect_bazel_lib~"
+          ],
+          [
+            "aspect_rules_js~",
+            "aspect_rules_js",
+            "aspect_rules_js~"
+          ],
+          [
+            "aspect_rules_js~",
+            "bazel_features",
+            "bazel_features~"
+          ],
+          [
+            "aspect_rules_js~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "aspect_rules_js~",
+            "bazel_tools",
+            "bazel_tools"
+          ],
+          [
+            "bazel_features~",
+            "bazel_features_globals",
+            "bazel_features~~version_extension~bazel_features_globals"
+          ],
+          [
+            "bazel_features~",
+            "bazel_features_version",
+            "bazel_features~~version_extension~bazel_features_version"
+          ],
+          [
+            "bazel_lib~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "bazel_lib~",
+            "bazel_tools",
+            "bazel_tools"
+          ],
+          [
+            "tar.bzl~",
+            "aspect_bazel_lib",
+            "aspect_bazel_lib~"
+          ],
+          [
+            "tar.bzl~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "tar.bzl~",
+            "tar.bzl",
+            "tar.bzl~"
+          ]
+        ]
+      }
+    },
+    "@@aspect_rules_ts~//ts:extensions.bzl%ext": {
+      "general": {
+        "bzlTransitiveDigest": "h1hftyFCdJgiHD9blfFcMAiEk5ltEoUdNkuHPIkg/hM=",
+        "usagesDigest": "v0aTa4/gasWF2bvssXYr1bqcYWc3kjV48hcj0z2QVT0=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "npm_typescript": {
+            "bzlFile": "@@aspect_rules_ts~//ts/private:npm_repositories.bzl",
+            "ruleClassName": "http_archive_version",
+            "attributes": {
+              "bzlmod": true,
+              "version": "5.8.3",
+              "integrity": "",
+              "build_file": "@@aspect_rules_ts~//ts:BUILD.typescript",
+              "build_file_substitutions": {
+                "bazel_worker_version": "5.4.2",
+                "google_protobuf_version": "3.20.1"
+              },
+              "urls": [
+                "https://registry.npmjs.org/typescript/-/typescript-{}.tgz"
+              ]
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "aspect_rules_ts~",
+            "bazel_tools",
+            "bazel_tools"
+          ]
+        ]
+      }
+    },
+    "@@cel-spec~//:extensions.bzl%non_module_dependencies": {
+      "general": {
+        "bzlTransitiveDigest": "/2uyuQa5purSharolRXYOGYMGSGjDeByo6JfQDWsraA=",
+        "usagesDigest": "2f6juplOpWu+UdD1kVgi773xavnFQ+OcH0PRuQduDxY=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "com_google_googleapis": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_archive",
+            "attributes": {
+              "sha256": "bd8e735d881fb829751ecb1a77038dda4a8d274c45490cb9fcf004583ee10571",
+              "strip_prefix": "googleapis-07c27163ac591955d736f3057b1619ece66f5b99",
+              "urls": [
+                "https://github.com/googleapis/googleapis/archive/07c27163ac591955d736f3057b1619ece66f5b99.tar.gz"
+              ]
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "cel-spec~",
+            "bazel_tools",
+            "bazel_tools"
+          ]
+        ]
+      }
+    },
+    "@@cel-spec~//:googleapis_ext.bzl%googleapis_ext": {
+      "general": {
+        "bzlTransitiveDigest": "yun2jmsomFi3bs5bjQWXApBzqQf66zBJ39JEBYigzdc=",
+        "usagesDigest": "OK8FsLndSl2AbwGM1Npe5NdHR1kDAebcw7Ee+KkekE0=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "com_google_googleapis_imports": {
+            "bzlFile": "@@cel-spec~~non_module_dependencies~com_google_googleapis//:repository_rules.bzl",
+            "ruleClassName": "switched_rules",
+            "attributes": {
+              "rules": {
+                "proto_library_with_info": [
+                  "",
+                  ""
+                ],
+                "moved_proto_library": [
+                  "",
+                  ""
+                ],
+                "java_proto_library": [
+                  "",
+                  ""
+                ],
+                "java_grpc_library": [
+                  "",
+                  ""
+                ],
+                "java_gapic_library": [
+                  "",
+                  ""
+                ],
+                "java_gapic_test": [
+                  "",
+                  ""
+                ],
+                "java_gapic_assembly_gradle_pkg": [
+                  "",
+                  ""
+                ],
+                "py_proto_library": [
+                  "",
+                  ""
+                ],
+                "py_grpc_library": [
+                  "",
+                  ""
+                ],
+                "py_gapic_library": [
+                  "",
+                  ""
+                ],
+                "py_test": [
+                  "",
+                  ""
+                ],
+                "py_gapic_assembly_pkg": [
+                  "",
+                  ""
+                ],
+                "py_import": [
+                  "",
+                  ""
+                ],
+                "go_proto_library": [
+                  "",
+                  ""
+                ],
+                "go_library": [
+                  "",
+                  ""
+                ],
+                "go_test": [
+                  "",
+                  ""
+                ],
+                "go_gapic_library": [
+                  "",
+                  ""
+                ],
+                "go_gapic_assembly_pkg": [
+                  "",
+                  ""
+                ],
+                "cc_proto_library": [
+                  "native.cc_proto_library",
+                  ""
+                ],
+                "cc_grpc_library": [
+                  "",
+                  ""
+                ],
+                "cc_gapic_library": [
+                  "",
+                  ""
+                ],
+                "php_proto_library": [
+                  "",
+                  "php_proto_library"
+                ],
+                "php_grpc_library": [
+                  "",
+                  "php_grpc_library"
+                ],
+                "php_gapic_library": [
+                  "",
+                  "php_gapic_library"
+                ],
+                "php_gapic_assembly_pkg": [
+                  "",
+                  "php_gapic_assembly_pkg"
+                ],
+                "nodejs_gapic_library": [
+                  "",
+                  "typescript_gapic_library"
+                ],
+                "nodejs_gapic_assembly_pkg": [
+                  "",
+                  "typescript_gapic_assembly_pkg"
+                ],
+                "ruby_proto_library": [
+                  "",
+                  ""
+                ],
+                "ruby_grpc_library": [
+                  "",
+                  ""
+                ],
+                "ruby_ads_gapic_library": [
+                  "",
+                  ""
+                ],
+                "ruby_cloud_gapic_library": [
+                  "",
+                  ""
+                ],
+                "ruby_gapic_assembly_pkg": [
+                  "",
+                  ""
+                ],
+                "csharp_proto_library": [
+                  "",
+                  ""
+                ],
+                "csharp_grpc_library": [
+                  "",
+                  ""
+                ],
+                "csharp_gapic_library": [
+                  "",
+                  ""
+                ],
+                "csharp_gapic_assembly_pkg": [
+                  "",
+                  ""
+                ]
+              }
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "cel-spec~",
+            "com_google_googleapis",
+            "cel-spec~~non_module_dependencies~com_google_googleapis"
+          ]
+        ]
+      }
+    },
+    "@@envoy_api~//bazel:repositories.bzl%non_module_deps": {
+      "general": {
+        "bzlTransitiveDigest": "6TqmRfVELxZJRPQYuJpC4JBX4QvdrHqTDOUJGOGODSo=",
+        "usagesDigest": "IivjlawPvqhHPUJ3c6dLiPsH22mn/g/dJtlmv3zdimM=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "prometheus_metrics_model": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_archive",
+            "attributes": {
+              "urls": [
+                "https://github.com/prometheus/client_model/archive/v0.6.1.tar.gz"
+              ],
+              "sha256": "b9b690bc35d80061f255faa7df7621eae39fe157179ccd78ff6409c3b004f05e",
+              "strip_prefix": "client_model-0.6.1",
+              "build_file_content": "\nload(\"@envoy_api//bazel:api_build_system.bzl\", \"api_cc_py_proto_library\")\nload(\"@io_bazel_rules_go//proto:def.bzl\", \"go_proto_library\")\n\napi_cc_py_proto_library(\n    name = \"client_model\",\n    srcs = [\n        \"io/prometheus/client/metrics.proto\",\n    ],\n    visibility = [\"//visibility:public\"],\n)\n\ngo_proto_library(\n    name = \"client_model_go_proto\",\n    importpath = \"github.com/prometheus/client_model/go\",\n    proto = \":client_model\",\n    visibility = [\"//visibility:public\"],\n)\n"
+            }
+          },
+          "com_github_bufbuild_buf": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_archive",
+            "attributes": {
+              "urls": [
+                "https://github.com/bufbuild/buf/releases/download/v1.49.0/buf-Linux-x86_64.tar.gz"
+              ],
+              "sha256": "ee8da9748249f7946d79191e36469ce7bc3b8ba80019bff1fa4289a44cbc23bf",
+              "strip_prefix": "buf",
+              "build_file_content": "\npackage(\n    default_visibility = [\"//visibility:public\"],\n)\n\nfilegroup(\n    name = \"buf\",\n    srcs = [\n        \"@com_github_bufbuild_buf//:bin/buf\",\n    ],\n    tags = [\"manual\"], # buf is downloaded as a linux binary; tagged manual to prevent build for non-linux users\n)\n"
+            }
+          },
+          "envoy_toolshed": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_archive",
+            "attributes": {
+              "urls": [
+                "https://github.com/envoyproxy/toolshed/archive/bazel-v0.2.2.tar.gz"
+              ],
+              "sha256": "443fe177aba0cef8c17b7a48905c925c67b09005b10dd70ff12cd9f729a72d51",
+              "strip_prefix": "toolshed-bazel-v0.2.2/bazel"
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "envoy_api~",
+            "bazel_tools",
+            "bazel_tools"
+          ],
+          [
+            "envoy_api~",
+            "envoy_api",
+            "envoy_api~"
           ]
         ]
       }
@@ -727,6 +1218,37 @@
         "recordedRepoMappingEntries": []
       }
     },
+    "@@pybind11_bazel~//:internal_configure.bzl%internal_configure_extension": {
+      "general": {
+        "bzlTransitiveDigest": "CyAKLVVonohnkTSqg9II/HA7M49sOlnMkgMHL3CmDuc=",
+        "usagesDigest": "mFrTHX5eCiNU/OIIGVHH3cOILY9Zmjqk8RQYv8o6Thk=",
+        "recordedFileInputs": {
+          "@@pybind11_bazel~//MODULE.bazel": "e6f4c20442eaa7c90d7190d8dc539d0ab422f95c65a57cc59562170c58ae3d34"
+        },
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "pybind11": {
+            "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
+            "ruleClassName": "http_archive",
+            "attributes": {
+              "build_file": "@@pybind11_bazel~//:pybind11-BUILD.bazel",
+              "strip_prefix": "pybind11-2.12.0",
+              "urls": [
+                "https://github.com/pybind/pybind11/archive/v2.12.0.zip"
+              ]
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "pybind11_bazel~",
+            "bazel_tools",
+            "bazel_tools"
+          ]
+        ]
+      }
+    },
     "@@rules_foreign_cc~//foreign_cc:extensions.bzl%tools": {
       "general": {
         "bzlTransitiveDigest": "a7qnESofmIRYId6wwGNPJ9kvExU80KrkxL281P3+lBE=",
@@ -1162,7 +1684,7 @@
     "@@rules_nodejs~//nodejs:extensions.bzl%node": {
       "general": {
         "bzlTransitiveDigest": "q44Ox2Nwogn6OsO0Xw5lhjkd/xmxkvvpwVOn5P4pmHQ=",
-        "usagesDigest": "WQpLKLujnBfrx9sMWCJgyaK9P04binseT6CGBy3vP4E=",
+        "usagesDigest": "Py5Wgc5kr5fTMe1FKrlFK276B6SodesXp6nw2Fq5XA8=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -1292,8 +1814,8 @@
     },
     "@@rules_oci~//oci:extensions.bzl%oci": {
       "general": {
-        "bzlTransitiveDigest": "FaY+7xb13bB3hmxqwAWaGp3Tf3Q4Nfdlr+F38CP5mcg=",
-        "usagesDigest": "39yHQmifPoGf+JSYpnQSnJGugxbrFVge/+ENmUiqZ6M=",
+        "bzlTransitiveDigest": "AOLP47LtVHSKSDiukosQymx543OwcgeoQP666wwuj3o=",
+        "usagesDigest": "3Xsv1/UEV8MOARW4BZScPw3Gxtx19OQ5EXOqcL1p9bI=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -1580,6 +2102,43 @@
         ]
       }
     },
+    "@@rules_python~//python/uv:uv.bzl%uv": {
+      "general": {
+        "bzlTransitiveDigest": "Xpqjnjzy6zZ90Es9Wa888ZLHhn7IsNGbph/e6qoxzw8=",
+        "usagesDigest": "qI5PVlIum/YAnGJg5oXGHzDkMFWt2aNSUZY4G8PBbic=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "uv": {
+            "bzlFile": "@@rules_python~//python/uv/private:uv_toolchains_repo.bzl",
+            "ruleClassName": "uv_toolchains_repo",
+            "attributes": {
+              "toolchain_type": "'@@rules_python~//python/uv:uv_toolchain_type'",
+              "toolchain_names": [
+                "none"
+              ],
+              "toolchain_implementations": {
+                "none": "'@@rules_python~//python:none'"
+              },
+              "toolchain_compatible_with": {
+                "none": [
+                  "@platforms//:incompatible"
+                ]
+              },
+              "toolchain_target_settings": {}
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "rules_python~",
+            "platforms",
+            "platforms"
+          ]
+        ]
+      }
+    },
     "@@rules_scala~//scala/extensions:config.bzl%scala_config": {
       "general": {
         "bzlTransitiveDigest": "TdBxhkZTM7VU6teIFS+KoonKU7wmb5BL7leCWWx7yX8=",
@@ -5056,7 +5615,7 @@
     "@@rules_swift~//swift:extensions.bzl%non_module_deps": {
       "general": {
         "bzlTransitiveDigest": "PAIMhc1bVKfcyoHeg0xO8LMS9KN5yzbsMGwa5O2ifJM=",
-        "usagesDigest": "A3fzk5iHsrLdI3PokT1bHIdeJ2j9tc09H3/3Old6IfU=",
+        "usagesDigest": "l2vIL7SL4tJqHIVLWd78Y/ym+r0II64lmvoX8o+0Bb0=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},

ci/BUILD.bazel

@@ -1,6 +1,19 @@
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load", "oci_push")
 load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
+#
+# Deployment artifacts (tools needed on the host, not in containers)
+#
+
+pkg_tar(
+    name = "warmup_tar",
+    srcs = ["//src/main/go/net/eagle0/warmup:warmup_linux_amd64"],
+    package_dir = "bin",
+    remap_paths = {
+        "/warmup_linux_amd64": "/warmup",
+    },
+)
+
 #
 # Shared utilities layer (busybox for nc, wget, etc.)
 #
@@ -317,6 +330,13 @@ pkg_tar(
     package_dir = "/app",
 )
 
+# Package the attributions.json for the credits page
+pkg_tar(
+    name = "auth_attributions_layer",
+    srcs = ["//src/main/resources/net/eagle0:attributions"],
+    package_dir = "/app",
+)
+
 oci_image(
     name = "auth_server_image",
     base = "@alpine_linux_linux_amd64",
@@ -328,6 +348,7 @@ oci_image(
     tars = [
         ":busybox_layer",
         ":auth_binary_layer",
+        ":auth_attributions_layer",
     ],
     workdir = "/app",
 )

ci/build_eagle_installer_win.sh

@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-/bin/mkdir -p win_output
-/usr/bin/dotnet publish src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller.sln -o win_output
-SHA=`sha256sum /tmp/EagleInstaller.exe | awk '{print $1 }'`
-ZIP_FILE="updater__$SHA.zip"
-
-/usr/bin/zip win_output/$ZIP_FILE win_output/EagleInstaller.exe
-rm win_output/EagleInstaller.exe
-rm win_output/EagleInstaller.pdb
-
-DATE=`date +"%Y-%m-%d %T"`
-
-cat > win_output/updater.html <<-EOF
-<html>
-<head>
-<title>Download Eagle Updater</title>
-</head>
-<body>
-<a href="http://eagle0.net/assets/$ZIP_FILE">$ZIP_FILE</a> (updated $DATE)
-</body>
-</html>
-EOF
-
-SSH_KEY_FILE=$1
-SSH_USER_NAME=$2
-
-/usr/bin/rsync -r --copy-links -e "/usr/bin/ssh -i $SSH_KEY_FILE -p 9022" win_output/ $SSH_USER_NAME@eagle0.net:/www/assets/

ci/github_actions/archive_ios.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+
+# Archive and export iOS app for App Store / TestFlight
+
+set -euxo pipefail
+
+# Ensure xcodebuild uses Xcode.app, not Command Line Tools
+export DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
+
+XCODE_PROJECT_PATH=${1:?Usage: archive_ios.sh <xcode_project_path> <output_path> <team_id> <profile_uuid>}
+OUTPUT_PATH=${2:?Missing output path}
+TEAM_ID=${3:?Missing team ID}
+PROFILE_UUID=${4:?Missing provisioning profile UUID}
+
+ARCHIVE_PATH="$OUTPUT_PATH/eagle0.xcarchive"
+EXPORT_PATH="$OUTPUT_PATH"
+
+echo "Archiving iOS app..."
+echo "  Xcode project: $XCODE_PROJECT_PATH"
+echo "  Archive path: $ARCHIVE_PATH"
+echo "  Team ID: $TEAM_ID"
+
+mkdir -p "$OUTPUT_PATH"
+
+# Find the .xcodeproj file
+XCODEPROJ=$(find "$XCODE_PROJECT_PATH" -name "*.xcodeproj" -maxdepth 1 | head -1)
+if [ -z "$XCODEPROJ" ]; then
+    echo "Error: No .xcodeproj found in $XCODE_PROJECT_PATH"
+    exit 1
+fi
+
+echo "Found Xcode project: $XCODEPROJ"
+
+# Unity always generates "Unity-iPhone" as the main app scheme
+SCHEME="Unity-iPhone"
+echo "Using scheme: $SCHEME"
+
+# Archive without signing - we'll sign during export
+# This avoids issues with provisioning profiles on framework targets
+xcodebuild archive \
+    -project "$XCODEPROJ" \
+    -scheme "$SCHEME" \
+    -archivePath "$ARCHIVE_PATH" \
+    -destination "generic/platform=iOS" \
+    CODE_SIGN_IDENTITY="-" \
+    CODE_SIGNING_REQUIRED=NO \
+    CODE_SIGNING_ALLOWED=NO
+
+echo "Archive complete: $ARCHIVE_PATH"
+
+# Create export options plist
+# Signing happens here, not during archive
+EXPORT_OPTIONS_PLIST="$OUTPUT_PATH/ExportOptions.plist"
+cat > "$EXPORT_OPTIONS_PLIST" << EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>method</key>
+    <string>app-store-connect</string>
+    <key>teamID</key>
+    <string>$TEAM_ID</string>
+    <key>uploadSymbols</key>
+    <true/>
+    <key>signingStyle</key>
+    <string>manual</string>
+    <key>signingCertificate</key>
+    <string>Apple Distribution: Daniel Crosby (UWJ88DX8WQ)</string>
+    <key>provisioningProfiles</key>
+    <dict>
+        <key>net.eagle0.eagle</key>
+        <string>$PROFILE_UUID</string>
+    </dict>
+</dict>
+</plist>
+EOF
+
+echo "Exporting IPA..."
+
+# Debug: List available keychains and signing identities
+echo "=== Debug: Available keychains ==="
+security list-keychains -d user
+echo "=== Debug: Available signing identities ==="
+security find-identity -v -p codesigning
+echo "=== Debug: Export options plist ==="
+cat "$EXPORT_OPTIONS_PLIST"
+echo "=== End debug ==="
+
+# Export IPA (removed -allowProvisioningUpdates as we're using manual signing)
+xcodebuild -exportArchive \
+    -archivePath "$ARCHIVE_PATH" \
+    -exportPath "$EXPORT_PATH" \
+    -exportOptionsPlist "$EXPORT_OPTIONS_PLIST"
+
+# Find and rename the IPA to a consistent name
+IPA_FILE=$(find "$EXPORT_PATH" -name "*.ipa" | head -1)
+if [ -n "$IPA_FILE" ] && [ "$IPA_FILE" != "$EXPORT_PATH/eagle0.ipa" ]; then
+    mv "$IPA_FILE" "$EXPORT_PATH/eagle0.ipa"
+fi
+
+echo "Export complete: $EXPORT_PATH/eagle0.ipa"
+ls -la "$EXPORT_PATH"

ci/github_actions/build_ios_addressables.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+# Build iOS Addressables only (no player build)
+# This switches Unity to iOS target and builds addressables for CDN upload
+
+set -euxo pipefail
+
+# Read Unity version from project file
+UNITY_VERSION=$(grep "m_EditorVersion:" src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt | head -1 | sed 's/m_EditorVersion: //')
+
+# Use runner-specific build directory if EAGLE0_BUILD_DIR is set, otherwise default
+BUILD_BASE="${EAGLE0_BUILD_DIR:-/tmp/eagle0}"
+
+WORKSPACE=$(pwd)
+
+echo "Building protos"
+./scripts/build_protos.sh
+UNITY_INSTALL_PATH="/Applications/Unity/Hub/Editor"
+LOG_PATH=${1:-"${BUILD_BASE}/editor_ios_addressables.log"}
+
+echo "Building iOS Addressables"
+
+mkdir -p "$(dirname "$LOG_PATH")"
+
+# Build Addressables for iOS target
+# Uses BuildiOSAddressables which explicitly switches build target
+# Capture exit code to show log on failure
+set +e
+${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
+   -nographics \
+   -batchmode \
+   -quit \
+   -executeMethod BuildScript.BuildiOSAddressables \
+   -logFile "$LOG_PATH" \
+   -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+UNITY_EXIT_CODE=$?
+set -e
+
+if [ $UNITY_EXIT_CODE -ne 0 ]; then
+    echo ""
+    echo "Unity build failed with exit code $UNITY_EXIT_CODE"
+    echo "=== Unity Editor Log (last 200 lines) ==="
+    tail -200 "$LOG_PATH" || echo "Could not read log file at $LOG_PATH"
+    echo "=== End of Unity Editor Log ==="
+    exit $UNITY_EXIT_CODE
+fi
+
+echo "iOS Addressables build complete"
+echo "Bundles should be in: $WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0/ServerData/iOS/"

ci/github_actions/build_mac.sh

@@ -2,7 +2,8 @@
 
 set -euxo pipefail
 
-. ./ci/unity_version.sh
+# Read Unity version from project file
+UNITY_VERSION=$(grep "m_EditorVersion:" src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt | head -1 | sed 's/m_EditorVersion: //')
 
 WORKSPACE=$(pwd)
 UNITY_INSTALL_PATH="/Applications/Unity/Hub/Editor"
@@ -15,10 +16,25 @@ echo "Cleaning up $BUILD_DIR"
 /bin/rm -rf "$BUILD_DIR"
 /bin/mkdir -p "$BUILD_DIR"
 
+# Use custom build script that builds Addressables before the player
+# Capture exit code to show log on failure
+set +e
 ${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
    -nographics \
    -batchmode \
    -quit \
-   -buildOSXUniversalPlayer "$BUILD_DIR/eagle0.app" \
+   -executeMethod BuildScript.BuildMacPlayer \
+   -buildPath "$BUILD_DIR/eagle0.app" \
    -logFile "$LOG_PATH" \
    -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+UNITY_EXIT_CODE=$?
+set -e
+
+if [ $UNITY_EXIT_CODE -ne 0 ]; then
+    echo ""
+    echo "Unity build failed with exit code $UNITY_EXIT_CODE"
+    echo "=== Unity Editor Log (last 200 lines) ==="
+    tail -200 "$LOG_PATH" || echo "Could not read log file at $LOG_PATH"
+    echo "=== End of Unity Editor Log ==="
+    exit $UNITY_EXIT_CODE
+fi

ci/github_actions/build_unity.sh

@@ -2,20 +2,18 @@
 
 set -euxo pipefail
 
-LOG_PATH=""
+# Use runner-specific build directory if EAGLE0_BUILD_DIR is set, otherwise default
+BUILD_BASE="${EAGLE0_BUILD_DIR:-/tmp/eagle0}"
 
 COMMIT=$(/usr/bin/git rev-parse --short HEAD)
 
 /bin/echo "build protos"
 ./scripts/build_protos.sh
 
-/bin/echo "build plugins"
-./scripts/build_windows_plugin.sh
-
 git log -3
 
 /bin/echo "build Windows"
-LOG_PATH="/tmp/eagle0/editor_win.log"
+LOG_PATH="${BUILD_BASE}/editor_win.log"
 BUILD_DIR=$1
 
 ./ci/github_actions/build_windows.sh $BUILD_DIR $LOG_PATH

ci/github_actions/build_unity_ios.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+# Build iOS Unity player (generates Xcode project)
+
+set -euxo pipefail
+
+# Read Unity version from project file
+UNITY_VERSION=$(grep "m_EditorVersion:" src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt | head -1 | sed 's/m_EditorVersion: //')
+
+# Use runner-specific build directory if EAGLE0_BUILD_DIR is set, otherwise default
+BUILD_BASE="${EAGLE0_BUILD_DIR:-/tmp/eagle0}"
+
+WORKSPACE=$(pwd)
+BUILD_PATH=${1:-"${BUILD_BASE}/eagle0iOS"}
+LOG_PATH="${BUILD_BASE}/editor_ios.log"
+
+# Generate unique build number from git commit count
+# This ensures each build has a unique number for TestFlight
+BUILD_NUMBER=$(git rev-list --count HEAD)
+echo "Build number (git commit count): $BUILD_NUMBER"
+
+echo "Building protos"
+./scripts/build_protos.sh
+
+UNITY_INSTALL_PATH="/Applications/Unity/Hub/Editor"
+
+echo "Building iOS Unity player to: $BUILD_PATH"
+
+mkdir -p "$(dirname "$LOG_PATH")"
+mkdir -p "$BUILD_PATH"
+
+# Build iOS player - this generates an Xcode project
+# Capture exit code to show log on failure
+set +e
+${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
+   -nographics \
+   -batchmode \
+   -quit \
+   -executeMethod BuildScript.BuildiOSPlayer \
+   -buildPath "$BUILD_PATH" \
+   -buildNumber "$BUILD_NUMBER" \
+   -logFile "$LOG_PATH" \
+   -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+UNITY_EXIT_CODE=$?
+set -e
+
+if [ $UNITY_EXIT_CODE -ne 0 ]; then
+    echo ""
+    echo "Unity build failed with exit code $UNITY_EXIT_CODE"
+    echo "=== Unity Editor Log (last 200 lines) ==="
+    tail -200 "$LOG_PATH" || echo "Could not read log file at $LOG_PATH"
+    echo "=== End of Unity Editor Log ==="
+    exit $UNITY_EXIT_CODE
+fi
+
+echo "iOS Unity build complete"
+echo "Xcode project generated at: $BUILD_PATH"
+ls -la "$BUILD_PATH"

ci/github_actions/build_unity_mac.sh

@@ -2,18 +2,21 @@
 
 set -euxo pipefail
 
+# Use runner-specific build directory if EAGLE0_BUILD_DIR is set, otherwise default
+BUILD_BASE="${EAGLE0_BUILD_DIR:-/tmp/eagle0}"
+
 COMMIT=$(/usr/bin/git rev-parse --short HEAD)
 
 /bin/echo "build protos"
 ./scripts/build_protos.sh
 
-/bin/echo "build Mac plugin"
-./scripts/build_mac_plugin.sh
+/bin/echo "build Sparkle plugin"
+./scripts/build_sparkle_plugin.sh
 
 git log -3
 
 /bin/echo "build Mac"
-LOG_PATH="/tmp/eagle0/editor_mac.log"
+LOG_PATH="${BUILD_BASE}/editor_mac.log"
 BUILD_DIR=$1
 
 ./ci/github_actions/build_mac.sh "$BUILD_DIR" "$LOG_PATH"

ci/github_actions/build_windows.sh

@@ -2,7 +2,8 @@
 
 set -euxo pipefail
 
-. ./ci/unity_version.sh
+# Read Unity version from project file
+UNITY_VERSION=$(grep "m_EditorVersion:" src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt | head -1 | sed 's/m_EditorVersion: //')
 
 WORKSPACE=`pwd`
 UNITY_INSTALL_PATH="/Applications/Unity/Hub/Editor"
@@ -15,10 +16,25 @@ echo "Cleaning up $1"
 /bin/rm -rf $1
 /bin/mkdir -p $1
 
+# Use custom build script that builds Addressables before the player
+# Capture exit code to show log on failure
+set +e
 ${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
    -nographics \
    -batchmode \
    -quit \
-   -buildWindows64Player $BUILD_DIR/eagle0.exe \
+   -executeMethod BuildScript.BuildWindowsPlayer \
+   -buildPath "$BUILD_DIR/eagle0.exe" \
    -logFile $LOG_PATH \
    -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+UNITY_EXIT_CODE=$?
+set -e
+
+if [ $UNITY_EXIT_CODE -ne 0 ]; then
+    echo ""
+    echo "Unity build failed with exit code $UNITY_EXIT_CODE"
+    echo "=== Unity Editor Log (last 200 lines) ==="
+    tail -200 "$LOG_PATH" || echo "Could not read log file at $LOG_PATH"
+    echo "=== End of Unity Editor Log ==="
+    exit $UNITY_EXIT_CODE
+fi

ci/github_actions/ensure_unity_installed.sh

@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+
+# Ensures the required Unity version is installed via Unity Hub.
+# Usage: ./ensure_unity_installed.sh [PLATFORM]
+#
+# PLATFORM can be: mac, windows, ios, or all (default: all)
+#
+# This script:
+# 1. Reads the required version from ProjectSettings/ProjectVersion.txt
+# 2. Checks if it's already installed
+# 3. If not, attempts to install it via Unity Hub CLI with appropriate modules
+#
+# Note: Unity Hub CLI installation may require:
+# - Unity Hub to be installed
+# - User to be logged in to Unity Hub (for some versions)
+# - Appropriate licenses
+
+set -euo pipefail
+
+# Read Unity version directly from the project file (maintained by Unity itself)
+PROJECT_VERSION_FILE="src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
+UNITY_VERSION=$(grep "m_EditorVersion:" "$PROJECT_VERSION_FILE" | head -1 | sed 's/m_EditorVersion: //')
+
+UNITY_INSTALL_PATH="/Applications/Unity/Hub/Editor"
+UNITY_HUB_CLI="/Applications/Unity Hub.app/Contents/MacOS/Unity Hub"
+LOCK_FILE="/tmp/unity_install.lock"
+LOCK_TIMEOUT=1800  # 30 minutes max wait for another installation
+
+PLATFORM="${1:-all}"
+
+echo "Required Unity version: ${UNITY_VERSION}"
+echo "Platform: ${PLATFORM}"
+
+# Check if Unity is installed and has required modules
+check_modules_installed() {
+    local unity_path="${UNITY_INSTALL_PATH}/${UNITY_VERSION}"
+
+    if [ ! -d "$unity_path" ]; then
+        return 1
+    fi
+
+    case "${PLATFORM}" in
+        ios)
+            # iOS module installs to PlaybackEngines/iOSSupport
+            if [ ! -d "${unity_path}/PlaybackEngines/iOSSupport" ]; then
+                echo "✗ iOS module not installed for Unity ${UNITY_VERSION}"
+                return 1
+            fi
+            ;;
+        mac)
+            # Mac IL2CPP module
+            if [ ! -d "${unity_path}/PlaybackEngines/MacStandaloneSupport/Variations/macos_development_il2cpp" ] && \
+               [ ! -d "${unity_path}/PlaybackEngines/MacStandaloneSupport" ]; then
+                echo "✗ Mac IL2CPP module not installed for Unity ${UNITY_VERSION}"
+                return 1
+            fi
+            ;;
+        windows)
+            # Windows mono module
+            if [ ! -d "${unity_path}/PlaybackEngines/WindowsStandaloneSupport" ]; then
+                echo "✗ Windows module not installed for Unity ${UNITY_VERSION}"
+                return 1
+            fi
+            ;;
+        all)
+            # Check all required modules
+            local missing=0
+            if [ ! -d "${unity_path}/PlaybackEngines/iOSSupport" ]; then
+                echo "✗ iOS module missing"
+                missing=1
+            fi
+            if [ ! -d "${unity_path}/PlaybackEngines/MacStandaloneSupport" ]; then
+                echo "✗ Mac module missing"
+                missing=1
+            fi
+            if [ ! -d "${unity_path}/PlaybackEngines/WindowsStandaloneSupport" ]; then
+                echo "✗ Windows module missing"
+                missing=1
+            fi
+            if [ $missing -eq 1 ]; then
+                return 1
+            fi
+            ;;
+    esac
+
+    return 0
+}
+
+# Check if already installed with required modules
+if check_modules_installed; then
+    echo "✓ Unity ${UNITY_VERSION} is already installed with ${PLATFORM} support"
+    exit 0
+fi
+
+if [ ! -d "${UNITY_INSTALL_PATH}/${UNITY_VERSION}" ]; then
+    echo "✗ Unity ${UNITY_VERSION} not found at ${UNITY_INSTALL_PATH}/${UNITY_VERSION}"
+fi
+
+# Check if Unity Hub CLI is available
+if [ ! -f "${UNITY_HUB_CLI}" ]; then
+    echo ""
+    echo "Unity Hub CLI not found at ${UNITY_HUB_CLI}"
+    echo ""
+    echo "To install Unity ${UNITY_VERSION} manually:"
+    echo "  1. Open Unity Hub"
+    echo "  2. Go to Installs -> Install Editor"
+    echo "  3. Select version ${UNITY_VERSION}"
+    echo "  4. Add modules based on platform: mac-il2cpp, windows-mono, ios"
+    exit 1
+fi
+
+# Acquire lock to prevent concurrent installations
+acquire_lock() {
+    local waited=0
+    while ! mkdir "${LOCK_FILE}" 2>/dev/null; do
+        if [ $waited -ge $LOCK_TIMEOUT ]; then
+            echo "ERROR: Timed out waiting for Unity installation lock after ${LOCK_TIMEOUT}s"
+            echo "Another installation may be stuck. Remove ${LOCK_FILE} manually if needed."
+            exit 1
+        fi
+        echo "Another Unity installation is in progress, waiting... (${waited}s)"
+        sleep 10
+        waited=$((waited + 10))
+    done
+    # Store PID for debugging
+    echo $$ > "${LOCK_FILE}/pid"
+    trap release_lock EXIT
+}
+
+release_lock() {
+    rm -rf "${LOCK_FILE}" 2>/dev/null || true
+}
+
+# Re-check after acquiring lock (another process may have installed it)
+acquire_lock
+
+if check_modules_installed; then
+    echo "✓ Unity ${UNITY_VERSION} with ${PLATFORM} support was installed while waiting for lock"
+    exit 0
+fi
+
+echo ""
+
+# Determine modules needed for this platform
+get_modules_for_platform() {
+    case "${PLATFORM}" in
+        mac)
+            echo "mac-il2cpp"
+            ;;
+        windows)
+            echo "windows-mono"
+            ;;
+        ios)
+            echo "ios"
+            ;;
+        all)
+            echo "mac-il2cpp windows-mono ios"
+            ;;
+        *)
+            echo "Unknown platform: ${PLATFORM}" >&2
+            echo "Valid platforms: mac, windows, ios, all" >&2
+            exit 1
+            ;;
+    esac
+}
+
+MODULES=$(get_modules_for_platform)
+
+# Check if editor is already installed (just missing modules)
+if [ -d "${UNITY_INSTALL_PATH}/${UNITY_VERSION}" ]; then
+    echo "Unity ${UNITY_VERSION} is installed but missing modules. Adding modules..."
+    echo ""
+
+    # Use install-modules to add modules to existing installation
+    INSTALL_CMD=("${UNITY_HUB_CLI}" -- --headless install-modules --version "${UNITY_VERSION}")
+    for mod in $MODULES; do
+        INSTALL_CMD+=(--module "$mod")
+    done
+else
+    echo "Attempting to install Unity ${UNITY_VERSION} via Unity Hub CLI..."
+    echo ""
+
+    # Use install to install editor with modules
+    INSTALL_CMD=("${UNITY_HUB_CLI}" -- --headless install --version "${UNITY_VERSION}")
+    for mod in $MODULES; do
+        INSTALL_CMD+=(--module "$mod")
+    done
+fi
+
+echo "Running: ${INSTALL_CMD[*]}"
+echo ""
+
+# Capture output to check for "already installed" messages
+OUTPUT=$("${INSTALL_CMD[@]}" 2>&1) || true
+EXIT_CODE=$?
+echo "$OUTPUT"
+
+# Check if modules are already installed (Unity Hub returns error but modules are present)
+if echo "$OUTPUT" | grep -q "already installed\|No modules found to install"; then
+    echo ""
+    echo "✓ Modules already installed"
+elif [ $EXIT_CODE -eq 0 ]; then
+    echo ""
+    echo "Unity Hub CLI command completed"
+else
+    echo ""
+    echo "Unity Hub CLI command failed (exit code: ${EXIT_CODE})"
+    echo ""
+    echo "This may happen if:"
+    echo "  - The Unity version is not available for download"
+    echo "  - You need to log in to Unity Hub first"
+    echo "  - Unity Hub requires a GUI interaction"
+    echo ""
+    echo "To install manually:"
+    echo "  1. Open Unity Hub"
+    echo "  2. Go to Installs -> Install Editor"
+    echo "  3. Select version ${UNITY_VERSION}"
+    echo "  4. Add modules: ${PLATFORM}"
+    exit 1
+fi
+
+# Verify installation
+echo ""
+if [ -d "${UNITY_INSTALL_PATH}/${UNITY_VERSION}" ]; then
+    echo "✓ Verified: Unity ${UNITY_VERSION} is now installed"
+    exit 0
+else
+    echo "✗ Unity ${UNITY_VERSION} installation could not be verified"
+    echo "  Expected path: ${UNITY_INSTALL_PATH}/${UNITY_VERSION}"
+    echo ""
+    echo "The installation may still be in progress, or may require manual intervention."
+    exit 1
+fi

ci/github_actions/persist_library.sh

@@ -1,6 +1,33 @@
 #!/bin/bash
+#
+# Persist Unity Library/ cache to persistent storage
+#
+# Environment variables:
+#   UNITY_CACHE_PLATFORM - Platform identifier (e.g., "mac", "windows")
+#                          Defaults to "mac" if not set
+#
+# Note: Library/Bee/ is excluded because it contains DAG files with hardcoded
+# file paths that become stale when project files change. This prevents
+# "Data at the root level is invalid" XML errors from stale references.
 
-set -euxo pipefail
+set -uxo pipefail
 
-/bin/echo "persist Library/"
-/usr/bin/rsync -rtlDvq src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ /tmp/eagle0/Library/
+PLATFORM="${UNITY_CACHE_PLATFORM:-mac}"
+CACHE_DIR="/tmp/eagle0/Library-${PLATFORM}"
+
+/bin/echo "persist Library/ to $CACHE_DIR (excluding Bee/)"
+
+# rsync may exit with code 23 ("partial transfer due to error") if Unity's
+# temporary files vanish during the copy. This is acceptable for a cache.
+/usr/bin/rsync -rtlDvq --exclude='Bee/' src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ "$CACHE_DIR/"
+rsync_exit=$?
+
+if [ $rsync_exit -eq 0 ]; then
+    exit 0
+elif [ $rsync_exit -eq 23 ]; then
+    echo "Warning: rsync exited with 23 (some files vanished during copy). This is expected for Unity temp files."
+    exit 0
+else
+    echo "Error: rsync failed with exit code $rsync_exit"
+    exit $rsync_exit
+fi

ci/github_actions/restore_library.sh

@@ -1,7 +1,16 @@
 #!/bin/bash
+#
+# Restore Unity Library/ cache from persistent storage
+#
+# Environment variables:
+#   UNITY_CACHE_PLATFORM - Platform identifier (e.g., "mac", "windows")
+#                          Defaults to "mac" if not set
 
 set -euxo pipefail
 
-/bin/echo "restore Library/"
-/bin/mkdir -p /tmp/eagle0/Library
-/usr/bin/rsync -rtlDvq /tmp/eagle0/Library/ src/main/csharp/net/eagle0/clients/unity/eagle0/Library/
+PLATFORM="${UNITY_CACHE_PLATFORM:-mac}"
+CACHE_DIR="/tmp/eagle0/Library-${PLATFORM}"
+
+/bin/echo "restore Library/ from $CACHE_DIR"
+/bin/mkdir -p "$CACHE_DIR"
+/usr/bin/rsync -rtlDvq "$CACHE_DIR/" src/main/csharp/net/eagle0/clients/unity/eagle0/Library/

ci/github_actions/upload_addressables.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Upload Addressables bundles to DigitalOcean Spaces
+# Usage: ./upload_addressables.sh <build_target>
+# Example: ./upload_addressables.sh StandaloneOSX
+#
+# Required environment variables:
+#   ACCESS_KEY_ID - DigitalOcean Spaces access key (same as other deploys)
+#   SECRET_KEY    - DigitalOcean Spaces secret key (same as other deploys)
+
+set -euxo pipefail
+
+BUILD_TARGET=$1
+WORKSPACE=$(pwd)
+UNITY_PROJECT="$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+SERVER_DATA="$UNITY_PROJECT/ServerData/$BUILD_TARGET"
+
+# DigitalOcean Spaces configuration (same region as other eagle0 buckets)
+DO_ENDPOINT="https://sfo3.digitaloceanspaces.com"
+DO_BUCKET="eagle0-assets"
+
+if [ ! -d "$SERVER_DATA" ]; then
+    echo "No Addressables bundles found at $SERVER_DATA"
+    echo "Skipping upload (this is expected if Addressables are bundled locally)"
+    exit 0
+fi
+
+echo "Uploading Addressables bundles from $SERVER_DATA"
+echo "Target: s3://$DO_BUCKET/addressables/$BUILD_TARGET/"
+
+# Configure AWS CLI for DigitalOcean Spaces
+export AWS_ACCESS_KEY_ID="$ACCESS_KEY_ID"
+export AWS_SECRET_ACCESS_KEY="$SECRET_KEY"
+
+# Sync bundles to Spaces
+# --delete removes files in destination that don't exist in source
+# --acl public-read makes files publicly accessible
+aws s3 sync "$SERVER_DATA" "s3://$DO_BUCKET/addressables/$BUILD_TARGET/" \
+    --endpoint-url "$DO_ENDPOINT" \
+    --acl public-read \
+    --delete
+
+echo "Addressables upload complete"
+echo "Files available at: https://assets.eagle0.net/addressables/$BUILD_TARGET/"

ci/github_actions/upload_testflight.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+# Upload IPA to TestFlight using Apple ID credentials (same as Mac notarization)
+
+set -euxo pipefail
+
+IPA_PATH=${1:?Usage: upload_testflight.sh <ipa_path>}
+
+if [ ! -f "$IPA_PATH" ]; then
+    echo "Error: IPA file not found: $IPA_PATH"
+    exit 1
+fi
+
+echo "Uploading to TestFlight: $IPA_PATH"
+
+# Uses same credentials as Mac notarization:
+# - APPLE_ID: Your Apple ID email
+# - APP_SPECIFIC_PASSWORD: App-specific password from appleid.apple.com
+
+if [ -z "${APPLE_ID:-}" ]; then
+    echo "Error: APPLE_ID environment variable not set"
+    exit 1
+fi
+
+if [ -z "${APP_SPECIFIC_PASSWORD:-}" ]; then
+    echo "Error: APP_SPECIFIC_PASSWORD environment variable not set"
+    exit 1
+fi
+
+echo "Uploading with xcrun altool..."
+
+# Capture output to check for errors (altool may return 0 even on failure)
+OUTPUT=$(xcrun altool --upload-app \
+    --type ios \
+    --file "$IPA_PATH" \
+    --username "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" 2>&1) || true
+
+echo "$OUTPUT"
+
+# Check for error indicators in output
+if echo "$OUTPUT" | grep -q "ERROR:"; then
+    echo "ERROR: Upload failed. See error messages above."
+    exit 1
+fi
+
+echo "Upload complete! Check App Store Connect for processing status."
+echo "The build should appear in TestFlight within 15-30 minutes after processing."

ci/unity_version.sh

@@ -1 +0,0 @@
-UNITY_VERSION='6000.3.0f1'

deploy/env.template

@@ -1,40 +0,0 @@
-# Environment template for production deployment
-# This file defines all env vars used by docker-compose.prod.yml
-# Workflows should update their specific vars without overwriting others
-
-# Container images (managed by respective build workflows)
-EAGLE_IMAGE=registry.digitalocean.com/eagle0/eagle-server:latest
-SHARDOK_IMAGE=registry.digitalocean.com/eagle0/shardok-server:latest
-ADMIN_IMAGE=registry.digitalocean.com/eagle0/admin-server:latest
-JFR_SIDECAR_IMAGE=registry.digitalocean.com/eagle0/jfr-sidecar:latest
-AUTH_IMAGE=registry.digitalocean.com/eagle0/auth-server:latest
-
-# OpenAI / LLM
-OPENAI_API_KEY=
-GPT_MODEL_NAME=gpt-4o
-
-# DigitalOcean Spaces (S3-compatible storage)
-EAGLE_ENABLE_S3=false
-DO_SPACES_ACCESS_KEY=
-DO_SPACES_SECRET_KEY=
-
-# JWT authentication
-JWT_PRIVATE_KEY=
-
-# OAuth providers
-DISCORD_CLIENT_ID=
-DISCORD_CLIENT_SECRET=
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-
-# Shardok connection
-SHARDOK_ADDRESS=shardok:40042
-SHARDOK_AUTH_TOKEN=
-
-# Monitoring
-SENTRY_DSN=
-
-# Email (Fastmail JMAP)
-FASTMAIL_API_TOKEN=
-FASTMAIL_FROM_EMAIL=
-FASTMAIL_FROM_NAME=

deploy/update-env.sh

@@ -1,59 +0,0 @@
-#!/bin/bash
-# Update .env file without losing other variables
-# Usage: ./update-env.sh KEY1=value1 KEY2=value2 ...
-#
-# This script:
-# 1. Creates .env from template if it doesn't exist
-# 2. Updates only the specified KEY=value pairs
-# 3. Preserves all other existing values
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-ENV_FILE="${ENV_FILE:-/opt/eagle0/.env}"
-TEMPLATE_FILE="${TEMPLATE_FILE:-$SCRIPT_DIR/env.template}"
-
-# Create .env from template if it doesn't exist
-if [ ! -f "$ENV_FILE" ]; then
-    if [ -f "$TEMPLATE_FILE" ]; then
-        echo "Creating .env from template..."
-        grep -v '^#' "$TEMPLATE_FILE" | grep -v '^$' > "$ENV_FILE"
-    else
-        echo "Creating empty .env..."
-        touch "$ENV_FILE"
-    fi
-    chmod 600 "$ENV_FILE"
-fi
-
-# Process each KEY=VALUE argument
-for arg in "$@"; do
-    # Skip empty args
-    [ -z "$arg" ] && continue
-
-    # Parse KEY=VALUE
-    KEY="${arg%%=*}"
-    VALUE="${arg#*=}"
-
-    # Skip if no key
-    [ -z "$KEY" ] && continue
-
-    # Skip setting empty values (keeps existing value)
-    if [ -z "$VALUE" ]; then
-        echo "Skipping $KEY (empty value)"
-        continue
-    fi
-
-    # Remove existing line for this key and add new one
-    if grep -q "^${KEY}=" "$ENV_FILE" 2>/dev/null; then
-        # Key exists, update it
-        sed -i "s|^${KEY}=.*|${KEY}=${VALUE}|" "$ENV_FILE"
-        echo "Updated $KEY"
-    else
-        # Key doesn't exist, add it
-        echo "${KEY}=${VALUE}" >> "$ENV_FILE"
-        echo "Added $KEY"
-    fi
-done
-
-chmod 600 "$ENV_FILE"
-echo "Done updating $ENV_FILE"

docker-compose.prod.yml

@@ -1,11 +1,13 @@
 # Docker Compose for production deployment
 #
 # Local testing:
-#   Build images: bazel run //ci:eagle_server_load && bazel run //ci:shardok_server_load && bazel run //ci:auth_server_load
+#   Build images: bazel run //ci:eagle_server_load && bazel run //ci:auth_server_load
 #   Run: docker compose -f docker-compose.prod.yml up
 #
 # Production deployment:
 #   Run: docker compose -f docker-compose.prod.yml up -d
+#
+# Note: Shardok runs on Hetzner ARM64 server, deployed via shardok_arm64_build.yml workflow.
 
 services:
   # Blue-green deployment: eagle-blue is the primary (production) instance
@@ -16,24 +18,23 @@ services:
     image: ${EAGLE_IMAGE:-registry.digitalocean.com/eagle0/eagle-server:latest}
     container_name: eagle-blue
     command:
-      - "--gpt-model-name"
-      - "${GPT_MODEL_NAME:-gpt-5.1}"
       - "--shardok-interface-remote-address"
-      - "${SHARDOK_ADDRESS:-shardok:40042}"
+      - "${SHARDOK_ADDRESS}"
       - "--auth-service-url"
       - "auth:40033"
     ports:
       - "40032:40032"
     environment:
       OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
+      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
+      GEMINI_API_KEY: "${GEMINI_API_KEY:-}"
       EAGLE_ENABLE_S3: "${EAGLE_ENABLE_S3:-false}"
       DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
       DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
       DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
-      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
-      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
-      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
-      # Auth token for remote Shardok on Hetzner (only used when shardok address contains .eagle0.net)
+      # JWT public key for token validation (auth service handles signing)
+      # Reads from /etc/eagle0/keys/public.pem via shared volume
+      # Auth token for Shardok on Hetzner (required)
       SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
       # Use persistent volume for save data (users, games, etc.)
       EAGLE_SAVE_DIR: "/app/saves"
@@ -45,9 +46,8 @@ services:
       - ./archived:/app/archived     # Archived completed games
       - ./jfr:/app/jfr  # JFR recordings - dump with: docker exec eagle-blue jcmd 1 JFR.dump filename=/app/jfr/profile.jfr
       - jvm-tmp:/tmp  # Shared with jfr-sidecar for JVM attach socket files
-      - jwt-keys:/etc/eagle0/keys  # Shared JWT keys with auth service
+      - jwt-keys:/etc/eagle0/keys:ro  # JWT public key from auth service (read-only)
     depends_on:
-      - shardok
       - auth
     restart: unless-stopped
     logging:
@@ -67,23 +67,22 @@ services:
     container_name: eagle-green
     profiles: ["blue-green"]  # Only started during blue-green deployment
     command:
-      - "--gpt-model-name"
-      - "${GPT_MODEL_NAME:-gpt-5.1}"
       - "--shardok-interface-remote-address"
-      - "${SHARDOK_ADDRESS:-shardok:40042}"
+      - "${SHARDOK_ADDRESS}"
       - "--auth-service-url"
       - "auth:40033"
     ports:
       - "40034:40032"  # Different host port for staging
     environment:
       OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
+      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
+      GEMINI_API_KEY: "${GEMINI_API_KEY:-}"
       EAGLE_ENABLE_S3: "${EAGLE_ENABLE_S3:-false}"
       DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
       DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
       DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
-      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
-      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
-      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
+      # JWT public key for token validation (auth service handles signing)
+      # Reads from /etc/eagle0/keys/public.pem via shared volume
       SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
       EAGLE_SAVE_DIR: "/app/saves"
       EAGLE_ARCHIVE_DIR: "/app/archived"
@@ -92,9 +91,10 @@ services:
     volumes:
       - ./saves:/app/saves           # Same save directory as blue
       - ./archived:/app/archived     # Same archive directory as blue
-      - jwt-keys:/etc/eagle0/keys    # Shared JWT keys with auth service
+      - ./jfr:/app/jfr               # JFR recordings (same as blue)
+      - jvm-tmp:/tmp                 # Shared with jfr-sidecar-green for JVM attach socket files
+      - jwt-keys:/etc/eagle0/keys:ro # JWT public key from auth service (read-only)
     depends_on:
-      - shardok
       - auth
     restart: "no"  # Don't auto-restart during deployment
     logging:
@@ -131,6 +131,16 @@ services:
       DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
       GOOGLE_CLIENT_ID: "${GOOGLE_CLIENT_ID:-}"
       GOOGLE_CLIENT_SECRET: "${GOOGLE_CLIENT_SECRET:-}"
+      GH_OAUTH_CLIENT_ID: "${GH_OAUTH_CLIENT_ID:-}"
+      GH_OAUTH_CLIENT_SECRET: "${GH_OAUTH_CLIENT_SECRET:-}"
+      # Apple Sign-In credentials
+      APPLE_SIGNIN_CLIENT_ID: "${APPLE_SIGNIN_CLIENT_ID:-}"
+      APPLE_TEAM_ID: "${APPLE_TEAM_ID:-}"
+      APPLE_SIGNIN_KEY_ID: "${APPLE_SIGNIN_KEY_ID:-}"
+      APPLE_SIGNIN_PRIVATE_KEY: "${APPLE_SIGNIN_PRIVATE_KEY:-}"
+      # Twitch OAuth credentials
+      TWITCH_CLIENT_ID: "${TWITCH_CLIENT_ID:-}"
+      TWITCH_CLIENT_SECRET: "${TWITCH_CLIENT_SECRET:-}"
       # Server base URL for OAuth callbacks
       SERVER_BASE_URL: "${SERVER_BASE_URL:-https://prod.eagle0.net}"
       # JWT keys - PEM files in volume, bootstrapped from JWK on first run
@@ -140,6 +150,8 @@ services:
       FASTMAIL_API_TOKEN: "${FASTMAIL_API_TOKEN:-}"
       FASTMAIL_FROM_EMAIL: "${FASTMAIL_FROM_EMAIL:-}"
       FASTMAIL_FROM_NAME: "${FASTMAIL_FROM_NAME:-}"
+      # Require invitation codes for new user registration
+      REQUIRE_INVITATION_CODE: "true"
     # Note: port 40033 is exposed via nginx, not directly
     volumes:
       - jwt-keys:/etc/eagle0/keys  # Shared JWT keys with Eagle
@@ -158,30 +170,8 @@ services:
       retries: 3
       start_period: 10s
 
-  shardok:
-    image: ${SHARDOK_IMAGE:-registry.digitalocean.com/eagle0/shardok-server:latest}
-    container_name: shardok-server
-    mem_limit: 1g
-    memswap_limit: 1g  # Prevent swap, OOM-kill cleanly instead
-    ports:
-      - "40042:40042"
-      - "40052:40052"
-    environment:
-      SHARDOK_RESOURCES_PATH: "/app/resources"
-      SHARDOK_MAPS_PATH: "/app/resources/maps"
-      SHARDOK_EAGLE_INTERFACE_ADDRESS: "0.0.0.0:40042"
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "100m"
-        max-file: "5"
-    healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost 40042 || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
+  # Note: Shardok runs on Hetzner ARM64 server, not in this docker-compose.
+  # Configure SHARDOK_ADDRESS to point to the Hetzner instance.
 
   nginx:
     image: nginx:alpine
@@ -196,8 +186,9 @@ services:
       - ./certbot/www:/var/www/certbot:ro
       - ./auth:/etc/nginx/auth:ro
     depends_on:
-      - eagle-blue
       - admin
+    # Note: nginx connects to eagle via EAGLE_ADDR (default: eagle-blue:40032)
+    # For blue-green deployments, update EAGLE_ADDR in .env before switching
     restart: unless-stopped
     logging:
       driver: "json-file"
@@ -214,14 +205,17 @@ services:
       - "--auth-addr"
       - "auth:40033"
       - "--jfr-sidecar-addr"
-      - "jfr-sidecar:8081"
+      - "${JFR_SIDECAR_ADDR:-jfr-sidecar:8081}"  # Can be switched for blue-green
       - "--http-port"
       - "8080"
+    environment:
+      # Secret for CI to authenticate client update notifications
+      NOTIFY_SECRET: "${NOTIFY_SECRET:-}"
     # No external port - accessed via nginx at admin.eagle0.net
     depends_on:
-      - eagle-blue
       - auth
-      - jfr-sidecar
+    # Note: admin connects to eagle via EAGLE_ADDR and jfr-sidecar via JFR_SIDECAR_ADDR
+    # For blue-green deployments, set both in .env before switching
     restart: unless-stopped
     logging:
       driver: "json-file"
@@ -239,6 +233,7 @@ services:
     image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
     container_name: jfr-sidecar
     # Share PID namespace with Eagle to access its JVM via jcmd
+    # For blue-green: use JFR_SIDECAR_ADDR=jfr-sidecar-green:8081 when green is active
     pid: "service:eagle-blue"
     volumes:
       - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
@@ -257,6 +252,29 @@ services:
       retries: 3
       start_period: 10s
 
+  jfr-sidecar-green:
+    image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
+    container_name: jfr-sidecar-green
+    profiles: ["blue-green"]  # Only started during blue-green deployment
+    # Share PID namespace with Eagle green instance
+    pid: "service:eagle-green"
+    volumes:
+      - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
+    depends_on:
+      - eagle-green
+    restart: "no"  # Don't auto-restart during deployment
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "2"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8081/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
   certbot:
     image: certbot/certbot
     container_name: certbot

docs/ADMIN_SERVER_ENHANCEMENTS.md

@@ -1,471 +0,0 @@
-# Admin Server Enhancement Plan
-
-## Overview
-
-This document outlines enhancements to the Go admin server (`src/main/go/net/eagle0/admin_server/`) to provide a proper web UI for game administration.
-
-### Current State
-
-The admin server provides a full web UI with htmx interactivity:
-- `GET /` - Redirect to games list
-- `GET /games` - Game list page (HTML)
-- `GET /games/{id}` - Game detail with action history
-- `GET /games/{id}/history` - History rows (htmx partial, infinite scroll)
-- `GET /games/{id}/action/{index}` - Action detail (htmx partial)
-- `POST /games/{id}/rewind` - Rewind game to target action
-- `GET /settings` - Settings list with live search
-- `POST /settings/update` - Update setting value
-- `GET /health` - Health check (JSON)
-- `GET /api/games` - JSON API for programmatic access
-- `GET /api/games/{id}/history` - JSON API for history
-
-### Goals
-
-1. **Web UI**: Replace raw JSON with an interactive HTML interface
-2. **Settings Management**: View and modify the 275+ game settings at runtime
-3. **Game Rewind**: Restore a game to a previous action count
-
----
-
-## Architecture
-
-### Technology Choice: Go Templates + htmx
-
-**Rationale:**
-- Single binary deployment (no separate frontend build)
-- htmx provides interactivity without JavaScript framework complexity
-- Familiar HTML/CSS, minimal learning curve
-- Excellent for admin tools where SEO and bundle size don't matter
-
-**Alternatives Considered:**
-- React/Vue SPA: Adds build complexity, separate deployment artifact
-- Server-side only: Less interactive, full page reloads
-
-### Directory Structure
-
-```
-src/main/go/net/eagle0/admin_server/
-├── admin_server.go         # Main entry point, HTTP routes
-├── handlers/
-│   ├── games.go            # Game list and detail handlers
-│   ├── settings.go         # Settings list and update handlers
-│   └── rewind.go           # Game rewind handlers
-├── templates/
-│   ├── layout.html         # Base layout with nav, htmx includes
-│   ├── games/
-│   │   ├── list.html       # Game list page
-│   │   ├── detail.html     # Single game view with history
-│   │   └── history.html    # Partial for history table (htmx)
-│   ├── settings/
-│   │   ├── list.html       # Settings list with search/filter
-│   │   └── edit.html       # Inline edit partial (htmx)
-│   └── rewind/
-│       └── confirm.html    # Rewind confirmation modal
-├── static/
-│   ├── style.css           # Minimal CSS (Pico CSS or similar)
-│   └── htmx.min.js         # htmx library
-└── BUILD.bazel
-```
-
----
-
-## Feature 1: Web UI
-
-### Routes
-
-| Route | Method | Description |
-|-------|--------|-------------|
-| `/` | GET | Redirect to `/games` |
-| `/games` | GET | Game list page (HTML) |
-| `/games/{id}` | GET | Game detail page with history |
-| `/games/{id}/history` | GET | History partial (htmx, for infinite scroll) |
-| `/api/games` | GET | JSON API (existing, keep for programmatic access) |
-| `/api/games/{id}/history` | GET | JSON API (existing) |
-
-### Game List Page
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│  Eagle Admin                          [Settings] [Health]   │
-├─────────────────────────────────────────────────────────────┤
-│                                                             │
-│  Running Games (3)                                          │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ Game abc123f                          Round 45       │   │
-│  │ Players: Liu Bei (Human), Cao Cao (AI), Sun Quan    │   │
-│  │ Actions: 1,234                        [View] [Rewind]│   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ Game def456a                          Round 12       │   │
-│  │ Players: Test Player (Human)                         │   │
-│  │ Actions: 456                          [View] [Rewind]│   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-└─────────────────────────────────────────────────────────────┘
-```
-
-### Game Detail Page
-
-Shows game info and scrollable action history:
-- **Reverse chronological order**: Most recent actions displayed first
-- Each action shows: index, type, round ID
-- **Clickable actions**: Clicking an action row expands to show JSON representation of the full action data
-- "Rewind to here" button on each action row
-- Infinite scroll loads more history via htmx (loading older actions as user scrolls down)
-
-### Implementation Notes
-
-1. **Embed static files**: Use `//go:embed` to bundle templates and static files
-2. **Template functions**: Add helpers for formatting (hex IDs, timestamps, action summaries)
-3. **CSS framework**: Use Pico CSS (~10KB) for clean defaults without classes
-
----
-
-## Feature 2: Settings Management
-
-### New gRPC Endpoints (Eagle Server)
-
-Add to `eagle.proto`:
-
-```protobuf
-message Setting {
-  string name = 1;
-  string type = 2;           // "Int" or "Double"
-  string value = 3;          // Current value as string
-  string default_value = 4;  // Default from BUILD.bazel
-  string description = 5;    // Optional, for UI hints
-}
-
-message GetSettingsRequest {
-  string filter = 1;         // Optional name filter (substring match)
-}
-
-message GetSettingsResponse {
-  repeated Setting settings = 1;
-}
-
-message UpdateSettingRequest {
-  string name = 1;
-  string value = 2;
-}
-
-message UpdateSettingResponse {
-  Setting setting = 1;       // Updated setting
-  string error = 2;          // Empty on success
-}
-
-service Eagle {
-  // ... existing methods ...
-  rpc GetSettings(GetSettingsRequest) returns (GetSettingsResponse);
-  rpc UpdateSetting(UpdateSettingRequest) returns (UpdateSettingResponse);
-}
-```
-
-### Eagle Server Implementation
-
-Create a settings registry that:
-1. Discovers all `IntSetting` and `DoubleSetting` instances via reflection or explicit registration
-2. Provides get/set by name
-3. Validates types on update
-
-```scala
-// src/main/scala/net/eagle0/eagle/library/settings/SettingsRegistry.scala
-object SettingsRegistry {
-  private val settings: Map[String, Either[IntSetting, DoubleSetting]] = Map(
-    "ActionVigorCost" -> Left(ActionVigorCost),
-    "BaseFoodBuyPrice" -> Right(BaseFoodBuyPrice),
-    // ... register all 275 settings
-  )
-
-  def getAll(filter: Option[String]): Seq[Setting] = ...
-  def get(name: String): Option[Setting] = ...
-  def update(name: String, value: String): Either[String, Setting] = ...
-}
-```
-
-**Alternative: Code generation**
-
-Rather than manually registering 275 settings, modify `setting_rule.bzl` to generate a registry file during build.
-
-### Admin Server Routes
-
-| Route | Method | Description |
-|-------|--------|-------------|
-| `/settings` | GET | Settings list page with search |
-| `/settings/{name}` | GET | Single setting detail (htmx partial) |
-| `/settings/{name}` | PUT | Update setting value |
-| `/api/settings` | GET | JSON API |
-| `/api/settings/{name}` | PUT | JSON API |
-
-### Settings UI
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│  Eagle Admin                          [Games] [Health]       │
-├─────────────────────────────────────────────────────────────┤
-│                                                             │
-│  Settings                    [Search: __________ ]          │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ ActionVigorCost (Int)                                │   │
-│  │ Current: [15    ] Default: 15              [Save]    │   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ BaseFoodBuyPrice (Double)                            │   │
-│  │ Current: [0.5   ] Default: 0.5             [Save]    │   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-│  ... (275 settings, virtualized/paginated) ...              │
-│                                                             │
-└─────────────────────────────────────────────────────────────┘
-```
-
-### Considerations
-
-1. **Persistence**: Settings changes are in-memory only. Document that restarts reset to defaults.
-2. **Validation**: Validate numeric ranges where applicable (e.g., percentages 0-100)
-3. **Categories**: Consider grouping settings by prefix (AI*, Combat*, Economy*, etc.)
-4. **Audit log**: Log setting changes with timestamp for debugging
-
----
-
-## Feature 3: Game Rewind
-
-### Concept
-
-Restore a game to a previous point in its action history. This is useful for:
-- Debugging issues that occurred at a specific point
-- Testing "what if" scenarios
-- Recovering from bugs that corrupted state
-
-### New gRPC Endpoint
-
-Add to `eagle.proto`:
-
-```protobuf
-message RewindGameRequest {
-  int64 game_id = 1;
-  int32 target_action_count = 2;  // Rewind to state after this many actions
-}
-
-message RewindGameResponse {
-  bool success = 1;
-  string error = 2;
-  int32 new_action_count = 3;
-  int32 disconnected_clients = 4;  // Number of clients that were disconnected
-}
-
-service Eagle {
-  // ... existing methods ...
-  rpc RewindGame(RewindGameRequest) returns (RewindGameResponse);
-}
-```
-
-### Eagle Server Implementation
-
-The `GameHistory` already stores `ActionWithResultingState` for each action, which includes the `GameState` after that action. Rewinding means:
-
-1. **Validate**: Check that `target_action_count` is within valid range (0 to current count)
-2. **Get target state**: Retrieve `GameState` at target action count from history
-3. **Disconnect clients**: Close all human player connections (they'll need to reconnect)
-4. **Replace engine**: Create new `EngineImpl` with target state and truncated history
-5. **Reset AI state**: Clear any cached AI state that depends on current game state
-
-```scala
-// GameController.scala (pseudocode)
-def rewindTo(targetActionCount: Int): Either[String, RewindResult] = {
-  if (targetActionCount < 0 || targetActionCount > engine.history.count)
-    return Left(s"Invalid action count: $targetActionCount")
-
-  // Get state at target point
-  val targetState = engine.history.stateAt(targetActionCount)
-  val truncatedHistory = engine.history.truncateTo(targetActionCount)
-
-  // Disconnect all human clients
-  val disconnectedCount = humanClients.length
-  humanClients.foreach(_.disconnect("Game rewound by admin"))
-
-  // Create new engine at target state
-  val newEngine = EngineImpl(
-    gameId = engine.gameId,
-    currentState = targetState,
-    history = truncatedHistory,
-    // ... other fields
-  )
-
-  // Replace controller's engine
-  this.engine = newEngine
-
-  Right(RewindResult(targetActionCount, disconnectedCount))
-}
-```
-
-### GameHistory Enhancement
-
-Add method to get state at a specific action count:
-
-```scala
-trait GameHistory {
-  // ... existing methods ...
-
-  def stateAt(actionCount: Int): GameState = {
-    if (actionCount == 0) initialState
-    else all(actionCount - 1).resultingState
-  }
-
-  def truncateTo(actionCount: Int): GameHistory = {
-    GameHistoryImpl(
-      initialState = initialState,
-      actions = all.take(actionCount)
-    )
-  }
-}
-```
-
-### Admin Server Route
-
-| Route | Method | Description |
-|-------|--------|-------------|
-| `/games/{id}/rewind` | POST | Rewind game (form: `target_action_count`) |
-| `/games/{id}/rewind/confirm` | GET | Confirmation modal (htmx partial) |
-
-### Rewind UI Flow
-
-1. User views game history
-2. User clicks "Rewind to here" on an action row
-3. Confirmation modal appears via htmx:
-   ```
-   ┌─────────────────────────────────────────┐
-   │  Rewind Game abc123f?                   │
-   │                                         │
-   │  This will:                             │
-   │  • Restore to action 456 (Round 23)     │
-   │  • Discard 778 subsequent actions       │
-   │  • Disconnect 2 connected players       │
-   │                                         │
-   │  This cannot be undone.                 │
-   │                                         │
-   │            [Cancel]  [Rewind]           │
-   └─────────────────────────────────────────┘
-   ```
-4. On confirm, POST to `/games/{id}/rewind`
-5. Success: redirect to game detail showing new state
-6. Error: show error message
-
-### Safety Considerations
-
-1. **No undo**: Rewinding discards history. Consider optional backup before rewind.
-2. **Client disconnect**: All connected clients are forcibly disconnected.
-3. **AI state**: Ensure AI clients restart cleanly after rewind.
-4. **Concurrent access**: Lock game during rewind to prevent race conditions.
-5. **Authorization**: In production, require admin authentication.
-
----
-
-## Implementation Phases
-
-### Phase 1: Web UI Foundation
-
-**Status: Complete**
-
-1. ✅ Set up Go templates with `embed`
-2. ✅ Add Pico CSS and htmx
-3. ✅ Create base layout with navigation
-4. ✅ Convert `/games` to HTML with styling
-5. ✅ Add game detail page with history table
-6. ✅ Implement htmx infinite scroll for history
-7. ✅ Reverse history order (most recent first)
-8. ✅ Clickable action rows that expand to show JSON representation
-9. ✅ Add `/games/{id}/action/{index}` endpoint for fetching action details
-
-**Deliverable**: Browsable game list and history in HTML with clickable action details
-
-### Phase 2: Settings Management
-
-**Status: Complete**
-
-1. ✅ Add `GetSettings` to `eagle.proto` (uses existing `AddSettings` for updates)
-2. ✅ Add `getAllSettings` method to auto-generated `SettingsLoader`
-3. ✅ Implement `getSettings` in `EagleServiceImpl`
-4. ✅ Create settings list page with live search
-5. ✅ Add inline editing with htmx
-6. ✅ Modified settings are highlighted
-
-**Deliverable**: View and edit settings via admin UI
-
-### Phase 3: Game Rewind
-
-**Status: Complete**
-
-1. ✅ Add `RewindGame` to `eagle.proto`
-2. ✅ Implement `stateAt` and `truncateTo` in `GameHistory`
-3. ✅ Implement rewind logic in `Engine` and `GameController`
-4. ✅ Add rewind confirmation (htmx `hx-confirm` dialog)
-5. ✅ Handle client disconnection gracefully
-6. ✅ Add rewind button to history rows
-7. ✅ Implement `rewindGame` in `GamesManager` and `EagleServiceImpl`
-8. ✅ Add admin server `/games/{id}/rewind` POST handler
-9. ✅ Add success/error feedback UI
-
-**Deliverable**: Rewind games to any previous action
-
-### Phase 4: Polish
-
-**Status: Not Started**
-
-#### High Priority
-1. **Add tests for rewind functionality**
-   - `PersistedHistory.truncateTo` (handles complex persisted vs recent logic)
-   - `InMemoryHistory.truncateTo`
-   - `EngineImpl.rewindTo`
-   - `GameController.rewindTo`
-   - `GamesManager.rewindGame`
-
-2. **Improve action history display**
-   - Human-readable action type names (e.g., "New Round" instead of "NewRoundAction")
-   - Show acting faction/province when available
-   - Action summaries from the `summary` field in `GameHistoryEntry`
-
-#### Medium Priority
-3. **Settings improvements**
-   - Group settings by category prefix (AI*, Combat*, Economy*, etc.)
-   - Show setting descriptions where available
-   - Pagination for large settings lists
-
-4. **Error handling improvements**
-   - Better error messages on failed operations
-   - Retry logic for transient gRPC failures
-
-#### Low Priority (Nice to Have)
-5. **Basic auth** - HTTP Basic Auth or OAuth for production use
-6. **Audit logging** - Log admin actions with timestamps
-7. **Documentation** - Usage guide, deployment notes
-
-#### Future Considerations
-- Game creation from admin UI
-- Player management (view connected players, force disconnect)
-- Export game history to file
-- Metrics/stats dashboard
-
----
-
-## Security Notes
-
-The admin server is intended for local/trusted network use only. For production:
-
-1. **Do not expose to public internet** without authentication
-2. Consider adding HTTP Basic Auth or OAuth
-3. Run on internal network or behind VPN
-4. Log all admin actions for audit trail
-
----
-
-## Open Questions
-
-1. **Settings persistence**: Should we add optional persistence to disk/database?
-2. **Game snapshots**: Should rewind create a backup first?
-3. **Multi-admin**: Need locking if multiple admins access simultaneously?
-4. **Shardok settings**: Are there Shardok (C++) settings to expose too?

docs/ASSET_AUDIT.md

@@ -109,11 +109,41 @@ All 26 tracks have CC licenses with proper attribution:
 | Dragon Castle | Makai Symphony | CC BY-SA 3.0 |
 | Durandal | Makai Symphony | CC BY-SA 3.0 |
 
-**Tracks without specific license (verify):**
-- Market Day
-- Shopping List
-- Medieval: Victory Theme
-- Tracks by Dima Koltsov (AUDIUS): No Time for Greatness, Warriors of Demacia, Forest Queen Tale, Valor, Clouds
+**Tracks with non-CC licenses:**
+
+| Track | Artist | License | Source |
+|-------|--------|---------|--------|
+| Market Day | RandomMind | Free without attribution | [Chosic](https://www.chosic.com/download-audio/27016/) |
+| Shopping List | Komiku | Free without attribution | [Chosic](https://www.chosic.com/download-audio/24714/) |
+| Medieval: Victory Theme | RandomMind | CC0 Public Domain | [Chosic](https://www.chosic.com/download-audio/28492/) |
+| No Time for Greatness | Dima Koltsov | CC BY 4.0 | [YouTube](https://www.youtube.com/watch?v=cQh0OWIFdgM) |
+| Warriors of Demacia | Dima Koltsov | CC BY 4.0 | [YouTube](https://www.youtube.com/watch?v=yktSUMJn9ao) |
+| Forest Queen Tale | Dima Koltsov | Presumed CC BY 4.0 | Not found on YouTube; other Dima Koltsov tracks are CC BY 4.0 |
+| Valor | Dima Koltsov | CC BY 4.0 | [YouTube](https://www.youtube.com/watch?v=uoHYJRPcS2Y) |
+| Clouds | Dima Koltsov | Presumed CC BY 4.0 | Not found on YouTube; other Dima Koltsov tracks are CC BY 4.0 |
+
+**Note on Dima Koltsov tracks:** 3 of 5 tracks confirmed CC BY 4.0 via YouTube. 2 remaining tracks (Forest Queen Tale, Clouds) presumed same license but not verified.
+
+---
+
+## 2b. Creative Commons Sound Effects
+
+**Location:** `Assets/Shardok/Sounds/`
+
+| File | Description | Artist | License | Source |
+|------|-------------|--------|---------|--------|
+| `rain_loop.ogg` | Rain falling on clay roof tiles (loopable) | aesqe | CC BY 4.0 | [Freesound #37618](https://freesound.org/people/aesqe/sounds/37618/) |
+| `blizzard_wind_loop.wav` | Wind draft loop (indoor recording, loops seamlessly) | nsstudios | CC BY 4.0 | [Freesound #651540](https://freesound.org/people/nsstudios/sounds/651540/) |
+| `thunder_distant.mp3` | Distant thunder rumble | LittleRainySeasons | CC BY 4.0 | [Freesound #351526](https://freesound.org/people/LittleRainySeasons/sounds/351526/) |
+| `thunder_loud.mp3` | Loud thunder clap | mokasza | CC BY 4.0 | [Freesound #810746](https://freesound.org/people/mokasza/sounds/810746/) |
+| `thunder_crack.wav` | Thunder crack | OneSoundToRuleThemAll | CC BY 4.0 | [Freesound #238796](https://freesound.org/people/OneSoundToRuleThemAll/sounds/238796/) |
+| `thunder_clap.wav` | Thunder clap | FreqMan | CC BY 4.0 | [Freesound #32544](https://freesound.org/people/FreqMan/sounds/32544/) |
+
+**Location:** `Assets/Shardok/soundEffects/`
+
+| File | Description | Artist | License | Source |
+|------|-------------|--------|---------|--------|
+| `runaway.mp3` | Medieval army running loop (gravel + metal/chain) | Yap_Audio_Production | CC BY 4.0 | [Freesound #218997](https://freesound.org/people/Yap_Audio_Production/sounds/218997/) |
 
 ---
 
@@ -129,42 +159,61 @@ All 26 tracks have CC licenses with proper attribution:
 
 ## 4. Potentially Problematic Assets (Review Needed)
 
-### Stock Images (Possible License Issues)
-These appear to be stock images that may have been used as placeholders:
-
-| File | Concern |
-|------|---------|
-| ~~`Assets/Eagle/79066358-stock-illustration-raster-illustration-medieval-purse-bag...jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Images/kisspng-hammer-hand-saws-tool-clip-art...jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Images/lee-ermy-cropped.jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Eagle/images.jpeg`~~ | **DELETED** (2025-01-04) |
-
-### Clip Art (Unknown License)
-| File | Concern |
-|------|---------|
-| `Assets/Shardok/commandImages/bridge.png` | Clip art style wooden bridge, unknown source - **needs replacement** |
-| `Assets/Images/startFire.png` | Icon, unknown source - **needs verification or replacement** |
+### ~~Clip Art (Unknown License)~~ RESOLVED
+| File | Status |
+|------|--------|
+| ~~`Assets/Shardok/commandImages/bridge.png`~~ | **REPLACED** (2026-01-23) with AI-generated wooden rope bridge icon (ChatGPT/DALL-E 3, 512x512 PNG). No licensing restrictions - AI-generated for this project. |
+| ~~`Assets/Images/startFire.png`~~ | **REPLACED** (2026-01-23) with "Flame Icon" from [UXWing](https://uxwing.com/flame-icon/) (free for commercial use, no attribution required). Consolidated duplicate removed. |
+| ~~`Assets/Shardok/commandImages/startFire.png`~~ | **DELETED** (2026-01-23) - duplicate removed, all references updated to use `Assets/Images/startFire.png` |
 
 ### Shardok Sound Effects
 - **Location:** `Assets/Shardok/soundEffects/`
-- **Count:** 56 MP3 files
+- **Count:** 37 audio files (was incorrectly counted as 56 including .meta files)
 - **Contents:** Spell effects, movement, combat sounds
-- **Status:** Unknown origin - may be custom or need verification
 
-### Free Icons
-- **Location:** `Assets/free_icons/`
-- **Count:** 8 PNG weather icons
-- **Status:** Verify "free" means commercially usable
+**Verified from [Zombie Monster - Undead Collection](https://assetstore.unity.com/packages/audio/sound-fx/creatures/zombie-monster-undead-collection-70662) (Unity Asset Store):**
+- `raise_undead.mp3`
+- `undead_break_control.mp3`
+- `undead_grew.wav`
 
-### Terrain Hexes
+**⚠️ MUST REPLACE (1 remaining):**
+- ~~`anybody.mp3`~~ - **REPLACED** (2026-01-23) with `Positive Effect 6.wav` from Magic Spells Sound Effects LITE
+- ~~`burnination.mp3`~~ - **REPLACED** (2026-01-23) with `Magic Element Fire 04.wav` from Medieval Combat Sounds
+- `failure_horn.mp3` - licensing issue, no replacement found in purchased assets
+- ~~`runaway.mp3`~~ - **REPLACED** (2026-01-27) with `MedievalArmyRunningLoop.mp3` from Freesound (CC BY 4.0)
+
+**Presumed from Unity Asset Store purchases (31 files):**
+Owner believes these are from: Fantasy Interface Sounds, Medieval Combat Sounds, Magic Spells Sound Effects LITE, and/or Medieval Battle Sound Pack.
+- `archery.mp3`, `battle_shout.mp3`, `boo.mp3`, `braved_water.mp3`
+- `build_bridge.mp3`, `build_bridge_failure.mp3`, `charge.mp3`
+- `dismiss_unit.mp3`, `duel_challenged.mp3`, `failure_horn.mp3`, `fear.mp3`, `fear_failed.mp3`
+- `fire_extinguish.mp3`, `fire_spread.mp3`, `fire_start.mp3`, `fire_start_failure.mp3`
+- `freeze.mp3`, `holy_wave.mp3`, `holy_wave_damage.mp3`, `jail_door.mp3`, `lightning.mp3`
+- `melee.mp3`, `meteor.mp3`, `mind_control.mp3`, `move.mp3`, `move 1.mp3`
+- `raging_fire.mp3`, `reduce.mp3`, `repair.mp3`, `repair_failed.mp3`, `splash.mp3`
+
+### ~~Free Icons~~ RESOLVED
+- **Location:** `Assets/free_icons/` - **DELETED** (2026-01-27)
+- **Resolution:** All icons replaced with equivalents from purchased Asset Store packs:
+  - `blizzard.png` → `16_blizzard_nobg.png` (4000_Fantasy_Icons)
+  - `rain.png` → `12_Magic_rain_nobg.png` (4000_Fantasy_Icons)
+  - `thunderstorm.png` → `27_Storm_nobg.png` (4000_Fantasy_Icons)
+  - `wind.png` → `23_Light_blow_nobg.png` (4000_Fantasy_Icons)
+  - `thermometer.png` → `startFire.png` (existing licensed asset)
+  - `snow.png` → `16_blizzard_nobg.png` (4000_Fantasy_Icons)
+  - `cloud.png`, `sun.png` → deleted (unused)
+
+### ~~Terrain Hexes~~ VERIFIED
 - **Location:** `Assets/Terrain Hexes/`
 - **Count:** 85 PNG files
-- **Status:** Unknown source - verify licensing
+- **Status:** ✓ Confirmed Unity Asset Store purchase (2026-01-23)
 
-### StrategyGameIcons
+### ~~StrategyGameIcons~~ VERIFIED
 - **Location:** `Assets/StrategyGameIcons/`
 - **Count:** 138 PNG files
-- **Status:** Unknown source - verify licensing
+- **Publisher:** REXARD
+- **Asset Store Link:** https://assetstore.unity.com/packages/2d/gui/icons/strategy-game-icons-64816
+- **Status:** ✓ Confirmed Unity Asset Store purchase (2026-01-23)
 
 ---
 
@@ -194,28 +243,31 @@ NuGet packages in `Assets/Packages/` all include LICENSE.TXT files:
 
 ## Action Items
 
-### Must Verify Before Opening Public Access:
+### Must Replace Before Opening Public Access:
 
-1. ~~**Stock images** - The JPG files with stock image filenames need review.~~ **DONE** - Deleted lee-ermy, kisspng, stock-illustration, Yosemite Sam, and images.jpeg (2025-01-04)
+1. ~~**Clip art images**~~ - **RESOLVED** (2026-01-23): Replaced with properly licensed alternatives
 
-2. **Clip art images** - Unknown license, need replacement with properly licensed alternatives:
-   - `Assets/Shardok/commandImages/bridge.png` - wooden bridge icon
-   - `Assets/Images/startFire.png` - fire icon
+2. ~~**Shardok sound effects**~~ - **ALL RESOLVED**:
+   - ~~`anybody.mp3`~~ - **REPLACED** (2026-01-23)
+   - ~~`burnination.mp3`~~ - **REPLACED** (2026-01-23)
+   - ~~`failure_horn.mp3`~~ - **REPLACED** (2026-01-27) with `Negative Effect 04.wav` from Magic Spells Sound Effects LITE
+   - ~~`runaway.mp3`~~ - **REPLACED** (2026-01-27) with Freesound CC BY 4.0
 
-3. **Shardok sound effects** - 56 MP3 files of unknown origin. Either:
-   - Document their source
-   - Replace with known-licensed alternatives
-   - Confirm they were custom-created
+### Low Priority (Verify):
 
-4. **Terrain Hexes** - 85 hex tiles of unknown source
-   - **TODO:** Confirm if this is a Unity Asset Store purchase (owner believes it is)
+3. **Dima Koltsov tracks** - 2 of 5 not verified: `Forest Queen Tale`, `Clouds` (presumed CC BY 4.0 like his other tracks)
 
-5. **StrategyGameIcons** - 138 icons of unknown source
-   - **TODO:** Investigate origin - check Unity Asset Store purchase history
+### Already Resolved:
 
-6. **AUDIUS music tracks** - Verify Dima Koltsov tracks are licensed for commercial use
+4. ~~**Free Icons**~~ - **RESOLVED** (2026-01-27): All replaced with Asset Store equivalents, folder deleted
 
-7. **Discord logo** (`Eagle/Discord-Logo-Blurple.png`) - Likely fine for "Login with Discord" button per Discord brand guidelines, but verify usage complies with their terms
+5. ~~**Terrain Hexes**~~ - **VERIFIED** (2026-01-23): Confirmed Unity Asset Store purchase
+
+6. ~~**StrategyGameIcons**~~ - **VERIFIED** (2026-01-23): Unity Asset Store purchase (REXARD)
+
+7. ~~**Medieval: Victory Theme**~~ - **VERIFIED** (2026-01-23): CC0 Public Domain by RandomMind ([Chosic](https://www.chosic.com/download-audio/28492/))
+
+8. ~~**Discord logo**~~ - **OK** (2026-01-23): Usage complies with Discord brand guidelines for "Login with Discord" button
 
 ### Already Safe:
 
@@ -229,12 +281,23 @@ NuGet packages in `Assets/Packages/` all include LICENSE.TXT files:
 
 ## Recommendation
 
-Before removing HTTP basic auth:
+**Remaining before public release:**
 
-1. ~~Delete or replace the 4 suspicious JPG/JPEG files in `Assets/Eagle/` and `Assets/Images/`~~ **DONE** (2025-01-04)
-2. Replace clip art images (`bridge.png`, `startFire.png`) with properly licensed alternatives (e.g., from [game-icons.net](https://game-icons.net) CC BY 3.0)
-3. Verify source of `Assets/Shardok/soundEffects/` MP3s
-4. Verify source of `Assets/Terrain Hexes/` and `Assets/StrategyGameIcons/`
-5. If any are from early development with unclear licensing, replace them
+None! All required items resolved.
+
+**Low priority:**
+
+2. Verify 2 Dima Koltsov tracks (`Forest Queen Tale`, `Clouds`) - presumed CC BY 4.0
+
+**Already resolved:**
+
+- ~~Clip art images~~ **DONE** - replaced with properly licensed alternatives
+- ~~Terrain Hexes~~ **DONE** - confirmed Asset Store purchase
+- ~~StrategyGameIcons~~ **DONE** - Unity Asset Store (REXARD)
+- ~~Medieval: Victory Theme~~ **DONE** - CC0 Public Domain
+- ~~3 other Dima Koltsov tracks~~ **DONE** - confirmed CC BY 4.0
+- ~~anybody.mp3, burnination.mp3~~ **DONE** - replaced
+- ~~free_icons~~ **DONE** - replaced with Asset Store equivalents
+- ~~failure_horn.mp3~~ **DONE** - replaced with Negative Effect 04.wav
 
 The bulk of your assets (95%+) are properly licensed Asset Store purchases or CC content.

docs/DEPROTO_PLAN.md

@@ -1,388 +0,0 @@
-# Deproto Migration Plan
-
-## Vision
-
-**Protocol buffers should only be used at the edges** — for network serialization (gRPC) and disk persistence. Inside the Eagle game engine, all logic should operate on native Scala models.
-
-```
-┌─────────────────────────────────────────────────────────────────────┐
-│                         GRPC BOUNDARY                               │
-│  EagleServiceImpl.scala  ←→  Proto Messages  ←→  Unity Client       │
-└─────────────────────────────────────────────────────────────────────┘
-                                   ↓
-                          GameStateConverter
-                                   ↓
-┌─────────────────────────────────────────────────────────────────────┐
-│                         SCALA ENGINE                                │
-│                                                                     │
-│   GameStateC ───→ Actions ───→ ActionResultT ───→ New GameStateC   │
-│       ↑                                                   │        │
-│       │               (Pure Scala models)                 │        │
-│       └───────────────────────────────────────────────────┘        │
-│                                                                     │
-│   HeroC, FactionC, ProvinceC, BattalionC, ArmyC, etc.              │
-└─────────────────────────────────────────────────────────────────────┘
-                                   ↓
-                          GameStateConverter
-                                   ↓
-┌─────────────────────────────────────────────────────────────────────┐
-│                      PERSISTENCE BOUNDARY                           │
-│  GameHistory.scala  ←→  Proto Messages  ←→  File/Database          │
-└─────────────────────────────────────────────────────────────────────┘
-```
-
----
-
-## Current State
-
-### Completed Phases
-
-| Phase | Status | Summary |
-|-------|--------|---------|
-| Phase 1: GameStateC | **Complete** | Scala `GameState` model with 22 fields |
-| Phase 2: EngineImpl | **Complete** | Holds Scala `GameState` internally |
-| Phase 3: GameHistory | **Complete** | `stateAfter` returns Scala GameState |
-| Phase 4: ActionResultT | **Complete** | All 59 actions return `ActionResultT` |
-| Phase 5: Action Base Classes | **Complete** | All `RandomSequentialResultsAction` and `DeterministicSingleResultAction` converted to T-type base classes |
-| Phase 5b: Base Class Cleanup | **Complete** | `RandomSequentialResultsAction` and `DeterministicSingleResultAction` deleted |
-| Phase 5c: RoundPhaseAdvancer Actions | **Complete** | All actions called by RoundPhaseAdvancer accept Scala GameState |
-| Phase 5d: RoundPhaseAdvancer Itself | **Complete** | RoundPhaseAdvancer.checkForPhaseAdvancement takes Scala GameState |
-
-### Phase 5c/5d Progress (Complete)
-
-`RoundPhaseAdvancer.checkForPhaseAdvancement` now accepts Scala `GameState` and `ActionResultApplier` directly (PR #4677).
-
-| Action | PR | Status |
-|--------|-----|--------|
-| `PrisonerExchangeAction` | #4670 | ✅ Merged |
-| `PerformForcedTurnBackAction` | #4671 | ✅ Merged |
-| `PerformHeroDeparturesAction` | #4672 | ✅ Merged |
-| `RequestFreeForAllBattlesAction` | #4673 | ✅ Merged |
-| `EndPlayerCommandsPhaseAction` | #4674 | ✅ Merged |
-| `EndDiplomacyResolutionPhaseAction` | #4675 | ✅ Merged |
-| `RoundPhaseAdvancer` itself | #4677 | ✅ Merged |
-
-### EngineImpl Progress
-
-| Change | PR | Status |
-|--------|-----|--------|
-| `recursiveTransform` deleted | #4677 | ✅ Merged |
-| `recursiveTransformT` uses `RandomStateTSequencer` | #4677 | ✅ Merged |
-
-### Current Architecture
-
-**ActionResultT Production (100% Complete):**
-- All actions produce `ActionResultT`
-- Conversion to `ActionResultProto` happens via `ActionResultProtoConverter.toProto()`
-- No direct `ActionResultProto` construction outside the converter
-
-**ActionResultProto Consumption (Next Target):**
-- `ActionResultProtoApplierImpl` - applies proto results to proto GameState
-- `RoundPhaseAdvancer` - calls converter, passes protos to applier
-- `InMemoryHistory` / `PersistedHistory` - stores proto results
-- Service layer (`GameController`, `GamesManager`, etc.) - uses proto for client communication
-
----
-
-## Phase 6: Migrate to ActionResultT Consumers
-
-### Objective
-
-Eliminate internal consumption of `ActionResultProto`. Everything inside the engine should work with `ActionResultT`.
-
-### Current Flow (Proto-Heavy)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultProtoConverter.toProto()
-    → ActionResultProto
-    → ActionResultProtoApplierImpl.applyActionResults()
-    → GameStateProto
-    → GameStateConverter.fromProto()
-    → GameStateC
-```
-
-### Target Flow (T-Types Throughout)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultApplier.applyActionResults()
-    → GameStateC
-
-    (Proto conversion only at boundaries)
-```
-
-### Key Files to Convert
-
-**Tier 1 - Core Applier:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/actions/applier/ActionResultApplierImpl.scala
-```
-`ActionResultApplier` applies `ActionResultT` directly to Scala `GameState`. The legacy `ActionResultTApplierImpl` wraps it and converts to/from proto for callers that still need proto types.
-
-**Tier 2 - RoundPhaseAdvancer:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/RoundPhaseAdvancer.scala
-```
-Now accepts Scala `GameState` and `ActionResultApplier`. Only converts to proto lazily for `AvailableCommandsFactory` calls.
-
-**Tier 3 - Sequencers:**
-```
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateTSequencer.scala
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateProtoSequencer.scala
-```
-Modify `RandomStateTSequencer` to thread Scala `GameState` throughout (currently converts to proto internally). Then evaluate whether `RandomStateProtoSequencer` is still needed at all.
-
-**Current State**: `RandomStateTSequencer` accepts Scala `GameState` via its `apply()` method but internally converts to proto. All callback methods (`withRandomActionResult`, `withActionResults`, etc.) pass `GameStateProto` to callers, forcing actions that use the sequencer to work with proto types internally.
-
-**Target State**: Create a fully protoless sequencer where:
-1. `lastState` returns Scala `GameState` (not `lastStateProto`)
-2. All callback methods pass Scala `GameState` to callers
-3. Actions using the sequencer can be fully protoless
-
-**Migration Path**:
-1. Add `lastState: GameState` method alongside `lastStateProto` (non-breaking)
-2. Add parallel callback methods that pass Scala GameState (e.g., `withScalaActionResult`)
-3. Migrate actions one by one to use the new Scala-based callbacks
-4. Once all actions migrated, deprecate/remove proto-based callbacks
-5. Remove `lastStateProto` once no longer used
-
-**RandomStateSequencer Migration Progress** (PR #4679 introduced protoless `RandomStateSequencer`):
-
-| Action | Status |
-|--------|--------|
-| `TruceTurnBackPhaseAction` | ✅ Migrated (PR #4680) |
-| `EndHandleRiotsPhaseAction` | ✅ Migrated (PR #4684) |
-| `PerformVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformVassalDefenseDecisionsAction` | ✅ Migrated |
-| `EndVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformReconResolutionAction` | ✅ Migrated |
-| `NewRoundAction` | ✅ Migrated (PR #4698) |
-| `EndBattleAftermathPhaseAction` | ✅ Migrated (PR #4699) |
-| `EndDiplomacyResolutionPhaseAction` | ✅ Migrated |
-| `PerformUnaffiliatedHeroesAction` | ✅ Migrated |
-| `EngineImpl.recursiveTransformT` | ✅ Migrated (PR #4704) |
-| `ProtolessSequentialResultsActionWrapper` | ✅ Migrated (PR #4705) |
-| `LegacyRandomStateTSequencer` | ✅ **Deleted** (PR #4705) |
-
-**TCommandFactory Extraction** (PR #4684):
-
-To enable lightweight mocking of command creation in tests, `TCommandFactory` trait was extracted from `CommandFactory`. This allows tests to mock just the `makeTCommand` method without pulling in all 40+ command dependencies that `CommandFactory` requires.
-
-- `TCommandFactory` - lightweight trait with just `makeTCommand`
-- `CommandFactory extends TCommandFactory` - maintains backward compatibility
-- Actions accepting command factories now use `TCommandFactory` type for better testability
-
-**Tier 4 - History APIs:**
-```
-src/main/scala/net/eagle0/eagle/service/InMemoryHistory.scala
-src/main/scala/net/eagle0/eagle/service/PersistedHistory.scala
-```
-Change APIs to vend Scala `GameState` and `ActionResultT` instead of proto versions. `PersistedHistory` converts to proto internally for disk persistence; `InMemoryHistory` doesn't need proto at all.
-
-### ActionResultProto Consumer Inventory
-
-| File | Usage | Status |
-|------|-------|--------|
-| `ActionResultApplierImpl.scala` | Applies ActionResultT to Scala GameState | ✅ **Complete** |
-| `ActionResultTApplierImpl.scala` | Legacy wrapper - converts to/from proto | Keep until all callers migrated |
-| `RoundPhaseAdvancer.scala` | Uses Scala GameState | ✅ **Complete** |
-| `RandomStateSequencer.scala` | Threads Scala GameState | ✅ **Complete** |
-| `VigorXPApplier.scala` | Has both proto and Scala methods | Scala method exists, delete proto method when unused |
-| `PerformForcedTurnBackAction.scala` | Fully protoless | ✅ **Complete** |
-| `ResolveBattleAction.scala` | ✅ Fully protoless | Complete (PR #5048) |
-| `InMemoryHistory.scala` | Stores proto results | Pending - vend Scala types |
-| `PersistedHistory.scala` | Stores proto results | Pending - vend Scala types, convert for disk |
-| `GameController.scala` | Uses proto for client communication | Keep proto (gRPC boundary) |
-
-### Remaining Proto Usage in Actions
-
-**Progress: 52 of 52 action files (100%) are fully protoless.** ✅
-
-All action files have been migrated to use Scala types:
-
-| Action | Status | Notes |
-|--------|--------|-------|
-| `ResolveBattleAction` | ✅ Complete | PR #5048 - uses Scala GameState and ActionResultApplier |
-| `PerformVassalCommandsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `EndHandleRiotsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `PerformVassalDefenseDecisionsAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `EndVassalCommandsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-
-**Note:** `NewRoundAction` is now fully protoless after converting `ChronicleEventGenerator` to return Scala `ChronicleEvent` types directly.
-
-**Deleted Dead Code:**
-- `UnaffiliatedHeroMovedAction` - Was never called; `PerformUnaffiliatedHeroesAction.heroMovedResult` constructs `ActionResultC` directly
-- `HeroBackstoryUpdateActionGenerator.fromGameState` - Dead method that converted proto to Scala; only `apply(GameState)` is used
-
-**Note**: `PerformReconResolutionAction` and `EndBattleAftermathPhaseAction` are now fully protoless after:
-1. Migrating `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` to use Scala `ProvinceView`
-2. Adding Scala overload of `ProvinceViewFilter.withdrawnFromProvinceView`
-
-### Estimated Effort (Remaining)
-
-| Component | Lines | Complexity | Blocks |
-|-----------|-------|------------|--------|
-| History API updates | ~100 | Low | - |
-| **Total Remaining** | **~100** | | |
-
-**Completed:**
-- ✅ `ChronicleEventGenerator` converted to return Scala `ChronicleEvent` types directly
-- ✅ `CommandChoiceHelpers` migrated to Scala types
-- ✅ `ResolveBattleAction` refactored to use Scala GameState and ActionResultApplier (PR #5048)
-
-### Enum Type Migrations
-
-Proto enums are being converted to Scala sealed traits with converters at boundaries:
-
-| Enum | Scala Type | Status | Notes |
-|------|------------|--------|-------|
-| `DiplomacyOfferStatus` | `Status` sealed trait | ✅ **Complete** | PR #5093 - `EligibleDiplomacyStatuses` uses Scala types internally |
-| `RoundPhase` | `RoundPhase` sealed trait | Partial | Some usages converted |
-| `BattalionType` | `BattalionType` sealed trait | Partial | Some usages converted |
-
-**DiplomacyOfferStatus Migration (PR #5093):**
-- `EligibleDiplomacyStatuses.scala` now returns `Vector[Status]` instead of `Vector[DiplomacyOfferStatus]`
-- Call sites in `AvailableResolve*CommandFactory` files convert to proto via `StatusConverter.toProto` at the boundary
-- This pattern should be applied to other proto enums
-
-### CommandChoiceHelpers Migration Status
-
-Several command selectors have already been converted to use Scala types:
-
-| File | Status | Notes |
-|------|--------|-------|
-| `AttackCommandChooser.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
-| `AlmsCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
-| `FoodConsumptionUtils.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `RoundPhase` |
-| `MarchSuppliesHelpers.scala` | ✅ **Protoless** | Uses `BattalionT` |
-| `CombatUnitSelector.scala` | ✅ **Protoless** | Uses `HeroT`, `BattalionT`, `BattalionType` |
-| `ExpandCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `FactionT` |
-| `ImproveCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `HeroT` |
-| `OrganizeCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `BattalionT`, `BattalionType` |
-| `RansomOfferHelpers.scala` | ✅ **Protoless** | Uses Scala `GameState`, `FactionT` |
-| `CommandChoiceHelpers.scala` | ✅ **Protoless** | Uses Scala `GameState` throughout |
-| `ProvinceGoldSurplusCalculator.scala` | ✅ **Protoless** | Uses Scala types |
-
-**All CommandChoiceHelpers selectors have been migrated to Scala types.** ✅
-
-### Progress Summary
-
-| Metric | Value |
-|--------|-------|
-| Action files fully protoless | 52 / 52 (100%) ✅ |
-| Proto usages in remaining actions | 0 |
-| Next target | See "Next Candidates" section below |
-
-### Next Candidates
-
-Priority candidates for further deproto work:
-
-1. **More Enum Migrations** - Apply the `DiplomacyOfferStatus` pattern to other proto enums:
-   - Files importing `net.eagle0.eagle.common.round_phase.RoundPhase` (proto) could use Scala `RoundPhase`
-   - Files importing `net.eagle0.eagle.common.battalion_type.BattalionType` (proto) could use Scala `BattalionType`
-
-2. **AvailableCommandsFactory Files** - Many still use proto `GameState` internally:
-   - These files build proto `AvailableCommand` messages but could use Scala types for internal logic
-   - Convert to accept Scala `GameState`, only convert fields to proto when building the response
-
-3. **History APIs** - `InMemoryHistory` and `PersistedHistory`:
-   - Change to vend Scala `GameState` and `ActionResultT` instead of proto versions
-   - `PersistedHistory` converts to proto internally for disk persistence
-
-### Validation
-- [x] `ActionResultApplier` created and tested
-- [x] `RandomStateSequencer` threads Scala GameState throughout
-- [x] `RoundPhaseAdvancer` uses T-types internally
-- [x] `ProvinceViewFilter` has Scala overload for server-side use (PR #4752)
-- [x] `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` use Scala `ProvinceView`
-- [x] `ProvinceViewFilter.withdrawnFromProvinceView` has Scala overload
-- [x] `CommandChoiceHelpers` uses Scala types ✅
-- [x] All action files (52/52) are fully protoless ✅
-- [ ] `ProvinceViewFilter` faction-filtered views use Scala types
-- [ ] History APIs vend Scala types
-- [ ] No `ActionResultProtoConverter.toProto()` calls except at persistence/gRPC boundaries
-- [ ] All tests pass
-
----
-
-## Phase 7: Clean Up Legacy Utilities
-
-### Objective
-Remove remaining direct proto imports from utility classes.
-
-### Files to Modify
-
-| File | Status |
-|------|--------|
-| `CommandChoiceHelpers.scala` | Accepts proto `GameState`; blocks full deproto of `PerformVassalCommandsPhaseAction` and `PerformVassalDefenseDecisionsAction` |
-| `LegacyProvinceUtils.scala` | Replace with `ProvinceUtils.scala` - `hasImminentRiot` added (PR #4683) |
-| `LegacyFactionUtils.scala` | Replace proto imports with `FactionT` |
-| `LegacyUnaffiliatedHeroUtils.scala` | Replace proto imports with Scala models |
-| `BattalionTypeLoader.scala` | Keep proto for file loading, convert immediately after |
-| `BeastUtils.scala` | **Complete** - now uses Scala `BeastInfo` only |
-
-### View Filters (Partially Complete)
-
-The view filter utilities now have Scala overloads for server-side use:
-
-| File | Status | Notes |
-|------|--------|-------|
-| `ProvinceViewFilter.scala` | **Partial** | `filteredProvinceView(ProvinceT, ScalaGameState)` added (PR #4752) |
-| `ArmyFilter.scala` | **Partial** | `filterArmy(ScalaArmy, Map[BattalionId, BattalionT], Option[FactionId])` added |
-| `BattalionViewFilter.scala` | **Complete** | Uses Scala `BattalionT` throughout |
-| `GameStateViewFilter.scala` | Pending | Uses proto types throughout |
-| `GameStateViewDiffer.scala` | Pending | Works with view protos |
-
-**Unblocked Actions** (PR #4752):
-- `EndBattleAftermathPhaseAction` - can now use `filteredProvinceView(province, scalaGameState)`
-- `PerformReconResolutionAction` - can now use Scala overload
-- `GameStateFactionExtensions` - can now use `updatedReconnedProvinces` with Scala types
-
-**Remaining Work**:
-- Faction-filtered `filteredProvinceView(Province, GameState, FactionId)` still uses proto types
-- `withdrawnFromProvinceView` still uses proto types
-- These are needed for client-facing views with visibility restrictions
-
----
-
-## Phase 8: Verify Boundaries
-
-### Objective
-Confirm protos are used correctly at boundaries — and ONLY there.
-
-### Expected Proto Usage (Keep)
-- `EagleServiceImpl.scala` - gRPC boundary
-- `InMemoryHistory.scala` / `PersistedHistory.scala` - Persistence boundary
-- `*Converter.scala` - Explicit conversion utilities
-- `*Loader.scala` - File loading utilities
-
-### Expected No Proto Usage (Verify)
-- `/library/actions/impl/` - Pure Scala models
-- `/library/util/` - Pure Scala models (except loaders)
-- `/model/state/` - Pure Scala models
-
----
-
-## Open Questions
-
-1. **Persistence Format**: Currently game state is persisted as proto. Should we keep proto for persistence (good for schema evolution) or switch to a different format?
-
-2. **Shardok Integration**: `ResolveBattleAction` communicates with Shardok. Should the Shardok interface use protos (external service) or Scala models?
-
-3. **View Generation**: `GameStateViewDiffer` works with view protos for client updates. Views need Scala models (`ProvinceViewT`, etc.) to allow actions like `EndBattleAftermathPhaseAction` to be fully protoless. The Scala views would be converted to proto only at the gRPC boundary when sending updates to clients.
-
----
-
-## Success Criteria
-
-### Code Quality
-- [ ] Zero proto imports in `/library/actions/` (except boundaries)
-- [ ] Zero proto imports in `/library/` utilities (except loaders)
-- [ ] `GameStateT` used throughout engine internals
-- [ ] Proto usage limited to: `EagleServiceImpl`, loaders, converters, persistence
-
-### Architecture
-- [ ] Clear separation: Scala models (internal) vs Proto (boundaries)
-- [ ] Converters as the only bridge between domains
-- [ ] No "proto creep" into business logic

docs/LLM_MODEL_COMPARISON.md

@@ -0,0 +1,94 @@
+# LLM Model Comparison
+
+This document compares streaming latency (time-to-first-token) and pricing across OpenAI, Anthropic (Claude), and Google (Gemini) models for use in Eagle's narrative text generation.
+
+## Test Methodology
+
+All tests were performed locally using curl with streaming enabled. Each model was tested 3 times with the same prompt:
+
+> "Write a short paragraph about a brave knight who discovers a hidden cave. Make it vivid and descriptive."
+
+Time-to-first-token (TTFT) was measured from request initiation to the first text content appearing in the stream.
+
+## Streaming Latency Results (January 2026)
+
+| Model | Run 1 | Run 2 | Run 3 | Average TTFT |
+|-------|-------|-------|-------|--------------|
+| **Gemini 2.5 Flash-Lite** | 0.76s | 0.54s | 0.53s | **~0.6s** |
+| **gpt-4.1-mini** | 1.65s | 1.72s | 1.68s | **~1.7s** |
+| **claude-3-5-haiku** | 1.85s | 1.92s | 1.88s | **~1.9s** |
+| gpt-5.2 | 3.25s | 3.38s | 3.32s | **~3.3s** |
+| gpt-5-mini | 2.52s | 5.82s | 3.12s | **~3.8s** (high variance) |
+| Gemini 3 Flash Preview | 4.11s | 4.77s | 4.28s | **~4.4s** |
+| claude-sonnet-4 | 4.89s | 5.12s | 4.98s | **~5.0s** |
+| Gemini 2.5 Flash | 5.60s | 7.00s | 7.79s | **~6.8s** |
+
+## Pricing Comparison (per 1M tokens)
+
+| Model | Input Price | Output Price | Notes |
+|-------|-------------|--------------|-------|
+| **Gemini 2.5 Flash-Lite** | $0.10 | $0.40 | Cheapest and fastest |
+| Gemini 2.5 Flash | $0.15 | $0.60 | |
+| gpt-5-mini | $0.25 | $2.00 | |
+| **gpt-4.1-mini** | $0.40 | $1.60 | Best OpenAI value |
+| Gemini 3 Flash Preview | $0.50 | $3.00 | Includes thinking tokens |
+| **claude-3-5-haiku** | $0.80 | $4.00 | Best Anthropic value |
+| gpt-5.2 | ~$1.00 | ~$10.00 | Full reasoning model |
+| Gemini 2.5 Pro | $1.25 | $10.00 | |
+| Gemini 3 Pro Preview | $2.00 | $12.00 | ≤200K context |
+| claude-sonnet-4 | $3.00 | $15.00 | |
+
+## Recommendations
+
+### For Narrative Text Generation (Default)
+
+**Gemini 2.5 Flash-Lite** is recommended as the default:
+- Fastest TTFT (~0.6s) - nearly 3x faster than alternatives
+- Cheapest pricing ($0.10/$0.40 per 1M tokens)
+- Quality is acceptable for short narrative snippets
+
+### Alternative Options
+
+| Priority | Model | When to Use |
+|----------|-------|-------------|
+| Speed + Cost | Gemini 2.5 Flash-Lite | Default for most use cases |
+| Speed + Quality | gpt-4.1-mini | When you need OpenAI quality with good speed |
+| Instruction Following | claude-3-5-haiku | Complex multi-step prompts, consistent tone |
+| Maximum Quality | claude-sonnet-4 or gpt-5.2 | When output quality is paramount |
+
+### Quality Trade-offs
+
+For short narrative snippets (1-3 paragraphs):
+- **Flash-Lite vs Haiku/4.1-mini**: Minor quality difference, significant speed gain
+- **Haiku vs Sonnet**: Noticeable quality difference in creative writing variety
+- **gpt-4.1-mini vs gpt-5.2**: Moderate quality difference, significant cost savings
+
+## Configuration
+
+LLM settings can be changed at runtime via the admin console:
+
+1. Navigate to Admin Console → Settings
+2. Change `LlmProvider` to select vendor (gemini, openai, claude)
+3. Change the corresponding model name setting:
+   - `GeminiModelName` (default: gemini-2.5-flash-lite)
+   - `OpenAiModelName` (default: gpt-4.1-mini)
+   - `ClaudeModelName` (default: claude-3-5-haiku-20241022)
+
+Changes take effect on the next LLM request.
+
+## Environment Variables
+
+For production deployment, ensure API keys are set:
+
+```bash
+OPENAI_API_KEY=sk-...
+ANTHROPIC_API_KEY=sk-ant-...
+GEMINI_API_KEY=AIza...
+```
+
+## Notes
+
+- **gpt-5-mini** showed high latency variance (2.5s - 5.8s) in testing
+- **Gemini 2.5 Flash** was surprisingly slower than Flash-Lite, possibly due to internal reasoning overhead
+- **Gemini 3 Flash** is a frontier model with better quality but higher latency than 2.5 Flash-Lite
+- All Gemini models have a generous free tier (up to 1,000 daily requests)

docs/NEW_PROFESSION_PROPOSALS.md

@@ -0,0 +1,103 @@
+# New Profession Proposals
+
+This document proposes 5 new hero professions for Eagle0. Each profession has abilities for both the Eagle (strategic) and Shardok (tactical) game layers.
+
+## Current Professions Reference
+
+| Profession | Eagle Ability | Shardok Abilities |
+|------------|---------------|-------------------|
+| **Mage** | Control Weather | Lightning Bolt, Meteor, Freeze Water, Start Fire (enhanced) |
+| **Necromancer** | Start Epidemic | Raise Dead, Fear |
+| **Engineer** | (general) | Repair, Fortify, Build Bridge, Reduce (siege) |
+| **Paladin** | Alms (prioritized) | Holy Wave |
+| **Ranger** | Recon | Scout, Hide (enhanced), Brave Water (enhanced) |
+| **Champion** | (general) | Challenge Duel |
+
+---
+
+## Proposed New Professions
+
+### 1. HERALD (Morale & Communication Specialist)
+
+**Fantasy:** The inspiring leader who rallies troops and carries messages across the battlefield.
+
+**Eagle Ability: "Rally Province"**
+- Spend vigor to boost recruitment in a province for one turn, or reduce unrest
+- Synergy: Pairs well with provinces in turmoil or after losses
+
+**Shardok Ability: "Inspire"**
+- Target friendly unit within 3 hexes gains +1 action point this turn
+- Creates interesting tactical choices about when to act vs. when to buff allies
+- Cannot target self (prevents simple optimization)
+
+---
+
+### 2. ALCHEMIST (Fire & Transformation Specialist)
+
+**Fantasy:** The mad scientist who manipulates the elements through science, not magic.
+
+**Eagle Ability: "Transmute"**
+- Convert one resource type to another in a province (gold to food or vice versa, at a loss)
+- Provides economic flexibility during shortages
+
+**Shardok Ability: "Wildfire"**
+- Start a fire that spreads to 2 additional adjacent hexes immediately (not just at end of round)
+- More aggressive than Mage's Start Fire but less controlled
+- Cannot freeze water (that's magic, not science)
+
+---
+
+### 3. WARDEN (Defensive Specialist)
+
+**Fantasy:** The stalwart defender who holds the line and protects allies.
+
+**Eagle Ability: "Garrison"**
+- A province with a Warden-led unit gets +1 to defense when attacked
+- Encourages strategic placement of defensive heroes
+
+**Shardok Ability: "Intercept"**
+- Once per turn, when an adjacent friendly unit is attacked, the Warden's unit can take the hit instead
+- Creates a "bodyguard" mechanic that protects valuable units
+- Costs action points to maintain readiness
+
+---
+
+### 4. INQUISITOR (Anti-Magic & Intelligence)
+
+**Fantasy:** The witch-hunter who counters supernatural threats and uncovers secrets.
+
+**Eagle Ability: "Expose"**
+- Reveal hidden information about enemy heroes in a province (stats, profession, vigor)
+- Counter to Ranger's stealth/recon advantages
+
+**Shardok Ability: "Dispel"**
+- Cancel an active magical effect: stop a meteor cast, remove Fear from friendly unit, or reveal a hidden unit
+- Direct counter to Mage and Necromancer abilities
+- Creates meaningful profession rock-paper-scissors
+
+---
+
+### 5. BEASTMASTER (Animal Control)
+
+**Fantasy:** The wild one who commands beasts and understands nature's fury.
+
+**Eagle Ability: "Suppress Beasts" (Enhanced)**
+- Already exists in game, but Beastmaster does it at reduced vigor cost
+- Additionally: Can redirect beast attacks to enemy provinces instead of just suppressing
+
+**Shardok Ability: "Beast Call"**
+- Summon a wolf pack (weak undead-style unit) that attacks the nearest enemy
+- Wolves act immediately but disappear at end of round
+- Provides disposable units for screening or harassing archers
+
+---
+
+## Design Philosophy
+
+These professions were designed to:
+
+1. **Fill mechanical gaps**: Warden provides defensive depth, Inquisitor counters magic-heavy strategies
+2. **Create counterplay**: Inquisitor vs Mage/Necromancer, Beastmaster vs Rangers (nature vs nature)
+3. **Avoid overlap**: Each has a unique niche not covered by existing professions
+4. **Support both layers**: Each ability is meaningful in its respective game mode
+5. **Enable interesting decisions**: Intercept creates bodyguard tactics, Inspire creates action economy choices

docs/NOTIFICATION_DIFF_BATCHING.md

@@ -0,0 +1,150 @@
+# Notification Diff Batching Optimization
+
+## Problem
+
+`ActionResultFilter.filterForPlayer` generates per-action-result game state diffs, which is expensive. Profiling shows significant time spent in `filteredGameStateDiff` → `GameStateViewFilter.filteredGameState` (called twice per result) → `GameStateViewDiffer.diff`.
+
+A potential optimization is to batch diffs: instead of computing N diffs for N action results, compute one combined diff representing the final state change. However, this is blocked by how client notification generators work.
+
+## Current Architecture
+
+### Server Side
+1. `ActionResultFilter.filterForPlayer` processes each action result
+2. For each result, computes `filteredGameStateDiff(before, after, factionId)`
+3. Returns `Vector[ActionResultView]` where each view has its own `gameStateDiff`
+
+### Client Side
+1. `EagleGameModel.HandleNewHistoryEntry` processes each `ActionResultView`:
+   ```csharp
+   private void HandleNewHistoryEntry(ActionResultView arv) {
+       _currentModel.HistoryCount++;
+       MaybeSendNotification(arv);        // Uses currentModel state
+       ApplyGameStateViewDiff(arv.GameStateDiff);  // Updates currentModel
+   }
+   ```
+
+2. Notification generators receive `(ActionResultView, IGameModel)` and look up display data from the model:
+   ```csharp
+   var province = currentModel.Provinces[details.ProvinceId];
+   var factionName = currentModel.FactionName(details.FactionId);
+   var hero = currentModel.Heroes[heroId];
+   var affectedProvinces = currentModel.ProvincesForFaction(factionId);
+   ```
+
+### The Problem
+Notification for action N sees model state after actions 1..N-1 have been applied. If we batch diffs, notification N would see model state before ANY actions, potentially showing stale data.
+
+Example:
+1. Action 1: Province X conquered by Faction B (was Faction A)
+2. Action 2: Notification needs to show Province X's current ruler
+
+With batching, action 2's notification would incorrectly show Faction A.
+
+## Audit of Client Notification Generators
+
+~50 generators access `currentModel`. Key lookup patterns:
+
+| Lookup | Count | Mutable? | Risk |
+|--------|-------|----------|------|
+| `currentModel.PlayerId` | 22 | No | Safe |
+| `currentModel.Provinces[id]` | 17 | Yes | `RulingFactionId` changes on conquest |
+| `currentModel.Heroes[id]` | ~20 | Mostly safe | Hero data stable, used for display |
+| `currentModel.FactionName(id)` | ~10 | No | Names don't change |
+| `currentModel.MaybeDestroyedFaction(id)` | ~15 | Yes | Faction may be destroyed |
+| `currentModel.ProvincesForFaction(id)` | ~15 | Yes | Changes on conquest |
+
+### State-Changing Action Types
+- `ProvinceConquered` - changes province ownership
+- `FactionDestroyed` - removes faction
+- `FactionLeaderRemoved` - changes faction head
+
+## Proposed Solution: Server-Side Display Data
+
+Eliminate client model lookups by including all display data in server-generated notifications.
+
+### Current Notification Structure
+```scala
+case class NotificationC(
+    details: NotificationDetails,
+    targetFactionIds: Vector[FactionId],
+    affectedProvinceIds: Vector[ProvinceId],  // Already exists, underused
+    affectedHeroIds: Vector[HeroId],          // Already exists, underused
+    llm: NotificationT.Llm,
+    deferred: Boolean
+)
+```
+
+### Proposed Changes
+
+**Option A: Add fields to NotificationC**
+```scala
+case class NotificationC(
+    details: NotificationDetails,
+    targetFactionIds: Vector[FactionId],
+    affectedProvinceIds: Vector[ProvinceId],
+    affectedHeroIds: Vector[HeroId],
+    // New fields:
+    factionNames: Map[FactionId, String],
+    displayedHeroViews: Vector[HeroView],
+    provinceNames: Map[ProvinceId, String],
+    llm: NotificationT.Llm,
+    deferred: Boolean
+)
+```
+
+**Option B: Enrich each NotificationDetails type**
+```scala
+case class TruceAccepted(
+    offeringFactionId: FactionId,
+    offeringFactionName: String,      // New
+    targetFactionId: FactionId,
+    targetFactionName: String,        // New
+    ambassadorHeroId: HeroId,
+    ambassadorHeroView: HeroView      // New
+)
+```
+
+### Implementation Steps
+
+1. **Proto changes**: Add new fields to `Notification` message
+2. **Server**: Populate display fields when creating notifications
+3. **Client**: Update ~50 generators to use notification fields
+4. **Test**: Add test that greps for `currentModel.` access in generators (excluding `PlayerId`)
+5. **Server optimization**: With client decoupled from model state, batch diffs in `filterForPlayer`
+
+### Trade-offs
+
+**Pros:**
+- Clean separation: server provides all display data
+- Enables diff batching optimization
+- Easier to reason about notification correctness
+- Test can enforce the invariant
+
+**Cons:**
+- Larger notification messages (includes names, hero views)
+- Proto changes required
+- ~50 generators need updating (mechanical but tedious)
+- Server must know what display data each notification type needs
+
+## Alternative Approaches Considered
+
+### A: Selective Per-Action Diffs
+Only generate individual diffs for action results with notifications that need mutable model state. Requires tracking which notification types need which state.
+
+**Rejected because:** Fragile; easy to add a new generator that breaks the invariant.
+
+### B: State-Change-Triggered Diffs
+If batch contains state-changing action types (ProvinceConquered, etc.), generate individual diffs from that point. Otherwise batch.
+
+**Rejected because:** Still conservative; many batches would fall back to individual diffs.
+
+## Status
+
+**Deferred** - Current performance is acceptable. This doc captures the analysis for future reference if optimization becomes necessary.
+
+## References
+
+- `ActionResultFilter.scala` - Server-side filtering
+- `EagleGameModel.cs` - Client-side model updates
+- `Assets/Eagle/Notifications/` - All notification generators
+- `NotificationT.scala` - Server notification types

docs/OAUTH_GO_SERVICE_PLAN.md

@@ -1,383 +0,0 @@
-# Plan: Extract OAuth to Go Service
-
-## Goal
-Move OAuth authentication handling from the Eagle Scala server into a separate Go service. This simplifies Eagle (gRPC-only, no HTTP), reduces complexity, and sets up for potentially moving JWT validation outside Eagle too.
-
-## Architecture Decision: Sidecar Service (Not DO Functions)
-
-**Recommendation: Go sidecar service on the same droplet, in a separate container**
-
-**Why not DO Functions:**
-- OAuth requires **stateful sessions** (pendingOAuth/completedOAuth maps with 10-min TTL)
-- Client polling pattern (every 2 seconds) would incur high function invocation costs
-- Cold start latency problematic for auth flows
-- State would require external store (Redis), adding complexity
-
-**Why sidecar (separate container):**
-- Simple process on same droplet, minimal network latency
-- In-memory state management (like current Scala impl)
-- Easy to monitor/debug alongside Eagle
-- Can share filesystem for key files (RSA keys) via volume mounts
-- **Independent deployment**: Deploying Eagle doesn't restart auth service (and vice versa)
-- **Independent scaling**: Could move to separate droplet later if needed
-
-## Current Architecture (What Exists)
-
-```
-Unity Client
-    ├── GetOAuthUrl RPC → Eagle AuthServiceImpl → OAuthService.getAuthUrl()
-    ├── [User browser auth] → HTTP callback → OAuthHttpHandler → OAuthService.handleCallback()
-    ├── CheckOAuthStatus RPC (polling) → AuthServiceImpl → OAuthService.checkStatus()
-    └── All other RPCs include JWT → AuthorizationInterceptor validates
-```
-
-**Key files:**
-- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth flow, state management
-- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - JWT creation/validation
-- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD (persisted)
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC Auth service
-- `src/main/scala/net/eagle0/eagle/service/OAuthHttpHandler.scala` - HTTP callback handler
-
-## Target Architecture (Phase 1)
-
-```
-Unity Client
-    ├── GetOAuthUrl RPC ──────────────┐
-    ├── CheckOAuthStatus RPC (polling)├──→ Eagle (port 40032) ──proxy──→ Go Auth Container (port 40033)
-    ├── RefreshToken RPC ─────────────┘                                        │
-    ├── [User browser] → HTTP callback ────────────────────────────────────────┤
-    │                                                                          ↓
-    │                                            (Internal gRPC: GetOrCreateUser, GetUser)
-    │                                                                          ↓
-    └── Game RPCs with JWT ─────────────────────→ Eagle (port 40032) ← JWT validation stays here
-
-[Same Droplet]
-┌─────────────────────────────────────────────────────────────────────────────┐
-│                                                                             │
-│  ┌──────────────────────┐          ┌────────────────────────────────────┐  │
-│  │  Go Auth Container   │◄────────►│       Eagle Container              │  │
-│  │  (eagle0-auth)       │ internal │       (eagle0-server)              │  │
-│  │                      │  gRPC    │                                    │  │
-│  │  - OAuth flow        │          │  - JWT validation                  │  │
-│  │  - JWT creation      │          │  - UserService (persistence)       │  │
-│  │  - HTTP callback     │          │  - Game logic                      │  │
-│  └──────────────────────┘          └────────────────────────────────────┘  │
-│           │                                        │                        │
-│           └────────────────┬───────────────────────┘                        │
-│                            ▼                                                │
-│                    /etc/eagle0/keys/ (shared volume)                        │
-│                    - private.pem                                            │
-│                    - public.pem                                             │
-└─────────────────────────────────────────────────────────────────────────────┘
-```
-
-## Component Responsibilities
-
-### Go Auth Service (NEW - separate container)
-- **OAuth flow**: getAuthUrl, handleCallback (HTTP), checkStatus
-- **State management**: pendingOAuth, completedOAuth maps with TTL
-- **JWT creation**: Issue access/refresh tokens (shares RSA private key with Eagle)
-- **Token refresh**: Validate refresh token, issue new access token
-- Calls Eagle's internal UserService gRPC to find/create users
-
-### Eagle Server (SIMPLIFIED)
-- **JWT validation**: AuthorizationInterceptor stays (validates tokens on game RPCs)
-- **UserService**: Stays in Eagle (user persistence, display name logic)
-- **New internal gRPC**: Expose GetOrCreateUser, GetUser for Go service to call
-- **Proxy (Phase 1)**: Forward OAuth RPCs to Go service
-- **Remove (Phase 2)**: OAuthService, OAuthHttpHandler, HTTP server setup
-
-### Unity Client (NO CHANGES in Phase 1)
-- Eagle proxies Auth RPCs to Go service
-- Client still connects to Eagle on port 40032
-
-## Implementation Phases
-
-### Phase 1: Go Auth Service with Eagle Proxy (Zero Client Changes)
-
-1. **Create Go service structure**
-   ```
-   src/main/go/net/eagle0/authservice/
-   ├── main.go           # Entry point, starts gRPC + HTTP servers
-   ├── oauth.go          # OAuth state management, provider configs
-   ├── jwt.go            # JWT creation (copy logic from Scala)
-   ├── handlers.go       # gRPC handlers for Auth service
-   ├── http_callback.go  # HTTP handler for OAuth callback
-   └── BUILD.bazel
-   ```
-
-2. **Internal gRPC proto for Eagle UserService**
-   ```protobuf
-   // src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto
-
-   service InternalUserService {
-     rpc GetOrCreateUser(GetOrCreateUserRequest) returns (GetOrCreateUserResponse);
-     rpc GetUser(GetUserRequest) returns (GetUserResponse);
-   }
-
-   message GetOrCreateUserRequest {
-     string provider = 1;        // "discord" or "google"
-     string provider_user_id = 2;
-     string email = 3;
-     string avatar_url = 4;
-   }
-
-   message GetOrCreateUserResponse {
-     string user_id = 1;
-     string display_name = 2;
-     string avatar_url = 3;
-     bool is_admin = 4;
-     bool is_new_user = 5;
-   }
-   ```
-
-3. **Eagle: Expose InternalUserService**
-   - New `InternalUserServiceImpl.scala` wrapping UserService
-   - Bind to same port, different service name (internal only)
-
-4. **Eagle: Proxy Auth RPCs to Go**
-   - AuthServiceImpl delegates GetOAuthUrl, CheckOAuthStatus, RefreshToken to Go service
-   - SetDisplayName, GetCurrentUser, Logout stay in Eagle
-
-5. **Share RSA keys via volume mount**
-   - Go service reads same key files as Eagle
-   - Both can create valid JWTs
-   - Eagle continues to validate JWTs
-
-6. **Docker/Container setup**
-   - New Dockerfile for Go auth service
-   - docker-compose or Kubernetes config for both containers
-   - Shared volume for /etc/eagle0/keys/
-   - Internal network for container-to-container gRPC
-
-### Phase 2: Client Direct to Go Service (Future)
-
-1. **Update Unity client**
-   - Connect to Go Auth service directly for OAuth RPCs
-   - Keep connecting to Eagle for game RPCs
-
-2. **Remove Eagle proxy code**
-   - Delete AuthServiceImpl OAuth delegation
-   - AuthServiceImpl only handles SetDisplayName, GetCurrentUser, Logout
-
-### Phase 3: Move JWT Validation to Go (Optional Future)
-
-1. **Go service validates JWTs**
-   - Add ValidateToken RPC or use shared middleware pattern
-
-2. **Eagle calls Go for validation**
-   - AuthorizationInterceptor calls Go to validate tokens
-   - OR: Use stateless validation (both share public key)
-
-## Files to Create
-
-### Go Service
-- `src/main/go/net/eagle0/authservice/main.go`
-- `src/main/go/net/eagle0/authservice/oauth.go`
-- `src/main/go/net/eagle0/authservice/jwt.go`
-- `src/main/go/net/eagle0/authservice/handlers.go`
-- `src/main/go/net/eagle0/authservice/http_callback.go`
-- `src/main/go/net/eagle0/authservice/BUILD.bazel`
-
-### Protos
-- `src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto`
-
-### Scala
-- `src/main/scala/net/eagle0/eagle/service/InternalUserServiceImpl.scala`
-
-### Docker/Deployment
-- `ci/auth_service.Dockerfile`
-- Update `docker-compose.yml` (or equivalent)
-
-## Files to Modify
-
-### Scala (Phase 1)
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - Proxy OAuth RPCs to Go
-- `src/main/scala/net/eagle0/eagle/Main.scala` - Start internal user service, add auth-service-url flag
-
-### Scala (Phase 2 - Removal)
-- Delete `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala`
-- Delete `src/main/scala/net/eagle0/eagle/service/OAuthHttpHandler.scala`
-- Simplify `src/main/scala/net/eagle0/eagle/Main.scala` - Remove HTTP server
-
-### Unity (Phase 2)
-- `Assets/Auth/OAuthManager.cs` - Point OAuth RPCs to Go service port
-- `Assets/EagleConnection.cs` - Add second channel for auth service
-
-## Key Implementation Details
-
-### State Management in Go
-```go
-type OAuthState struct {
-    Provider  string
-    CreatedAt time.Time
-}
-
-type OAuthResult struct {
-    Success  bool
-    UserInfo *ProviderUserInfo
-    Provider string
-    Error    string
-}
-
-var pendingOAuth   = sync.Map{} // state -> OAuthState
-var completedOAuth = sync.Map{} // state -> OAuthResult
-
-const stateExpiration = 10 * time.Minute
-
-// Background goroutine cleans expired states every minute
-func cleanupExpiredStates() {
-    ticker := time.NewTicker(1 * time.Minute)
-    for range ticker.C {
-        cutoff := time.Now().Add(-stateExpiration)
-        pendingOAuth.Range(func(key, value any) bool {
-            if value.(OAuthState).CreatedAt.Before(cutoff) {
-                pendingOAuth.Delete(key)
-            }
-            return true
-        })
-        // Similar for completedOAuth
-    }
-}
-```
-
-### JWT Creation in Go
-```go
-import "github.com/golang-jwt/jwt/v5"
-
-type EagleClaims struct {
-    jwt.RegisteredClaims
-    UserId      string `json:"userId"`
-    DisplayName string `json:"displayName"`
-    IsAdmin     bool   `json:"isAdmin"`
-}
-
-func CreateAccessToken(userId, displayName string, isAdmin bool) (string, error) {
-    claims := EagleClaims{
-        RegisteredClaims: jwt.RegisteredClaims{
-            ExpiresAt: jwt.NewNumericDate(time.Now().Add(7 * 24 * time.Hour)),
-            IssuedAt:  jwt.NewNumericDate(time.Now()),
-        },
-        UserId:      userId,
-        DisplayName: displayName,
-        IsAdmin:     isAdmin,
-    }
-
-    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
-    return token.SignedString(privateKey)
-}
-```
-
-### OAuth Provider Configs
-- Read from environment variables (same as current OAuthConfig.scala)
-- DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET
-- GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
-- OAUTH_CALLBACK_URL (e.g., https://eagle0.shardok.games/oauth/callback)
-
-### Container Networking
-```yaml
-# docker-compose.yml example
-services:
-  eagle0-auth:
-    build:
-      context: .
-      dockerfile: ci/auth_service.Dockerfile
-    ports:
-      - "40033:40033"  # gRPC
-      - "8080:8080"    # HTTP callback
-    volumes:
-      - ./keys:/etc/eagle0/keys:ro
-    environment:
-      - DISCORD_CLIENT_ID
-      - DISCORD_CLIENT_SECRET
-      - GOOGLE_CLIENT_ID
-      - GOOGLE_CLIENT_SECRET
-      - EAGLE_INTERNAL_URL=eagle0-server:40034
-
-  eagle0-server:
-    build:
-      context: .
-      dockerfile: ci/eagle_run.Dockerfile
-    ports:
-      - "40032:40032"  # Public gRPC
-    expose:
-      - "40034"        # Internal gRPC (container-to-container only)
-    volumes:
-      - ./keys:/etc/eagle0/keys:ro
-      - ./data:/var/lib/eagle0
-    environment:
-      - AUTH_SERVICE_URL=eagle0-auth:40033
-```
-
-## Deployment
-
-### Development
-```bash
-# Terminal 1: Go Auth Service
-bazel run //src/main/go/net/eagle0/authservice:authservice -- \
-  --grpc-port=40033 \
-  --http-port=8080 \
-  --eagle-internal-url=localhost:40034
-
-# Terminal 2: Eagle Server
-bazel run //src/main/scala/net/eagle0/eagle:eagle_server -- \
-  --eagle-grpc-port=40032 \
-  --internal-grpc-port=40034 \
-  --auth-service-url=localhost:40033
-```
-
-### Production
-- Both containers on same droplet via docker-compose
-- Shared volume for RSA keys at /etc/eagle0/keys/
-- Internal Docker network for container-to-container communication
-- External access: 40032 (Eagle gRPC), 8080 (OAuth HTTP callback)
-
-## Testing Strategy
-
-1. **Unit tests for Go service**
-   - OAuth state management (expiration, cleanup)
-   - JWT creation matches Scala output (test with same keys)
-   - HTTP callback parsing
-
-2. **Integration tests**
-   - Go service ↔ Eagle internal gRPC
-   - Full OAuth flow with mock provider
-
-3. **Existing tests continue to pass**
-   - All Scala tests (JWT validation, user service)
-
-4. **End-to-end test**
-   - Spin up both containers
-   - Run OAuth flow through proxy
-
-## Risks and Mitigations
-
-| Risk | Mitigation |
-|------|------------|
-| Key file permissions | Shared volume with read-only mount |
-| State loss on Go restart | Document this (same as current Scala behavior); consider Redis later |
-| Clock skew affecting JWT | Both on same machine |
-| OAuth callback race | HTTP callback completes before gRPC poll |
-| Container networking | Use docker-compose for reliable internal DNS |
-| Proxy adds latency | Minimal (same machine), remove in Phase 2 |
-
-## Estimated Scope
-
-- **Phase 1**: ~500-700 lines Go, ~100 lines Scala changes, ~50 lines Docker config
-- **Phase 2**: ~50 lines Unity, deletion of ~300 lines Scala
-- **Phase 3**: Optional, separate decision
-
-## Alternative Considered: Move Everything to Go
-
-Could move UserService to Go as well, but:
-- UserService is tightly integrated with game persistence
-- Would require duplicating persistence layer
-- Not worth the complexity for now
-
-Keep UserService in Eagle, expose via internal gRPC.
-
-## Open Questions
-
-1. **HTTP callback routing**: Does the OAuth callback URL need to change, or can we route traffic from the existing URL to the new Go service?
-2. **Health checks**: Should we add health check endpoints for container orchestration?
-3. **Logging**: Should Go service log to same format/destination as Eagle?

docs/OAUTH_IMPLEMENTATION_PLAN.md

@@ -1,189 +0,0 @@
-# Discord + Google OAuth Implementation Plan
-
-## Overview
-
-Replace HTTP Basic Auth with OAuth 2.0 (Discord + Google) for Eagle0. Users authenticate via system browser, receive JWT tokens, and choose their own display names.
-
-## Architecture
-
-```
-Unity Client                                          Eagle Server
-     |                                                      |
-     |  1. Click "Login with Discord/Google"                |
-     |  ------------------------------------------------->  |
-     |     GetOAuthUrl(provider) -> auth_url + state        |
-     |                                                      |
-     |  2. Open system browser -> OAuth consent             |
-     |  3. User authenticates with provider                 |
-     |  4. Redirect to eagle0://auth/callback?code=xxx      |
-     |                                                      |
-     |  5. ExchangeCode(code, state)                        |
-     |  ------------------------------------------------->  |
-     |     Exchange code with provider                      |
-     |     Fetch user info (id, email, avatar)              |
-     |     Create/update user record                        |
-     |     Issue JWT + refresh token                        |
-     |  <-------------------------------------------------  |
-     |     (jwt, refresh_token, user_info, is_new_user)     |
-     |                                                      |
-     |  6. [If new user] SetDisplayName(name)               |
-     |  ------------------------------------------------->  |
-     |                                                      |
-     |  7. Subsequent gRPC calls                            |
-     |     Authorization: Bearer <jwt>                      |
-     |  ------------------------------------------------->  |
-```
-
-## Key Design Decisions
-
-| Decision | Choice | Rationale |
-|----------|--------|-----------|
-| OAuth flow | System browser + deep link | Secure, supports password managers |
-| Code exchange | Eagle server directly | No separate auth service needed |
-| JWT signing | RS256 (asymmetric) | Future flexibility for token verification |
-| User storage | Protobuf file via Persister | Consistent with existing patterns |
-| Token expiry | 7-day access, 30-day refresh | Balance security and gaming UX |
-
-## Implementation Phases
-
-### Phase 1: Proto Definitions & Infrastructure
-
-**New files:**
-- `src/main/protobuf/net/eagle0/eagle/api/auth.proto` - Auth API messages
-- `src/main/protobuf/net/eagle0/eagle/internal/user.proto` - User storage schema
-
-**Key proto messages:**
-```protobuf
-// API
-GetOAuthUrlRequest/Response     // Get OAuth URL to open in browser
-ExchangeCodeRequest/Response    // Exchange auth code for JWT
-SetDisplayNameRequest/Response  // Set user's display name
-RefreshTokenRequest/Response    // Refresh expired access token
-
-// Internal storage
-User                           // user_id, display_name, oauth_identities
-UserDatabase                   // All users + indexes for lookup
-```
-
-### Phase 2: Eagle Server Auth Services
-
-**New Scala files:**
-- `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` - Discord/Google config from env vars
-- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - JWT creation/validation (RS256)
-- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD, display name validation
-- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth code exchange
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC service implementation
-
-**Modify:**
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationInterceptor.scala`
-  - Replace Basic Auth parsing with JWT validation
-  - Skip auth for public endpoints (GetOAuthUrl, ExchangeCode, RefreshToken)
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationUtils.scala`
-  - Change context keys from `userName` to `userId` + `displayName`
-- `src/main/scala/net/eagle0/eagle/service/Main.scala`
-  - Wire up new auth services and JWT key loading
-
-### Phase 3: Unity Client OAuth Flow
-
-**New C# files:**
-- `Assets/Auth/OAuthManager.cs` - OAuth flow + deep link handling
-- `Assets/Auth/TokenStorage.cs` - Secure token persistence
-- `Assets/Auth/AuthClient.cs` - gRPC client for auth service
-
-**Modify:**
-- `Assets/EagleConnection.cs`
-  - Replace `AuthInterceptor` (Basic Auth) with `JwtAuthInterceptor` (Bearer token)
-- `Assets/ConnectionHandler/ConnectionHandler.cs`
-  - Replace username/password UI with Discord/Google login buttons
-  - Add display name setup flow for new users
-
-### Phase 4: Platform Configuration
-
-**Deep link registration:**
-- iOS: Add `eagle0://` to CFBundleURLSchemes in Info.plist
-- Android: Add intent-filter for `eagle0://auth` in AndroidManifest.xml
-- Desktop: Register URL scheme (Windows registry / macOS plist)
-
-**OAuth provider setup:**
-1. Discord Developer Portal: Create app, add redirect URI `eagle0://auth/callback`
-2. Google Cloud Console: Create OAuth client, add redirect URI
-
-**Environment variables (server):**
-```
-DISCORD_CLIENT_ID
-DISCORD_CLIENT_SECRET
-GOOGLE_CLIENT_ID
-GOOGLE_CLIENT_SECRET
-JWT_PRIVATE_KEY_PATH
-JWT_PUBLIC_KEY_PATH
-```
-
-### Phase 5: Testing
-
-**Unit tests:**
-- `JwtServiceSpec.scala` - Token creation/validation
-- `UserServiceSpec.scala` - Display name validation, uniqueness
-- `OAuthServiceSpec.scala` - OAuth flow with mocked providers
-
-**Integration tests:**
-- Full OAuth flow with mock provider
-- JWT validation in AuthorizationInterceptor
-- gRPC calls with valid/invalid tokens
-
-**Manual testing:**
-- [ ] Discord login (Windows, macOS)
-- [ ] Google login (Windows, macOS)
-- [ ] Deep link callback works
-- [ ] Display name validation
-- [ ] Session persistence across restarts
-- [ ] Token refresh
-
-## Files Summary
-
-### Create
-| File | Purpose |
-|------|---------|
-| `src/main/protobuf/net/eagle0/eagle/api/auth.proto` | Auth API definitions |
-| `src/main/protobuf/net/eagle0/eagle/internal/user.proto` | User storage schema |
-| `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` | Provider config |
-| `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` | JWT handling |
-| `src/main/scala/net/eagle0/eagle/auth/UserService.scala` | User management |
-| `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` | OAuth flow |
-| `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` | gRPC service |
-| `Assets/Auth/OAuthManager.cs` | Unity OAuth manager |
-| `Assets/Auth/TokenStorage.cs` | Token storage |
-| `Assets/Auth/AuthClient.cs` | Auth gRPC client |
-
-### Modify
-| File | Changes |
-|------|---------|
-| `AuthorizationInterceptor.scala` | Basic Auth -> JWT validation |
-| `AuthorizationUtils.scala` | userName -> userId + displayName |
-| `Main.scala` | Wire auth services |
-| `EagleConnection.cs` | AuthInterceptor -> JwtAuthInterceptor |
-| `ConnectionHandler.cs` | Login UI -> OAuth buttons + display name |
-
-### Delete
-- nginx htpasswd configuration (no longer needed)
-
-## Security Considerations
-
-1. **State parameter** - CSRF protection in OAuth flow
-2. **PKCE** - Consider adding for mobile (enhancement)
-3. **Secure storage** - Use Keychain (iOS) / Keystore (Android) for tokens
-4. **Token refresh** - 7-day access tokens with 30-day refresh
-5. **Rate limiting** - Limit login attempts per IP
-
-## Dependencies to Add
-
-**Scala (MODULE.bazel):**
-- JWT library (e.g., `jwt-scala` or `nimbus-jose-jwt`)
-- HTTP client (e.g., `sttp` for OAuth requests)
-
-**Unity:**
-- Deep linking is built-in (Unity 2021+)
-- No additional packages required
-
-## Rollback Plan
-
-Keep Basic Auth code in a feature branch. Both auth methods can coexist during transition via feature flag if needed.

docs/OAUTH_NEXT_STEPS.md

@@ -1,350 +0,0 @@
-# OAuth Implementation: Next Steps and Design
-
-## Executive Summary
-
-The OAuth implementation is functional but has several gaps that need addressing before it's production-ready. This document outlines the known issues, proposes a comprehensive user identity model, and provides a prioritized implementation plan.
-
-## Current State (Updated January 2026)
-
-### What Works ✅
-- Discord OAuth flow (server-mediated polling)
-- Google OAuth flow
-- JWT token generation and validation
-- User creation and display name setting
-- Auto-login with stored tokens
-- Basic game creation and play with OAuth users
-- Headshot fetching via public CDN (no auth required)
-- Logout button in lobby (preserves tokens for quick reconnect)
-- Environment (prod/qa) and user display in lobby
-- Game identity with userName = displayName (PR #4964 merged)
-
-### Known Issues
-
-#### 1. Game Identity Model Fragility (Deferred)
-**Status**: Accepted for now. PR #4964 merged with `userName = displayName`.
-
-**Current behavior**:
-- Games store `userNameToFactionId: Map[String, Int]`
-- For JWT users, this maps displayName → factionId
-- displayName is technically mutable (users could change it)
-- No migration path when displayName changes
-
-**Why this is acceptable**:
-1. We don't currently have a "change display name" feature
-2. The alternative (using userId) requires more extensive changes
-3. Can migrate to userId-based identity later if needed
-
-#### 2. In-Game Headshot Fetching ✅ FIXED
-**Solution**: Made the `eagle0-headshots` S3 bucket public and enabled CDN.
-- Client now fetches directly from `https://eagle0-headshots.sfo3.cdn.digitaloceanspaces.com/`
-- No authentication required
-- Works for both OAuth and Basic Auth users
-- Simpler architecture, no dependency on home Mac server
-
-#### 3. Logout from Lobby ✅ FIXED
-**Solution**: Added logout button to lobby UI (PR #4967).
-- Button disconnects from server and returns to connection screen
-- Intentionally does NOT clear OAuth tokens
-- Allows quick reconnect with same account without full OAuth flow
-
-#### 4. Display Name Uniqueness Not Enforced (Medium) - OPEN
-**Problem**: User was able to set displayName "nolen" when that name was already taken.
-
-**Root cause**: Unknown - needs investigation. Either:
-- The uniqueness check is buggy
-- The displayNameIndex wasn't populated correctly during user creation
-- Race condition during concurrent registrations
-
-#### 5. Admin Server Crashes ✅ FIXED
-**Solution**: PR #4964 sets `userName = displayName` for JWT users.
-
-#### 6. Intermittent "Expired" Errors During Login (Medium) - INVESTIGATING
-**Problem**: Users occasionally get "OAuth session expired" errors even when server logs show the callback succeeded.
-
-**Status**: Added diagnostic logging in PR #4974 to trace:
-- State creation in `getAuthUrl`
-- State lookup in `handleCallback`
-- Result lookup in `checkStatus`
-
-**Possible causes**:
-- State mismatch between client and server
-- Race condition in polling
-- Cleanup running at wrong time
-
-#### 7. Token Expiry Field Bug ✅ FIXED
-**Problem**: `CheckOAuthStatusResponse.expiresAt` was returning refresh token expiry (30 days) instead of access token expiry (7 days).
-
-**Solution**: Fixed in PR #4974 to calculate correct access token expiry.
-
----
-
-## Proposed User Identity Model
-
-### Design Principles
-
-1. **Stable Internal Identity**: `userId` (UUID) is the only key used for persistent associations
-2. **Display Name is Cosmetic**: Can change without breaking game associations
-3. **Backwards Compatibility**: Basic Auth continues to work for local development
-4. **Multi-Provider Support**: Users can link Discord, Google, and future providers
-5. **Avatar Flexibility**: Use OAuth avatar by default, support custom uploads later
-
-### Data Model
-
-```
-User {
-  userId: String (UUID)           // Primary key, immutable, used for all internal references
-  displayName: String             // Unique, user-visible, mutable with migration
-  displayNameLower: String        // Case-insensitive uniqueness
-  email: String                   // Primary email for account recovery/linking
-  avatarUrl: String               // Current avatar URL
-  avatarData: bytes               // Cached avatar for offline/fast access (future)
-  oauthIdentities: [OAuthIdentity]
-  createdAt: Timestamp
-  lastLoginAt: Timestamp
-  isAdmin: Boolean
-}
-
-OAuthIdentity {
-  provider: String                // "discord", "google", etc.
-  providerUserId: String          // Provider's user ID
-  providerEmail: String           // Email from this provider
-  avatarUrl: String               // Avatar from this provider
-  linkedAt: Timestamp
-}
-```
-
-### Identity Resolution Strategy
-
-The key question: **What should `AuthorizationUtils.userName` return?**
-
-#### Option A: userName = displayName (Current PR #4964)
-- **Pro**: Human-readable in logs, game saves, debugging
-- **Con**: Breaks if displayName changes
-- **Migration**: None needed now, complex later
-
-#### Option B: userName = userId (Recommended)
-- **Pro**: Stable identity, displayName changes are safe
-- **Con**: UUIDs in logs are ugly, need display name lookup for UI
-- **Migration**: Cleaner long-term, but breaking change for any existing OAuth games
-
-#### Option C: Hybrid with Migration Support
-- **userName** = userId for new games
-- **Legacy lookup** for old games by displayName
-- **Display layer** resolves userId → displayName for UI
-
-**Recommendation**: Option B with a display name resolution layer. The ugliness in logs is acceptable for the stability it provides. Implement a `UserService.resolveDisplayName(identifier: String): String` that returns displayName for UUIDs or the identifier itself for legacy usernames.
-
-### Account Linking Strategy
-
-#### Automatic Linking (Future)
-When a user logs in with a new OAuth provider:
-1. Check if the provider email matches an existing user's email
-2. If match found, prompt: "An account exists with this email. Link accounts?"
-3. If confirmed, add new OAuthIdentity to existing user
-4. If declined, create separate account (different email required)
-
-#### Manual Linking (MVP)
-1. User logs in with primary account
-2. User goes to Settings → Linked Accounts
-3. User clicks "Link Discord" or "Link Google"
-4. OAuth flow adds new identity to current user
-
-### Avatar/Headshot Strategy
-
-#### Phase 1: OAuth Avatars (MVP)
-- Store `avatarUrl` from OAuth provider during login
-- Server proxies avatar requests to avoid CORS issues
-- Cache avatars locally with TTL
-
-#### Phase 2: Avatar Caching
-- Download avatar to local storage on login
-- Serve from local storage for reliability
-- Refresh periodically or on login
-
-#### Phase 3: Custom Avatars (Future)
-- Allow users to upload custom avatar
-- Store in S3/DO Spaces
-- Custom avatar overrides OAuth avatar
-
----
-
-## Implementation Plan
-
-### Phase 1: Stabilization ✅ COMPLETE
-
-#### 1.1 Fix Display Name Uniqueness Bug - OPEN
-- [ ] Investigate why "nolen" was allowed when it existed
-- [ ] Add logging to `setDisplayName` to trace the issue
-- [ ] Ensure `displayNameIndex` is correctly maintained
-- [ ] Add unit tests for uniqueness enforcement
-
-#### 1.2 Add Logout Button to Lobby ✅ DONE
-- [x] Add "Logout" button to lobby UI
-- [x] Disconnect from server
-- [x] Navigate to connection screen
-- [x] Preserve OAuth tokens for quick reconnect (intentional change from original plan)
-
-#### 1.3 Merge PR #4964 (userName = displayName) ✅ DONE
-- [x] Merged - games work with OAuth users
-- [x] Documented limitation (games break if displayName changes)
-
-#### 1.4 Fix Headshot Fetching ✅ DONE
-- [x] Made eagle0-headshots bucket public
-- [x] Client fetches directly from CDN
-- [x] No authentication required
-
-#### 1.5 Add Lobby Status Display ✅ DONE
-- [x] Show environment (prod/qa) in lobby
-- [x] Show current user in lobby (OAuth displayName or classic username)
-
-### Phase 2: Remaining Work (Priority Order)
-
-#### 2.1 Diagnose Intermittent "Expired" Errors - IN PROGRESS
-- [x] Add diagnostic logging (PR #4974)
-- [ ] Deploy and reproduce the issue
-- [ ] Analyze logs to identify root cause
-- [ ] Implement fix based on findings
-
-#### 2.2 Fix Display Name Uniqueness
-- [ ] Investigate UserService.setDisplayName logic
-- [ ] Check displayNameIndex population
-- [ ] Add logging to trace the issue
-- [ ] Fix the bug and add tests
-
-#### 2.3 Wire Up Lobby UI in Unity
-- [ ] Connect `lobbyEnvironmentText` to TextMeshProUGUI in scene
-- [ ] Connect `lobbyUserText` to TextMeshProUGUI in scene
-
-#### 2.4 Implement Token Refresh During Gameplay
-- [ ] Implement `RefreshToken` RPC on server (currently throws UNIMPLEMENTED)
-- [ ] Store refresh tokens server-side for validation
-- [ ] Add proactive refresh in client before token expires
-- [ ] Handle refresh during reconnection attempts
-
-### Phase 3: Nice-to-Haves (Future)
-
-#### 3.1 Proactive Token Refresh
-- [ ] Monitor token expiry in client
-- [ ] Refresh automatically when < 5 minutes remaining
-- [ ] Update TokenStorage with new access token
-
-#### 3.2 Better Error Messages
-- [ ] Distinguish between network errors and auth errors
-- [ ] Show user-friendly messages for OAuth failures
-- [ ] Add retry suggestions
-
-#### 3.3 Session Persistence Across Server Restarts
-- [ ] Move pendingOAuth from in-memory TrieMap to Redis/database
-- [ ] Move completedOAuth to Redis with TTL
-- [ ] Server can restart without breaking in-flight OAuth flows
-
-#### 3.4 Migrate to userId-based Game Identity (Deferred)
-- [ ] Change `AuthorizationUtils.userName` to return `userId` for JWT users
-- [ ] Add `UserService.resolveDisplayName(id: String): String` for UI display
-- [ ] Update game UI to resolve userIds to displayNames
-- [ ] Existing Basic Auth games continue to work (userName is literal)
-
-#### 3.5 Display Name Change Support (Requires 3.4)
-- [ ] Add `ChangeDisplayName` RPC
-- [ ] Validate new name is unique
-- [ ] Update user record
-- [ ] No game migration needed (games use userId)
-
-### Phase 3: Multi-Provider Support (Future)
-
-#### 3.1 Account Linking UI
-- [ ] Add Settings page with "Linked Accounts" section
-- [ ] Show currently linked providers
-- [ ] "Link Another Account" button triggers OAuth flow
-- [ ] `LinkOAuthProvider` RPC adds identity to current user
-
-#### 3.2 Login Provider Selection
-- [ ] If user has multiple providers, any can be used to login
-- [ ] All resolve to same userId
-- [ ] Session shows which provider was used
-
-#### 3.3 Account Merging (Complex)
-- [ ] Handle case where user created separate accounts
-- [ ] Merge game history, stats, etc.
-- [ ] Delete duplicate user record
-- [ ] This is complex - may defer or not implement
-
-### Phase 4: Enhanced Avatars (Future)
-
-#### 4.1 Avatar Caching
-- [ ] Download avatars to S3/DO Spaces on login
-- [ ] Serve from our CDN
-- [ ] Refresh on login if changed
-
-#### 4.2 Custom Avatar Upload
-- [ ] Upload endpoint with size/format validation
-- [ ] Store in S3/DO Spaces
-- [ ] Custom avatar overrides OAuth avatar
-
----
-
-## Technical Debt to Address
-
-1. **Context Propagation in Futures**: PR #4960 fixed `setDisplayName` and `getCurrentUser`, but audit all `Future` blocks that access `AuthorizationUtils`
-
-2. **Dual Auth Support**: The system supports both Basic Auth and JWT. Consider:
-   - Should Basic Auth be deprecated for production?
-   - Should it remain for local development only?
-   - How do Basic Auth users interact with OAuth users in the same game?
-
-3. **Token Refresh**: `RefreshToken` RPC throws UNIMPLEMENTED. Need to:
-   - Implement refresh token storage and validation
-   - Handle token refresh in client
-   - Consider refresh token rotation for security
-
-4. **Session Management**: No server-side session tracking. Consider:
-   - Track active sessions per user
-   - Allow "logout all devices"
-   - Detect concurrent logins
-
----
-
-## Open Questions
-
-1. **What happens when a Basic Auth user and OAuth user have the same name?**
-   - Currently possible - Basic Auth doesn't check UserService
-   - Could cause confusion in games
-   - Solution: Require OAuth for multiplayer? Or namespace Basic Auth names?
-
-2. **Should displayName changes be allowed?**
-   - With userId-based identity, it's safe
-   - But could cause confusion ("who is this new player?")
-   - Consider: rate limit changes, show "formerly known as" temporarily
-
-3. **How to handle OAuth provider account deletion?**
-   - User deletes their Discord account
-   - Their Eagle0 account still exists
-   - They can't login unless they linked another provider
-   - Solution: Encourage linking multiple providers, or add email/password fallback
-
-4. **Admin impersonation with OAuth**
-   - Currently works via X-Impersonate-User header
-   - Should this use userId or displayName?
-   - Probably userId for stability
-
----
-
-## Appendix: File Locations
-
-### Server (Scala)
-- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD
-- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - Token generation/validation
-- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth flow
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC Auth service
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationInterceptor.scala` - Auth middleware
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationUtils.scala` - Context accessors
-
-### Client (C#)
-- `Assets/Auth/AuthClient.cs` - gRPC client for Auth service
-- `Assets/Auth/OAuthManager.cs` - OAuth flow orchestration
-- `Assets/Auth/TokenStorage.cs` - Persistent token storage
-- `Assets/Auth/JwtAuthInterceptor.cs` - Attaches JWT to requests
-
-### Protos
-- `src/main/protobuf/net/eagle0/eagle/api/auth.proto` - Auth service definition
-- `src/main/protobuf/net/eagle0/eagle/internal/user/user.proto` - User data model

docs/SCALA3_MODERNIZATION.md

@@ -1,205 +0,0 @@
-# Scala 3 Modernization Guide
-
-## Overview
-This document outlines opportunities to modernize the Eagle0 codebase to use Scala 3 best practices and features. The migration to Scala 3 is complete, but the code still uses many Scala 2 patterns that can be improved.
-
-## Modernization Opportunities
-
-### 1. **Convert Sealed Traits to Enums** 🎯 HIGH IMPACT
-**Benefits**: Better performance, more concise syntax, improved exhaustiveness checking
-
-**Current pattern** (`ExternalTextGenerationCaller.scala:23-31`):
-```scala
-sealed trait ExternalTextGenerationError extends Error {
-  def message: String
-}
-case class ExternalTextGenerationRateLimitError(code: Int, message: String)
-    extends ExternalTextGenerationError
-case class ExternalTextGenerationHttpError(code: Int, message: String)
-    extends ExternalTextGenerationError
-case class ExternalTextGenerationTimeoutError(message: String)
-    extends ExternalTextGenerationError
-```
-
-**Scala 3 improvement**:
-```scala
-enum ExternalTextGenerationError extends Error:
-  case RateLimit(code: Int, message: String)
-  case Http(code: Int, message: String) 
-  case Timeout(message: String)
-  
-  def message: String = this match
-    case RateLimit(_, msg) => msg
-    case Http(_, msg) => msg
-    case Timeout(msg) => msg
-```
-
-**Files to check**:
-- `/src/main/scala/net/eagle0/common/llm_integration/ExternalTextGenerationCaller.scala`
-- `/src/main/scala/net/eagle0/eagle/model/action_result/generated_text_request/GeneratedTextRequestT.scala`
-- `/src/main/scala/net/eagle0/eagle/model/state/quest/concrete/QuestC.scala`
-
-### 2. **Convert Implicit Classes to Extension Methods** 🎯 HIGH IMPACT
-**Benefits**: Modern syntax, better IDE support, cleaner imports
-
-**Current pattern** (`MoreSeq.scala:23-26`):
-```scala
-implicit def SeqCollect[A, Repr[_]](coll: Repr[A])(implicit
-    itr: IsIterable[Repr[A]]
-): SeqCollect[A, Repr, itr.type] =
-  new SeqCollect[A, Repr, itr.type](coll, itr)
-```
-
-**Scala 3 improvement**:
-```scala
-extension [A, Repr[_]](coll: Repr[A])(using itr: IsIterable[Repr[A]])
-  def flatCollect[B](pf: PartialFunction[itr.A, Option[B]])(using Factory[B, Repr[B]]): Repr[B] =
-    Factory[B, Repr[B]].fromSpecific(itr(coll).collect(pf).flatten)
-    
-  def flatCollectFirst[B](pf: PartialFunction[itr.A, Option[B]]): Option[B] =
-    itr(coll).collect(pf).flatten.headOption
-```
-
-**Files to check**:
-- `/src/main/scala/net/eagle0/common/MoreSeq.scala`
-- `/src/main/scala/net/eagle0/eagle/library/util/command_choice_helpers/CommandChooser.scala`
-- `/src/main/scala/net/eagle0/eagle/service/new_game_creation/NewGameCreation.scala`
-- `/src/main/scala/net/eagle0/eagle/library/actions/applier/ActionResultProtoApplierImpl.scala`
-- `/src/main/scala/net/eagle0/eagle/service/new_game_creation/StartGameActionResultUtils.scala`
-- `/src/main/scala/net/eagle0/eagle/model/state/date/Date.scala`
-
-### 3. **Convert Implicit Parameters to Using Clauses** 🎯 MEDIUM IMPACT
-**Benefits**: Cleaner syntax, better tooling support, clearer intent
-
-**Current pattern**:
-```scala
-def method[T](value: T)(implicit ec: ExecutionContext): Future[T]
-def process[A](items: Seq[A])(implicit ord: Ordering[A]): Seq[A]
-```
-
-**Scala 3 improvement**:
-```scala
-def method[T](value: T)(using ExecutionContext): Future[T]
-def process[A](items: Seq[A])(using Ordering[A]): Seq[A]
-```
-
-**Files to check**:
-- `/src/main/scala/net/eagle0/common/MoreSeq.scala`
-- `/src/main/scala/net/eagle0/eagle/library/util/hero_name_fetcher/HeroNameFetcher.scala`
-- `/src/main/scala/net/eagle0/eagle/library/util/ShardokMapInfo.scala`
-- `/src/main/scala/net/eagle0/common/llm_integration/OpenAIChatCompletionsServiceImpl.scala`
-- `/src/main/scala/net/eagle0/common/llm_integration/ClaudeServiceImpl.scala`
-
-### 4. **Opaque Types for Type Safety** 🎯 MEDIUM IMPACT
-**Benefits**: Zero runtime cost, compile-time type safety, prevents mixing up similar types
-
-**Pattern to look for**: Type aliases that represent distinct concepts
-```scala
-// Instead of: type UserId = String, type GameId = String
-opaque type UserId = String
-object UserId:
-  def apply(s: String): UserId = s
-  extension (id: UserId) 
-    def value: String = id
-    def isValid: Boolean = id.nonEmpty && id.length > 3
-
-opaque type GameId = Long  
-object GameId:
-  def apply(l: Long): GameId = l
-  extension (id: GameId) def value: Long = id
-```
-
-**Candidates**: Look for simple type aliases and ID types throughout the codebase.
-
-### 5. **Inline Methods for Performance** 🎯 LOW IMPACT
-**Benefits**: Compile-time optimization, better performance for hot paths
-
-**Pattern**: Mark small, frequently-called methods as `inline`
-```scala
-inline def isValidId(id: String): Boolean = 
-  id.nonEmpty && id.length > 3
-
-inline def calculateScore(base: Int, multiplier: Double): Double = 
-  base * multiplier
-```
-
-**Candidates**: Small utility methods in performance-critical paths (AI calculations, game state updates).
-
-### 6. **Union Types Instead of Complex Hierarchies** 🎯 LOW IMPACT  
-**Benefits**: Simpler type definitions for either/or scenarios
-
-**Pattern**: Simple sealed traits with only case classes
-```scala
-// Instead of:
-sealed trait Result
-case class Success(value: String) extends Result  
-case class Error(message: String) extends Result
-
-// Consider:
-type Result = Success | Error
-case class Success(value: String)
-case class Error(message: String)
-```
-
-### 7. **Context Functions for Cleaner APIs** 🎯 LOW IMPACT
-**Benefits**: Cleaner API design, implicit context passing
-
-**Pattern**: Replace implicit function parameters
-```scala
-// Old
-type Handler = GameState => Unit
-def withGameState(gs: GameState)(handler: Handler): Unit = handler(gs)
-
-// New  
-type Handler = GameState ?=> Unit
-def withGameState(gs: GameState)(handler: Handler): Unit = 
-  given GameState = gs
-  handler
-```
-
-## Implementation Priority
-
-### Phase 1: Quick Wins (High Impact, Low Risk)
-1. **Convert Extension Methods** in `MoreSeq.scala` - immediate readability improvement
-2. **Update Using Clauses** - simple find/replace operation  
-3. **Convert Simple Sealed Traits to Enums** - start with error types
-
-### Phase 2: Type Safety Improvements  
-4. **Add Opaque Types** for IDs and measurements - improves type safety
-5. **Inline Performance-Critical Methods** - measure before/after impact
-
-### Phase 3: Advanced Features (Lower Priority)
-6. **Union Types** where appropriate - only for simple either/or cases
-7. **Context Functions** for complex API improvements
-
-## Implementation Guidelines
-
-### Style Consistency
-- **Keep curly braces**: Continue using Scala 2 style `{}` instead of indentation-based syntax
-- **Gradual adoption**: Modernize files as they're touched for other reasons
-- **Test thoroughly**: Each modernization should include verification that behavior is unchanged
-
-### Performance Considerations  
-- **Measure enum performance**: Verify that enum conversion actually improves performance in hot paths
-- **Benchmark inline methods**: Use profiling to confirm performance gains
-- **Consider compilation time**: Some features may increase compile time
-
-### Migration Strategy
-- **File-by-file approach**: Complete modernization of one file at a time
-- **Separate PRs**: Each modernization type should be its own PR for easier review
-- **Documentation**: Update this document as patterns are modernized
-
-## Success Criteria
-- [ ] All extension methods converted from implicit classes
-- [ ] All implicit parameters converted to using clauses  
-- [ ] Key sealed traits converted to enums where appropriate
-- [ ] Opaque types introduced for important ID types
-- [ ] Performance-critical methods marked as inline (with benchmarks)
-- [ ] No regression in functionality or performance
-- [ ] Code remains readable and maintainable
-
-## Notes
-- Focus on high-impact, low-risk improvements first
-- Each change should be driven by clear benefits (performance, readability, type safety)
-- Maintain backward compatibility where possible
-- Document any breaking changes clearly

docs/SMALL_EAGLE_TODO.md

@@ -0,0 +1,79 @@
+# The Small Eagle TODO
+
+## Goals
+
+Be able to support a small (10-50 user) private alpha, including with strangers.
+
+Larger set of goals in [The Big Eagle TODO](https://docs.google.com/document/d/17RTt3-4Wl2AAVMRLodaC3a84E4de6xuQTWBPvCRM484/edit?pli=1&tab=t.0), but most of that is not necessary for MVP.
+
+## Required
+
+### Gameplay Productionization
+
+- [x] ~~All functionality works on production eagle / shardok servers~~
+- [x] ~~Acceptable latency in all regions~~
+- [x] ~~Shardok performance similar to QA~~
+- [x] ~~Error logging & alerting~~
+- [x] ~~Fix long disconnects on deployments~~
+- [x] Fix the Mac installer
+- [x] ~~Still not reconnecting after deployments~~
+- [ ] Notify about client updates, button to come directly back
+- [x] Generatedtext healing
+- [x] Kill outstanding shardok requests when game is deleted
+
+### Other Productionization
+
+- [x] ~~Oauth sign-in~~
+  - [x] ~~Add Google, others?~~
+- [ ] User management
+  - [x] ~~Invite codes~~
+  - [ ] Link accounts
+  - [x] ~~Choose display name~~
+  - [x] ~~Just do account setup from the landing page?~~
+- [x] ~~Download client directly from DO, avoid basic auth/my home network~~
+- [x] Support plan (Discord + in-client bug reporting + email contact)
+
+### Alpha Tester Support
+
+- [x] Feedback channel (Discord server)
+- [x] Bug report form in Unity client (Settings > Report Bug, sends to Discord webhook)
+- [ ] Known issues doc (so testers don't report the same things)
+
+### IP / Legal
+
+- [x] Document and make available licenses for art & music (attributions panel)
+- [x] Required open source disclosures (attributions panel)
+- [x] Audit assets for anything we don't have rights to and replace it
+- [x] Replace heroes that are based on real 20th or 21st century people or IP
+- [x] ~~Privacy policy (collecting accounts, OAuth data, gameplay data)~~ (alpha notice on invite page/email)
+- [ ] Terms of service (basic liability protection) - defer until public release
+- [x] ~~Data deletion capability (user requests account removal)~~ (accounts.eagle0.net)
+
+### Basic Gameplay
+
+- [ ] Tutorial
+  - [x] In the Your Warlord panel, say what the profession is
+  - [x] ~~And separate panels for each profession when you encounter one~~
+  - [x] ~~Command tutorial for each command the first time it's clicked~~
+  - [x] ~~Time to recruit / expand~~
+    - [x] ~~And how expansion works~~
+  - [ ] Province events
+  - [x] Running low on food
+  - [x] ~~Time to swear brotherhood~~
+    - [x] ~~When you get large, or~~
+    - [x] ~~When you get a good candidate~~
+  - [ ] Shardok tutorial!
+- [ ] Basic Shardok AI stuff fixed
+- [ ] Lobby fixes
+- [ ] Have goals / ending
+  - [ ] Win condition: all other factions defeated
+  - [ ] Mid-game progression: King recognizes you as you gain power (generated events)
+- [ ] First-session onboarding (beyond mechanics tutorial)
+  - [ ] Narrative hook in first few minutes - why should I care about my warlord?
+  - [ ] Clear first-session goal ("try to capture your first province" or similar)
+  - [ ] Early small victory to build momentum
+  - [ ] Guided first scenario vs. overwhelming sandbox?
+
+## Nice to have
+
+- [x] "What's new" changelog (fetch JSON, show entries since last launch)

docs/SPARKLE_DELTA_UPDATES.md

@@ -0,0 +1,568 @@
+# Sparkle Delta Updates Implementation Plan
+
+## Overview
+
+This document outlines the implementation plan for adding delta update support to the Eagle0 macOS auto-update system using Sparkle's BinaryDelta feature.
+
+### Current State
+- Full DMG downloads (~200MB) for every update
+- `mac_build_handler.go` creates DMG, signs it, uploads to S3, updates appcast.xml
+- Keeps last 10 versions in appcast, deletes older DMGs
+- Users must download full app even for small changes
+
+### Goals
+- Reduce update download size from ~200MB to ~10-30MB (85% reduction)
+- Maintain backward compatibility with full DMG downloads
+- Automatic fallback for users who are many versions behind
+
+## Sparkle Delta Update Architecture
+
+Sparkle supports binary delta updates through the `<sparkle:deltas>` element in the appcast. When a user updates, Sparkle:
+1. Checks if a delta patch exists from their current version to the new version
+2. If found, downloads the smaller delta patch instead of the full DMG
+3. Applies the patch locally to create the new app version
+4. Falls back to full DMG if no matching delta exists
+
+### Appcast XML Structure with Deltas
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
+  <channel>
+    <title>Eagle0</title>
+    <link>https://assets.eagle0.net/mac/appcast.xml</link>
+    <description>Eagle0 game updates</description>
+    <language>en</language>
+    <item>
+      <title>Version 1.0.9615</title>
+      <pubDate>Sun, 19 Jan 2026 12:00:00 -0800</pubDate>
+      <sparkle:version>9615</sparkle:version>
+      <sparkle:shortVersionString>1.0.9615</sparkle:shortVersionString>
+      <enclosure
+        url="https://assets.eagle0.net/mac/builds/eagle0-1.0.9615.dmg"
+        length="200000000"
+        type="application/octet-stream"
+        sparkle:edSignature="..." />
+      <sparkle:deltas>
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9614-9615.delta"
+          sparkle:deltaFrom="9614"
+          length="15000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9613-9615.delta"
+          sparkle:deltaFrom="9613"
+          length="18000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9612-9615.delta"
+          sparkle:deltaFrom="9612"
+          length="22000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+      </sparkle:deltas>
+    </item>
+    <!-- older versions... -->
+  </channel>
+</rss>
+```
+
+## Implementation Plan
+
+### Phase 1: Add S3 Utility Functions
+
+**File:** `src/main/go/net/eagle0/util/aws/bucket_basics.go`
+
+Add two new functions to support delta generation:
+
+```go
+// ListObjectsWithPrefix returns all object keys matching the given prefix
+func (bb BucketBasics) ListObjectsWithPrefix(bucket, prefix string) ([]string, error) {
+    var keys []string
+    paginator := s3.NewListObjectsV2Paginator(bb.S3Client, &s3.ListObjectsV2Input{
+        Bucket: aws.String(bucket),
+        Prefix: aws.String(prefix),
+    })
+
+    for paginator.HasMorePages() {
+        page, err := paginator.NextPage(context.TODO())
+        if err != nil {
+            return nil, err
+        }
+        for _, obj := range page.Contents {
+            keys = append(keys, *obj.Key)
+        }
+    }
+    return keys, nil
+}
+
+// DownloadFile downloads an object to a local file path
+func (bb BucketBasics) DownloadFile(bucket, key, localPath string) error {
+    result, err := bb.S3Client.GetObject(context.TODO(), &s3.GetObjectInput{
+        Bucket: aws.String(bucket),
+        Key:    aws.String(key),
+    })
+    if err != nil {
+        return err
+    }
+    defer result.Body.Close()
+
+    file, err := os.Create(localPath)
+    if err != nil {
+        return err
+    }
+    defer file.Close()
+
+    _, err = io.Copy(file, result.Body)
+    return err
+}
+```
+
+### Phase 2: Store App Bundles for Delta Generation
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Add storage paths:
+```go
+var appsRoot = "mac/apps/"      // Zipped app bundles for delta generation
+var deltasRoot = "mac/deltas/"  // Delta patches
+```
+
+After DMG creation, upload the zipped app bundle:
+```go
+func uploadAppBundle(bb aws.BucketBasics, appPath string, buildNumber string) error {
+    appZipPath := filepath.Join("/tmp", fmt.Sprintf("eagle0-%s.app.zip", buildNumber))
+
+    // Create zip of app bundle using ditto (preserves metadata)
+    cmd := exec.Command("ditto", "-c", "-k", "--keepParent", appPath, appZipPath)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return fmt.Errorf("failed to zip app: %s: %w", string(output), err)
+    }
+    defer os.Remove(appZipPath)
+
+    // Upload to S3
+    remotePath := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", buildNumber)
+    log.Printf("Uploading app bundle to S3: %s", remotePath)
+    return bb.UploadFilePublic(bucketName, remotePath, appZipPath)
+}
+```
+
+### Phase 3: Add Delta XML Structures
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Add new structs for delta representation:
+```go
+// Delta represents a delta patch from a previous version
+type Delta struct {
+    XMLName   xml.Name `xml:"enclosure"`
+    URL       string   `xml:"url,attr"`
+    DeltaFrom string   `xml:"sparkle:deltaFrom,attr"`
+    Length    int64    `xml:"length,attr"`
+    Type      string   `xml:"type,attr"`
+    EdSig     string   `xml:"sparkle:edSignature,attr"`
+}
+
+// Deltas wraps the sparkle:deltas element
+type Deltas struct {
+    XMLName xml.Name `xml:"sparkle:deltas"`
+    Items   []Delta  `xml:"enclosure"`
+}
+
+// Update Item struct to include Deltas
+type Item struct {
+    Title               string     `xml:"title"`
+    PubDate             string     `xml:"pubDate"`
+    SparkleVersion      string     `xml:"sparkle:version"`
+    SparkleShortVersion string     `xml:"sparkle:shortVersionString"`
+    Description         string     `xml:"description,omitempty"`
+    Enclosure           Enclosure  `xml:"enclosure"`
+    Deltas              *Deltas    `xml:"sparkle:deltas,omitempty"`
+}
+```
+
+### Phase 4: Generate Delta Patches
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+```go
+// Maximum number of versions to generate deltas from
+const maxDeltaVersions = 5
+
+// generateDeltas creates delta patches from previous versions to the new version
+func generateDeltas(bb aws.BucketBasics, newBuildNumber string, newAppPath string, privateKeyPath string) ([]Delta, error) {
+    var deltas []Delta
+
+    // Ensure BinaryDelta tool is available
+    binaryDeltaPath, err := ensureBinaryDelta()
+    if err != nil {
+        return nil, fmt.Errorf("failed to get BinaryDelta: %w", err)
+    }
+
+    // List available app bundles
+    appKeys, err := bb.ListObjectsWithPrefix(bucketName, appsRoot+"eagle0-")
+    if err != nil {
+        log.Printf("Warning: failed to list app bundles: %v", err)
+        return deltas, nil // Continue without deltas
+    }
+
+    // Parse build numbers from keys and sort descending
+    var buildNumbers []string
+    for _, key := range appKeys {
+        // Extract build number from "mac/apps/eagle0-9614.app.zip"
+        base := filepath.Base(key)
+        if strings.HasPrefix(base, "eagle0-") && strings.HasSuffix(base, ".app.zip") {
+            bn := strings.TrimSuffix(strings.TrimPrefix(base, "eagle0-"), ".app.zip")
+            if bn != newBuildNumber {
+                buildNumbers = append(buildNumbers, bn)
+            }
+        }
+    }
+
+    // Sort descending (most recent first) and limit to maxDeltaVersions
+    sort.Sort(sort.Reverse(sort.StringSlice(buildNumbers)))
+    if len(buildNumbers) > maxDeltaVersions {
+        buildNumbers = buildNumbers[:maxDeltaVersions]
+    }
+
+    // Generate delta from each previous version
+    for _, oldBuild := range buildNumbers {
+        delta, err := generateSingleDelta(bb, binaryDeltaPath, oldBuild, newBuildNumber, newAppPath, privateKeyPath)
+        if err != nil {
+            log.Printf("Warning: failed to generate delta from %s: %v", oldBuild, err)
+            continue // Skip this delta but continue with others
+        }
+        deltas = append(deltas, delta)
+    }
+
+    return deltas, nil
+}
+
+func generateSingleDelta(bb aws.BucketBasics, binaryDeltaPath, oldBuild, newBuild, newAppPath, privateKeyPath string) (Delta, error) {
+    // Download old app bundle
+    oldAppZipKey := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", oldBuild)
+    oldAppZipLocal := filepath.Join("/tmp", fmt.Sprintf("eagle0-%s.app.zip", oldBuild))
+    defer os.Remove(oldAppZipLocal)
+
+    if err := bb.DownloadFile(bucketName, oldAppZipKey, oldAppZipLocal); err != nil {
+        return Delta{}, fmt.Errorf("failed to download old app: %w", err)
+    }
+
+    // Unzip old app
+    oldAppDir := filepath.Join("/tmp", fmt.Sprintf("old-app-%s", oldBuild))
+    defer os.RemoveAll(oldAppDir)
+
+    cmd := exec.Command("ditto", "-x", "-k", oldAppZipLocal, oldAppDir)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return Delta{}, fmt.Errorf("failed to unzip old app: %s: %w", string(output), err)
+    }
+
+    oldAppPath := filepath.Join(oldAppDir, "eagle0.app")
+
+    // Generate delta
+    deltaPath := filepath.Join("/tmp", fmt.Sprintf("%s-%s.delta", oldBuild, newBuild))
+    defer os.Remove(deltaPath)
+
+    cmd = exec.Command(binaryDeltaPath, "create", oldAppPath, newAppPath, deltaPath)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return Delta{}, fmt.Errorf("failed to create delta: %s: %w", string(output), err)
+    }
+
+    // Get delta size
+    deltaSize, err := getFileSize(deltaPath)
+    if err != nil {
+        return Delta{}, fmt.Errorf("failed to get delta size: %w", err)
+    }
+    log.Printf("Delta %s->%s size: %d bytes (%.1f MB)", oldBuild, newBuild, deltaSize, float64(deltaSize)/1024/1024)
+
+    // Sign delta
+    signature, err := signWithSparkle(deltaPath, privateKeyPath)
+    if err != nil {
+        return Delta{}, fmt.Errorf("failed to sign delta: %w", err)
+    }
+
+    // Upload delta
+    deltaKey := deltasRoot + fmt.Sprintf("%s-%s.delta", oldBuild, newBuild)
+    if err := bb.UploadFilePublic(bucketName, deltaKey, deltaPath); err != nil {
+        return Delta{}, fmt.Errorf("failed to upload delta: %w", err)
+    }
+
+    deltaURL := fmt.Sprintf("https://assets.eagle0.net/%s", deltaKey)
+    return Delta{
+        URL:       deltaURL,
+        DeltaFrom: oldBuild,
+        Length:    deltaSize,
+        Type:      "application/octet-stream",
+        EdSig:     signature,
+    }, nil
+}
+
+func ensureBinaryDelta() (string, error) {
+    binaryDeltaPath := "/tmp/sparkle-cache/Sparkle-2.6.4/bin/BinaryDelta"
+
+    if _, err := os.Stat(binaryDeltaPath); os.IsNotExist(err) {
+        log.Println("Sparkle BinaryDelta not found, downloading...")
+        cmd := exec.Command("bash", "-c", `
+            mkdir -p /tmp/sparkle-cache
+            curl -sL https://github.com/sparkle-project/Sparkle/releases/download/2.6.4/Sparkle-2.6.4.tar.xz | tar -xJ -C /tmp/sparkle-cache
+        `)
+        if output, err := cmd.CombinedOutput(); err != nil {
+            return "", fmt.Errorf("failed to download Sparkle: %s: %w", string(output), err)
+        }
+    }
+
+    return binaryDeltaPath, nil
+}
+```
+
+### Phase 5: Update Main Deploy Flow
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Modify `main()` to integrate delta generation:
+
+```go
+func main() {
+    // ... existing argument parsing ...
+
+    // Create DMG (existing)
+    if err := createDMG(appPath, dmgPath, "Eagle0"); err != nil {
+        log.Fatalf("Failed to create DMG: %v", err)
+    }
+
+    // ... existing DMG upload ...
+
+    if privateKeyPath != "" {
+        // Upload app bundle for future delta generation (NEW)
+        log.Println("Uploading app bundle for delta generation...")
+        if err := uploadAppBundle(bb, appPath, buildNumber); err != nil {
+            log.Printf("Warning: failed to upload app bundle: %v", err)
+            // Continue - delta generation is optional
+        }
+
+        // Generate deltas from previous versions (NEW)
+        log.Println("Generating delta patches...")
+        deltas, err := generateDeltas(bb, buildNumber, appPath, privateKeyPath)
+        if err != nil {
+            log.Printf("Warning: failed to generate deltas: %v", err)
+        } else {
+            log.Printf("Generated %d delta patches", len(deltas))
+        }
+
+        // Update appcast with deltas
+        log.Println("Updating appcast.xml...")
+        appcast, err := fetchAppcast(bb)
+        if err != nil {
+            log.Fatalf("Failed to fetch appcast: %v", err)
+        }
+
+        // Create new item with deltas
+        newItem := Item{
+            Title:               fmt.Sprintf("Version %s", version),
+            PubDate:             time.Now().Format(time.RFC1123Z),
+            SparkleVersion:      buildNumber,
+            SparkleShortVersion: version,
+            Description:         "",
+            Enclosure: Enclosure{
+                URL:    downloadURL,
+                Length: fileSize,
+                Type:   "application/octet-stream",
+                EdSig:  signature,
+            },
+        }
+
+        // Add deltas if any were generated
+        if len(deltas) > 0 {
+            newItem.Deltas = &Deltas{Items: deltas}
+        }
+
+        // ... rest of appcast handling ...
+    }
+}
+```
+
+### Phase 6: Cleanup Old Artifacts
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+When pruning old versions from appcast, also delete associated artifacts:
+
+```go
+// In the appcast pruning section, after removing old items:
+if len(appcast.Channel.Items) > 10 {
+    oldItems := appcast.Channel.Items[10:]
+    for _, item := range oldItems {
+        oldBuild := item.SparkleVersion
+
+        // Delete old DMG (existing)
+        dmgKey := strings.TrimPrefix(item.Enclosure.URL, "https://assets.eagle0.net/")
+        log.Printf("Deleting old build: %s", dmgKey)
+        bb.DeleteObject(bucketName, dmgKey)
+
+        // Delete old app bundle (NEW)
+        appKey := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", oldBuild)
+        log.Printf("Deleting old app bundle: %s", appKey)
+        bb.DeleteObject(bucketName, appKey)
+
+        // Delete deltas TO this version (NEW)
+        deltaKeys, _ := bb.ListObjectsWithPrefix(bucketName, deltasRoot)
+        for _, key := range deltaKeys {
+            if strings.HasSuffix(key, fmt.Sprintf("-%s.delta", oldBuild)) {
+                log.Printf("Deleting old delta: %s", key)
+                bb.DeleteObject(bucketName, key)
+            }
+        }
+    }
+    appcast.Channel.Items = appcast.Channel.Items[:10]
+}
+```
+
+## S3 Storage Structure
+
+After implementation, the S3 bucket will have this structure:
+
+```
+eagle0-windows/
+├── mac/
+│   ├── appcast.xml                    # Update feed with delta info
+│   ├── builds/                        # Full DMG downloads
+│   │   ├── eagle0-1.0.9620.dmg
+│   │   ├── eagle0-1.0.9619.dmg
+│   │   ├── ...
+│   │   └── eagle0-latest.dmg          # Symlink to latest
+│   ├── apps/                          # Zipped app bundles (NEW)
+│   │   ├── eagle0-9620.app.zip
+│   │   ├── eagle0-9619.app.zip
+│   │   ├── eagle0-9618.app.zip
+│   │   ├── eagle0-9617.app.zip
+│   │   └── eagle0-9616.app.zip        # Keep last 5 for delta gen
+│   └── deltas/                        # Delta patches (NEW)
+│       ├── 9619-9620.delta
+│       ├── 9618-9620.delta
+│       ├── 9617-9620.delta
+│       ├── 9616-9620.delta
+│       ├── 9615-9620.delta
+│       ├── 9618-9619.delta
+│       ├── 9617-9619.delta
+│       └── ...
+```
+
+## Storage Impact Analysis
+
+### Current Storage (without deltas)
+- 10 DMGs × 200MB = **~2GB**
+
+### Estimated Storage (with deltas)
+- 10 DMGs × 200MB = 2GB
+- 5 app bundles × 150MB = 0.75GB (zip compression)
+- ~25 delta files × 20MB avg = 0.5GB
+- **Total: ~3.25GB**
+
+### Trade-offs
+- **+1.25GB storage** (~60% increase)
+- **-170MB per user update** (~85% bandwidth savings)
+- Break-even: ~8 user updates to recoup storage cost
+
+## Bandwidth Savings
+
+| Scenario | Without Deltas | With Deltas | Savings |
+|----------|---------------|-------------|---------|
+| 1 version behind | 200MB | ~15MB | 92% |
+| 2 versions behind | 200MB | ~20MB | 90% |
+| 3 versions behind | 200MB | ~25MB | 87% |
+| 5 versions behind | 200MB | ~35MB | 82% |
+| 6+ versions behind | 200MB | 200MB (full) | 0% |
+
+## Migration Strategy
+
+The implementation is backward-compatible and requires no changes to existing clients:
+
+1. **First deploy after implementation:**
+   - Stores app bundle for the first time
+   - No deltas generated (no previous app bundles exist)
+   - Appcast has no `<sparkle:deltas>` element
+
+2. **Second deploy:**
+   - Generates delta from previous version
+   - Appcast now has `<sparkle:deltas>` with one entry
+   - Users on previous version get delta update
+
+3. **Subsequent deploys:**
+   - Generate deltas from last 5 versions
+   - Users within 5 versions get delta updates
+   - Users more than 5 versions behind get full DMG
+
+4. **Client behavior:**
+   - Sparkle automatically checks for matching delta
+   - Falls back to full DMG if no delta matches
+   - No client code changes required
+
+## Error Handling
+
+The implementation handles failures gracefully:
+
+1. **S3 list/download fails:** Skip delta generation, use full DMG
+2. **BinaryDelta fails for one version:** Log warning, continue with other versions
+3. **Signing fails:** Skip that delta, continue with others
+4. **Upload fails:** Skip that delta, continue with others
+
+The deploy never fails due to delta issues - deltas are optional enhancements.
+
+## Verification Plan
+
+### Manual Testing
+
+1. **Deploy version N:**
+   - Verify app bundle uploaded to `mac/apps/eagle0-N.app.zip`
+   - Verify appcast has no deltas (first deploy)
+
+2. **Deploy version N+1:**
+   - Verify delta generated at `mac/deltas/N-(N+1).delta`
+   - Verify appcast contains `<sparkle:deltas>` element
+   - Verify delta signature is valid
+
+3. **Test update from N to N+1:**
+   - Install version N manually
+   - Check for updates
+   - Monitor download size in Player.log (should be ~15-30MB, not 200MB)
+   - Verify app updated successfully
+
+4. **Test fresh install:**
+   - Download latest DMG directly
+   - Verify installation works normally
+
+5. **Test fallback scenario:**
+   - Install a version more than 5 versions behind
+   - Update should download full DMG
+
+### Automated Verification
+
+Add to CI workflow (optional):
+```yaml
+- name: Verify delta generation
+  run: |
+    # Check app bundle exists
+    aws s3 ls s3://eagle0-windows/mac/apps/ | grep eagle0-${BUILD_NUMBER}.app.zip
+
+    # Check deltas exist (after second deploy)
+    aws s3 ls s3://eagle0-windows/mac/deltas/ | head -5
+
+    # Verify appcast has deltas
+    curl -s https://assets.eagle0.net/mac/appcast.xml | grep "sparkle:deltas"
+```
+
+## Security Considerations
+
+1. **All deltas are EdDSA signed:** Same signature verification as full DMG
+2. **BinaryDelta is Sparkle's official tool:** Well-audited, production-ready
+3. **App bundles in S3 are public:** Same as DMGs, no additional exposure
+4. **Cleanup removes old artifacts:** No indefinite storage of old versions
+
+## Future Enhancements
+
+1. **Parallel delta generation:** Generate multiple deltas concurrently
+2. **Delta size threshold:** Skip uploading deltas larger than X% of full DMG
+3. **Delta metrics:** Track delta download rates vs full DMG
+4. **Configurable delta count:** Allow adjusting how many versions to keep

docs/TUTORIAL_CONTENT.md

@@ -0,0 +1,181 @@
+# Tutorial Content Guide
+
+This document defines all tutorial content. Edit this to refine the text, then update `TutorialContentDefinitions.cs` to match.
+
+---
+
+## Onboarding Sequence
+
+Shown to first-time players. Guides them through the basics of strategic and tactical gameplay.
+
+| Step | ID | Display | Trigger | Title | Description |
+|------|-----|---------|---------|-------|-------------|
+| 1 | `welcome` | Modal | Auto (game start) | Welcome to Eagle0 | Command your armies, recruit heroes, and conquer provinces in this turn-based strategy game.<br><br>Let's walk through the basics! |
+| 2 | `select_province` | Overlay | Completes on: `province_selected` | The Strategic Map | This is your kingdom. Each colored region is a province.<br><br>Tap a province you control (shown in your color) to see what you can do there. |
+| 3 | `province_panel` | Modal | Button click | Province Information | This panel shows province details: its name, terrain, any armies present, and the commands available to you.<br><br>Commands let you move troops, recruit heroes, and more. |
+| 4 | `try_march` | Overlay | Completes on: `command_issued` | Issue a Command | Try issuing a March command to move your army to an adjacent province.<br><br>Select a destination and confirm the order. |
+| 5 | `turn_cycle` | Modal | Button click | The Turn Cycle | Eagle0 uses simultaneous turns. All players give orders at the same time, then turns resolve together.<br><br>When all players are ready, the server processes everyone's commands and shows the results. |
+| 6 | `wait_for_battle` | Hidden | Completes on: `first_battle_available` | *(none)* | *(Invisible step - waits for a battle to become available)* |
+| 7 | `battle_intro` | Modal | Button click | Battle Time! | When armies collide, you'll fight tactical battles on a hex grid.<br><br>You command individual units - infantry, cavalry, archers, and heroes with special abilities. |
+| 8 | `enter_battle` | Overlay | Completes on: `battle_entered` | Enter the Battle | Tap the Battle button to enter tactical combat. |
+| 9 | `tactical_overview` | Modal | Button click | Tactical Combat | Each unit has movement points and attack power. Position your troops wisely!<br><br>Units attack adjacent enemies. Flanking (attacking from multiple sides) deals bonus damage. |
+| 10 | `move_unit` | Overlay | Completes on: `battle_action` | Move Your Units | Tap one of your units to select it, then tap a highlighted hex to move there.<br><br>Blue hexes show where you can move. |
+| 11 | `attack_enemy` | Overlay | Completes on: `battle_action` | Attack! | Move next to an enemy unit, then tap the enemy to attack.<br><br>Red highlights show valid attack targets. |
+| 12 | `end_turn` | Overlay | Completes on: `turn_ended` | End Your Turn | When you've moved all units or want to pass, tap End Turn.<br><br>The enemy will then take their turn. |
+| 13 | `complete` | Modal | Button click (no skip) | You're Ready! | You now know the basics of Eagle0!<br><br>Explore diplomacy, recruit powerful heroes, and conquer the realm. Good luck, commander! |
+
+### Notes on Onboarding Flow
+
+- Steps 1-5 cover strategic gameplay
+- Step 6 is invisible - just waits for a battle
+- Steps 7-12 cover tactical combat
+- Step 13 celebrates completion
+
+**Questions to consider:**
+- Should we skip tactical tutorial if player skips to first battle themselves?
+- Should there be a "skip all" option visible from step 1?
+- Is the step order correct for typical first-game flow?
+
+---
+
+## Strategic Contextual Tutorials
+
+Triggered when players encounter features for the first time.
+
+### Diplomacy Introduction
+| Field | Value |
+|-------|-------|
+| ID | `diplomacy_intro` |
+| Trigger | `diplomacy_available` (diplomacy commands appear) |
+| Display | Modal |
+| Title | Diplomacy |
+| Description | You can negotiate with other factions!<br><br>Offer alliances, declare war, or propose tribute. Your diplomatic choices shape the realm. |
+
+### Hero Recruitment
+| Field | Value |
+|-------|-------|
+| ID | `hero_recruitment` |
+| Trigger | `hero_recruitment_available` (free heroes detected) |
+| Display | Modal |
+| Title | Heroes Available |
+| Description | Free heroes wander the realm seeking a lord to serve.<br><br>Recruit them to lead your armies! Heroes have unique abilities and grow stronger with experience. |
+
+### Weather Control
+| Field | Value |
+|-------|-------|
+| ID | `weather_control` |
+| Trigger | `weather_control_available` (weather command appears) |
+| Display | Overlay |
+| Title | Weather Magic |
+| Description | Your mages can influence the weather!<br><br>Rain slows movement, storms disrupt enemies, and clear skies speed your march. |
+
+### Prisoner Management
+| Field | Value |
+|-------|-------|
+| ID | `prisoner_management` |
+| Trigger | `prisoner_command_issued` (player uses prisoner command) |
+| Display | Modal |
+| Title | Prisoners Captured |
+| Description | You've captured enemy soldiers!<br><br>You can ransom them for gold, recruit them into your army, or execute them as a warning. |
+
+---
+
+## Tactical Contextual Tutorials
+
+Triggered during battles when players encounter spells, terrain, or abilities.
+
+### Lightning Bolt Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_lightning` |
+| Trigger | `spell_lightning_available` |
+| Display | Tooltip |
+| Title | Lightning Bolt |
+| Description | Your mage can cast Lightning Bolt!<br><br>This spell strikes a single target for heavy damage. Great for eliminating key enemy units. |
+
+### Meteor Strike Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_meteor` |
+| Trigger | `spell_meteor_available` |
+| Display | Modal |
+| Title | Meteor Strike |
+| Description | Meteor is a devastating area spell!<br><br>It takes a turn to cast: first select target, then it lands next turn. Plan ahead! |
+
+### Holy Wave Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_holywave` |
+| Trigger | `spell_holywave_available` |
+| Display | Tooltip |
+| Title | Holy Wave |
+| Description | Holy Wave heals your units and damages undead!<br><br>Position your troops carefully to maximize its effect. |
+
+### Raise Dead Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_raisedead` |
+| Trigger | `spell_raisedead_available` |
+| Display | Modal |
+| Title | Raise Dead |
+| Description | Dark magic can raise fallen soldiers as undead!<br><br>They fight for you, but beware - they may crumble if your necromancer falls. |
+
+### Fire Terrain
+| Field | Value |
+|-------|-------|
+| ID | `terrain_fire` |
+| Trigger | `terrain_fire_encountered` (fire damage occurs) |
+| Display | Tooltip |
+| Title | Fire Hazard |
+| Description | Fire spreads across the battlefield!<br><br>Units in burning hexes take damage. Use fire to block enemy routes or avoid it yourself. |
+
+### Water Crossing
+| Field | Value |
+|-------|-------|
+| ID | `terrain_water` |
+| Trigger | `terrain_water_encountered` (water crossing attempted) |
+| Display | Tooltip |
+| Title | Water Crossing |
+| Description | Units can cross shallow water, but it's risky.<br><br>Crossing takes extra movement and may fail. Some units swim better than others. |
+
+### Cavalry Charge
+| Field | Value |
+|-------|-------|
+| ID | `ability_charge` |
+| Trigger | `ability_charge_available` |
+| Display | Overlay |
+| Title | Cavalry Charge |
+| Description | Your cavalry can Charge!<br><br>Charging deals bonus damage based on distance traveled. Use open terrain for maximum impact. |
+
+---
+
+## Display Modes
+
+| Mode | Description | Use For |
+|------|-------------|---------|
+| **Modal** | Full popup with dimmed background, blocks interaction | Important concepts, multi-paragraph explanations |
+| **Overlay** | Semi-transparent overlay, can highlight UI elements | Guiding player to interact with specific UI |
+| **Tooltip** | Small popup near target element | Quick tips, less important info |
+| **Hint** | Pulsing dot indicator only | Subtle suggestions |
+| **None** | Invisible, just waits for event | Transition steps |
+
+---
+
+## Adding New Tutorials
+
+1. Add entry to this document
+2. Update `TutorialContentDefinitions.cs`:
+   - For onboarding: add to `CreateOnboardingSequence()`
+   - For contextual: add to `RegisterStrategicTutorials()` or `RegisterTacticalTutorials()`
+3. Ensure trigger event exists in `TutorialTriggerRegistry.cs`
+4. Test the flow
+
+---
+
+## Content Guidelines
+
+- Keep descriptions to 2-3 short paragraphs max
+- Use `<br><br>` for paragraph breaks (renders as newlines in Unity)
+- Avoid jargon - explain game terms when first introduced
+- Be encouraging, not condescending
+- Focus on "what to do" not exhaustive "how it works"

docs/scala3-reflection-issues.md

@@ -1,310 +0,0 @@
-# Scala 3 Migration: Reflection Issues Found
-
-This document catalogs all reflection-related problems discovered during the Scala 2.13.16 → Scala 3.7.2 migration of the Eagle0 codebase.
-
-## Summary
-
-The migration revealed several categories of reflection issues that needed to be addressed for Scala 3 compatibility:
-
-1. **Scala 2 Runtime Reflection API** - No longer available in Scala 3
-2. **Settings System Reflection** - Custom reflection for loading settings singletons 
-3. **json4s Automatic Case Class Extraction** - Uses reflection that fails with Scala 3 metaprogramming classes
-4. **ScalaTest Exception Handling** - Syntax changes affecting exception variable binding
-
-## 1. Scala 2 Runtime Reflection (FIXED)
-
-### Issue
-Tests using `scala.reflect.runtime.universe` fail because this reflection API doesn't exist in Scala 3.
-
-### Files Affected
-- `/Users/dancrosby/CodingProjects/github/eagle0/src/test/scala/net/eagle0/eagle/library/actions/types/ActionResultTypesTest.scala`
-
-### Error
-```scala
-import scala.reflect.runtime.universe  // Not available in Scala 3
-```
-
-### Solution Applied
-**Deleted the test entirely** as it was redundant. The test was verifying that auto-generated Scala objects (created by Bazel from proto enum values) matched their source proto values - something already guaranteed by the build system. Since the objects are generated directly from the proto definitions, this test provided no value.
-
-**Files deleted:**
-- `src/test/scala/net/eagle0/eagle/library/actions/types/ActionResultTypesTest.scala`
-
-## 2. Settings System Reflection (FIXED)
-
-### Issue
-Custom `SettingsLoader` class used reflection to access Scala object singletons, but the reflection pattern changed between Scala 2 and Scala 3.
-
-### Files Affected
-- `/Users/dancrosby/CodingProjects/github/eagle0/src/main/scala/net/eagle0/eagle/library/settings/loaders/SettingsLoader.scala`
-
-### Error
-```
-java.lang.NoSuchMethodException: net.eagle0.eagle.library.settings.ApprehendOutlawVigorCost$.MODULE$
-```
-
-### Root Cause
-In Scala 2, singleton objects are accessed via `ClassName$.MODULE$()`, but in Scala 3, they're accessed directly via `ClassName$` field. Additionally, `scala.reflect.runtime.universe` is not available in Scala 3.
-
-### Solution Applied
-**Completely eliminated reflection** by auto-generating the entire `SettingsLoader.scala` file from BUILD.bazel definitions:
-
-1. **Created generator**: `src/main/go/net/eagle0/build/settings_loader_generator/settings_loader_generator.go` - parses BUILD.bazel and generates complete SettingsLoader.scala with pattern matching for all 272 settings
-
-2. **Added genrule**: In `src/main/scala/net/eagle0/eagle/library/settings/loaders/BUILD.bazel`:
-```python
-genrule(
-    name = "settings_loader_src",
-    srcs = ["//src/main/scala/net/eagle0/eagle/library/settings:BUILD.bazel"],
-    outs = ["SettingsLoader.scala"],
-    cmd = "$(location //src/main/go/net/eagle0/build/settings_loader_generator) $(location //src/main/scala/net/eagle0/eagle/library/settings:BUILD.bazel) > $@",
-    tools = ["//src/main/go/net/eagle0/build/settings_loader_generator"],
-)
-```
-
-3. **Result**: SettingsLoader now uses compile-time pattern matching instead of reflection:
-```scala
-private def settingObjectForKey(key: String): Any = key match {
-  case "ActionVigorCost" => ActionVigorCost
-  case "BaseFoodBuyPrice" => BaseFoodBuyPrice
-  // ... all 272 settings auto-generated
-  case _ => throw NoSuchSettingException(key)
-}
-```
-
-### Benefits
-- **No reflection** - Completely Scala 3 compatible
-- **Maintainable** - New settings automatically included when added to BUILD.bazel
-- **Performance** - Pattern matching is faster than reflection
-- **Type-safe** - Compile-time checking of all settings
-
-## 3. json4s Reflection Issues (MULTIPLE LOCATIONS)
-
-### 3.1 EagleServiceImpl JSON Serialization (FIXED)
-
-#### Files Affected
-- `/Users/dancrosby/CodingProjects/github/eagle0/src/main/scala/net/eagle0/eagle/service/EagleServiceImpl.scala`
-
-#### Error
-```
-java.lang.NoClassDefFoundError: scala/quoted/staging/package$
-```
-
-#### Root Cause
-json4s automatic case class serialization uses reflection that tries to access Scala 3 metaprogramming classes (`scala.quoted.staging.package$`) which aren't available at runtime.
-
-#### Solution Applied
-Replaced automatic json4s serialization with ScalaPB's built-in JSON support:
-
-```scala
-// Old (reflection-based):
-// implicit val formats: DefaultFormats.type = DefaultFormats
-// write(actionResultView)
-
-// New (ScalaPB JSON support):
-import scalapb.json4s.JsonFormat
-JsonFormat.toJsonString(actionResultView.toProto)
-```
-
-### 3.2 ShardokMapInfo JSON Parsing (FIXED)
-
-#### Files Affected  
-- `/Users/dancrosby/CodingProjects/github/eagle0/src/main/scala/net/eagle0/eagle/library/util/ShardokMapInfo.scala` (Line 44)
-
-#### Error
-```
-java.lang.NoClassDefFoundError: scala/quoted/staging/package$
-at org.json4s.reflect.ScalaSigReader$.readConstructor(ScalaSigReader.scala:42)
-```
-
-#### Root Cause
-The line `val extracted = parsedJson.extract[List[ShardokMapInfo]]` uses json4s automatic case class extraction which relies on reflection.
-
-#### Solution Applied
-Replaced automatic extraction with manual JSON parsing:
-
-```scala
-// OLD (reflection-based):
-val extracted = parsedJson.extract[List[ShardokMapInfo]]
-
-// NEW (manual parsing, no reflection):
-val extracted = parsedJson match {
-  case JArray(items) => items.map { item =>
-    val name = (item \ "name").extract[String]
-    val castleCount = (item \ "castleCount").extract[Int] 
-    val positions = (item \ "positions").extract[Map[Int, Int]]
-    ShardokMapInfo(name, castleCount, positions)
-  }
-  case _ => throw new Exception("Expected JSON array for map info")
-}
-```
-
-#### Testing
-The fix was verified - `attack_command_chooser_test` now passes successfully.
-
-### 3.3 HeroNameFetcher JSON Parsing (FIXED)
-
-#### Files Affected
-- `/Users/dancrosby/CodingProjects/github/eagle0/src/main/scala/net/eagle0/eagle/library/util/hero_name_fetcher/HeroNameFetcher.scala`
-
-#### Issue  
-Case class extraction `parsedJson.extract[ResponseBody]` uses reflection that may fail in Scala 3.
-
-#### Solution Applied
-Replaced automatic case class extraction with manual JSON parsing:
-
-```scala
-// OLD (reflection-based):
-val parsedJson = json.parse(src.getLines().mkString)
-parsedJson.extract[ResponseBody]
-
-// NEW (manual parsing, no reflection):
-parsedJson \ "names" match {
-  case JArray(nameArray) => 
-    nameArray.map { nameObj =>
-      val id = (nameObj \ "id").extract[String]
-      val name = (nameObj \ "name").extract[String]
-      NameResponse(id, name)
-    }.toVector
-  case _ => throw new Exception("Expected 'names' array in response")
-}
-```
-
-#### Testing
-The fix was verified - HeroNameFetcher now builds successfully without reflection.
-
-### 3.4 Other json4s Usage Analysis
-
-#### Files with json4s extraction:
-- **✅ SAFE**: OpenAI/Claude Services - Only extract simple types (`String`, `Int`) - no reflection
-- **✅ FIXED**: `HeroNameFetcher.scala` - Replaced `extract[ResponseBody]` with manual parsing (no reflection)
-- **⚠️ POTENTIAL ISSUES** (not currently causing failures but should be monitored):
-  - `JsonUtils.scala`: `extract[Map[String, Vector[String]]]` - complex type extraction
-  - `HexMapJsonUtils.scala`: `extract[List[JObject]]` - may be problematic
-
-#### Recommendation
-Apply the same manual parsing pattern to remaining case class extractions if they cause runtime failures during Scala 3 migration.
-
-## 4. ScalaTest Exception Handling Syntax (FIXED)
-
-### Issue
-Scala 3 changed how exception variables are bound in ScalaTest's `the[Exception] thrownBy {...}` construct.
-
-### Files Affected
-**70+ test files** across the codebase using exception testing patterns.
-
-### Error Pattern
-```
-Not found: ex
-```
-
-### Root Cause
-In Scala 2: `the[Exception] thrownBy { ... }` automatically creates an `ex` variable.
-In Scala 3: The exception variable must be explicitly bound.
-
-### Solution Applied
-Added explicit variable binding across all affected test files:
-
-```scala
-// Old Scala 2 syntax:
-the[EagleCommandException] thrownBy {
-  // test code
-}
-ex.getMessage shouldBe "expected message"
-
-// New Scala 3 syntax:
-val ex = the[EagleCommandException] thrownBy {
-  // test code  
-}
-ex.getMessage shouldBe "expected message"
-```
-
-### Script Used
-Created and ran a systematic fix script that processed 70+ files:
-
-```bash
-# Pattern to find and fix exception handling
-find . -name "*.scala" -exec sed -i '' 's/the\[\([^]]*\)\] thrownBy {/val ex = the[\1] thrownBy {/g' {} \;
-```
-
-## 5. ScalaTest Import Changes (FIXED)
-
-### Issue
-Scala 3 requires different imports for ScalaTest matchers.
-
-### Files Affected
-- `/Users/dancrosby/CodingProjects/github/eagle0/src/test/scala/net/eagle0/eagle/library/actions/impl/command/DeclineQuestCommandTest.scala`
-
-### Error
-```
-value convertToAnyShouldWrapper is not a member of object org.scalatest.matchers.should.Matchers
-```
-
-### Solution Applied
-Changed from specific imports to wildcard import:
-
-```scala
-// Old:
-import org.scalatest.matchers.should.Matchers.{convertToAnyShouldWrapper, the}
-
-// New:
-import org.scalatest.matchers.should.Matchers.*
-```
-
-## 6. Mock Framework Issues (FIXED)
-
-### Issue
-ScalaMock had type inference issues with Scala 3 for classes with constructor parameters.
-
-### Files Affected
-- `/Users/dancrosby/CodingProjects/github/eagle0/src/test/scala/net/eagle0/eagle/library/EngineImplTest.scala`
-
-### Error
-```
-Found: Vector
-Required: Vector[net.eagle0.eagle.library.util.hero_generator.hero_with_name.HeroWithName]
-```
-
-### Root Cause
-Mock framework couldn't properly infer types for `mock[HeroGenerator]` where `HeroGenerator` has constructor parameters.
-
-### Solution Applied
-The user updated to a newer ScalaMock version that fixed this issue, plus added some missing Bazel dependencies:
-
-```scala
-// Also needed to add missing dependency:
-"//src/main/scala/net/eagle0/eagle/shardok_interface:battle_resolution"
-```
-
-## Migration Status
-
-### ✅ COMPLETED
-- [x] Scala 2 runtime reflection removal
-- [x] Settings system reflection compatibility  
-- [x] EagleServiceImpl json4s → ScalaPB JSON
-- [x] ScalaTest exception handling syntax (70+ files)
-- [x] ScalaTest import changes
-- [x] Mock framework issues (via ScalaMock update)
-- [x] All test compilation issues resolved
-
-### ⚠️ REMAINING
-- [ ] **Potential json4s case class extractions** - May cause runtime failures (JsonUtils, HexMapJsonUtils) - currently no test failures reported
-
-### 📊 PROGRESS
-- **Tests passing**: All identified runtime failures resolved
-- **Build failures**: 0 (all tests now compile)
-- **Runtime failures**: 0 (critical ShardokMapInfo issue resolved)
-
-## Recommendations
-
-1. **✅ COMPLETED**: ShardokMapInfo json4s reflection issue resolved with manual parsing
-2. **Monitor remaining json4s usage**: Watch for runtime failures in HeroNameFetcher, JsonUtils, and HexMapJsonUtils during full Scala 3 migration
-3. **Consider ScalaPB for new JSON needs**: For new functionality, prefer ScalaPB's JSON support to avoid reflection entirely
-4. **Apply manual parsing pattern**: If other json4s case class extractions cause runtime failures, use the same manual parsing approach demonstrated in ShardokMapInfo
-
-## Key Learnings
-
-- **Scala 3 reflection changes**: Major differences in singleton object access patterns
-- **json4s compatibility**: Automatic case class extraction doesn't work well with Scala 3 metaprogramming
-- **ScalaPB advantage**: Using ScalaPB's JSON support avoids reflection issues entirely
-- **Systematic approach**: Many issues followed patterns that could be fixed with scripts across multiple files

external/BUILD.llvm_mingw

@@ -0,0 +1,48 @@
+# LLVM MinGW toolchain for Windows cross-compilation
+# Provides x86_64-w64-mingw32 target compiler and libraries
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "all_files",
+    srcs = glob(["**/*"]),
+)
+
+# Compiler binaries
+filegroup(
+    name = "compiler_files",
+    srcs = glob([
+        "bin/x86_64-w64-mingw32-*",
+        "bin/clang*",
+        "bin/llvm-*",
+        "bin/lld*",
+    ]),
+)
+
+# Windows x86_64 sysroot (headers and libraries)
+filegroup(
+    name = "windows_x86_64_sysroot",
+    srcs = glob([
+        "x86_64-w64-mingw32/**/*",
+        "generic-w64-mingw32/include/**/*",
+    ]),
+)
+
+# All library files needed for linking
+filegroup(
+    name = "linker_files",
+    srcs = glob([
+        "bin/x86_64-w64-mingw32-*",
+        "bin/lld*",
+        "bin/ld.lld*",
+        "lib/**/*",
+        "x86_64-w64-mingw32/lib/**/*",
+    ]),
+)
+
+# The main C compiler wrapper script path for CGO
+# CGO needs CC to point to the cross-compiler
+exports_files([
+    "bin/x86_64-w64-mingw32-clang",
+    "bin/x86_64-w64-mingw32-clang++",
+])

external/BUILD.sparkle

@@ -0,0 +1,8 @@
+load("@build_bazel_rules_apple//apple:apple.bzl", "apple_dynamic_framework_import")
+
+# Import pre-built Sparkle framework
+apple_dynamic_framework_import(
+    name = "Sparkle",
+    framework_imports = glob(["Sparkle.framework/**"]),
+    visibility = ["//visibility:public"],
+)

go.mod

@@ -11,6 +11,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.72.2
 	github.com/golang-jwt/jwt/v5 v5.2.1
 	github.com/google/uuid v1.6.0
+	github.com/webview/webview_go v0.0.0-20240831120633-6173450d4dd6
+	golang.org/x/sys v0.28.0
 	google.golang.org/grpc v1.68.0
 	google.golang.org/protobuf v1.36.3
 )

go.sum

@@ -41,6 +41,10 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/webview/webview_go v0.0.0-20240831120633-6173450d4dd6 h1:VQpB2SpK88C6B5lPHTuSZKb2Qee1QWwiFlC5CKY4AW0=
+github.com/webview/webview_go v0.0.0-20240831120633-6173450d4dd6/go.mod h1:yE65LFCeWf4kyWD5re+h4XNvOHJEXOCOuJZ4v8l5sgk=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
 golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

maven_install.json

@@ -1,19 +1,19 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": -2049857450,
-  "__RESOLVED_ARTIFACTS_HASH": -1728186926,
+  "__INPUT_ARTIFACTS_HASH": 434250008,
+  "__RESOLVED_ARTIFACTS_HASH": -824975294,
   "conflict_resolution": {
     "com.google.guava:failureaccess:1.0.1": "com.google.guava:failureaccess:1.0.2",
     "com.squareup.okio:okio:2.10.0": "com.squareup.okio:okio:3.6.0",
-    "io.netty:netty-buffer:4.1.110.Final": "io.netty:netty-buffer:4.1.112.Final",
-    "io.netty:netty-codec-http2:4.1.110.Final": "io.netty:netty-codec-http2:4.1.112.Final",
-    "io.netty:netty-codec-http:4.1.110.Final": "io.netty:netty-codec-http:4.1.112.Final",
-    "io.netty:netty-codec:4.1.110.Final": "io.netty:netty-codec:4.1.112.Final",
-    "io.netty:netty-common:4.1.110.Final": "io.netty:netty-common:4.1.112.Final",
-    "io.netty:netty-handler:4.1.110.Final": "io.netty:netty-handler:4.1.112.Final",
-    "io.netty:netty-resolver:4.1.110.Final": "io.netty:netty-resolver:4.1.112.Final",
-    "io.netty:netty-transport-native-unix-common:4.1.110.Final": "io.netty:netty-transport-native-unix-common:4.1.112.Final",
-    "io.netty:netty-transport:4.1.110.Final": "io.netty:netty-transport:4.1.112.Final",
+    "io.netty:netty-buffer:4.1.110.Final": "io.netty:netty-buffer:4.1.130.Final",
+    "io.netty:netty-codec-http2:4.1.110.Final": "io.netty:netty-codec-http2:4.1.130.Final",
+    "io.netty:netty-codec-http:4.1.110.Final": "io.netty:netty-codec-http:4.1.130.Final",
+    "io.netty:netty-codec:4.1.110.Final": "io.netty:netty-codec:4.1.130.Final",
+    "io.netty:netty-common:4.1.110.Final": "io.netty:netty-common:4.1.130.Final",
+    "io.netty:netty-handler:4.1.110.Final": "io.netty:netty-handler:4.1.130.Final",
+    "io.netty:netty-resolver:4.1.110.Final": "io.netty:netty-resolver:4.1.130.Final",
+    "io.netty:netty-transport-native-unix-common:4.1.110.Final": "io.netty:netty-transport-native-unix-common:4.1.130.Final",
+    "io.netty:netty-transport:4.1.110.Final": "io.netty:netty-transport:4.1.130.Final",
     "io.opencensus:opencensus-api:0.31.0": "io.opencensus:opencensus-api:0.31.1",
     "org.checkerframework:checker-qual:3.12.0": "org.checkerframework:checker-qual:3.43.0"
   },
@@ -296,27 +296,27 @@
     },
     "io.netty:netty-buffer": {
       "shasums": {
-        "jar": "bc182c48f5369d48cd8370d2ab0c5b8d99dd8ffa4a0f8ac701652d57bd380eff"
+        "jar": "00a522b67ea35cb7b4dd9cf27f85c6c58f5e306785aa045302e5f6b2d4944a87"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-codec": {
       "shasums": {
-        "jar": "72db4f93629f7ea520d2998c08e2b1d69f9c6a4792b53da5e9a001d24c78b151"
+        "jar": "52636bc29bd62120b97bbe5d1d21eab9b1cb2bef8efbb54d2221c5f3fa08d8cd"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-codec-http": {
       "shasums": {
-        "jar": "21b502d1374d6992728d004e0c1c95544d46d971f55ea78dcb854ce1ac0c83bc"
+        "jar": "5b6addc1df7b3397a193bd6544a8bfdb18ecac99fd13bee4ec75b1781a664e5e"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-codec-http2": {
       "shasums": {
-        "jar": "7f73efc845e8818d71da23b21dc65d69132dd0e12ed0e80cc937bd79ab7d5749"
+        "jar": "f8ffdb550368fd5dee7c7f1393fa49552522f280ed8de96aebf4269cab0dc8f3"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-codec-socks": {
       "shasums": {
@@ -326,15 +326,15 @@
     },
     "io.netty:netty-common": {
       "shasums": {
-        "jar": "b03967f32c65de5ed339b97729170e0289b22ffa5729e7f45f68bf6b431fb567"
+        "jar": "53921f28dd5a352b1bed0e1cbcc54d013dc60ffebeae9b2b1e53eabef317e581"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-handler": {
       "shasums": {
-        "jar": "ea4d6062a5fb10a6e2364d8bbdebc1cfa814f1fc9f910ef57e5caf02fb15c588"
+        "jar": "98c78ec187ca30a4b9775bf6f632f5c9929db6bf06a60e6971f945813880ca0f"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-handler-proxy": {
       "shasums": {
@@ -344,9 +344,9 @@
     },
     "io.netty:netty-resolver": {
       "shasums": {
-        "jar": "6b4ac9f3b67f562f0770d57c389279ff9c708eb401e1a3635f52297f0f897edc"
+        "jar": "48c5b218a89d184e1b601d46433957f515fcefdb4464182b1348bce4f5a18f35"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-tcnative-boringssl-static": {
       "shasums": {
@@ -367,15 +367,15 @@
     },
     "io.netty:netty-transport": {
       "shasums": {
-        "jar": "d38e31624d25ca790ee413d529c152170217ebedbcdcf61164fa6291f3a56c92"
+        "jar": "1bf573266d271f856705a9984d25449c56a1d73c02a16af12033ceccfe555dbb"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-transport-classes-epoll": {
       "shasums": {
-        "jar": "96cf2e6622ea70e2bc67aed373607df32863f863d0d7b8c9c94d468efd1d0638"
+        "jar": "1c352508d70aca1ccc3068daac907ad1e9d8dc68b07148d57426730bf0d0c8b6"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.netty:netty-transport-native-epoll": {
       "shasums": {
@@ -385,9 +385,9 @@
     },
     "io.netty:netty-transport-native-unix-common": {
       "shasums": {
-        "jar": "e79ccea1b87a6348d4ebd3dfb37a2cccd9b7cb65c3375f6ccdac086c7b5ce487"
+        "jar": "cf5efc4168597d7cd14695b469418cac2a1134533f9a0c82ef0538d796fd39e1"
       },
-      "version": "4.1.112.Final"
+      "version": "4.1.130.Final"
     },
     "io.opencensus:opencensus-api": {
       "shasums": {
@@ -415,9 +415,9 @@
     },
     "io.sentry:sentry": {
       "shasums": {
-        "jar": "740a118182fc089d307830f4e508372e01ad94639b00b4e1b1d83762298a5f35"
+        "jar": "bf4feb94944d03cc12e6d64ac8827d2328e3992744a3ce836f3f561e2c896209"
       },
-      "version": "7.19.0"
+      "version": "8.31.0"
     },
     "javax.activation:javax.activation-api": {
       "shasums": {
@@ -589,183 +589,189 @@
     },
     "software.amazon.awssdk:annotations": {
       "shasums": {
-        "jar": "a8faf8a259a3044758c3b6d2c53e33e7ec511bce9ef9b43a2a28af51483e868f"
+        "jar": "ed03bb4ff78900307dc96bacdec70ddf80c17df3eb6761219573025649f08ff3"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:apache-client": {
       "shasums": {
-        "jar": "a63a91614d68fd7a72bd6e2f8e3c3a14dfca5b9768af30bc9b612c5592dd811e"
+        "jar": "37c1331e8e5e8bb8357b459258f4df7d367a7c0bb5ca36d640f688551484e98a"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:arns": {
       "shasums": {
-        "jar": "71a9f48c063ca66c2b72172254ade7a4207bb055290c668f42e49c744b11df69"
+        "jar": "79074ed723d0bbc0eeb06ed8b30a1a5c1c109587706e284f6c02cb6e03c1732e"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:auth": {
       "shasums": {
-        "jar": "91416554cbc4cb293847e9f79019e6eb292f73b2221b91d5c2f9704709030f72"
+        "jar": "6ead038931e9348fc54f83f57b3788e7bbf2427d530e979206342c6bcd1c419d"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:aws-core": {
       "shasums": {
-        "jar": "a7a36217cb47ab0025fad65cec0f4911ef7fa65ab3bcb21fefcfb41aa145021e"
+        "jar": "962c6a0037f054fafc38535c2ace8e2645a079ab7020068bd8c874f3112d8fe5"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:aws-query-protocol": {
       "shasums": {
-        "jar": "34a9492bed2015c82587521e9761a4a19e4976a8e20956ace88f1dd2083b7714"
+        "jar": "46ef904b4f6ed9966a8f02255e2089b2b87d2028430dfca3e14b111bb4ef745b"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:aws-xml-protocol": {
       "shasums": {
-        "jar": "027b5935a88bc8cbfee038c15344d209bc08d542d190f8598b28995e33474297"
+        "jar": "199af876a21a7768b1690582c28792a83f7da0c398dc02c8e66f60fb57805622"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:checksums": {
       "shasums": {
-        "jar": "19a304fbee84b6a0de316ddc71ae109167f8c6c9e64af9a5f968bc04860507dd"
+        "jar": "63685bbafb8c88c3cf184d83abf568b9bcbecd590494e471262d827ebf4500e8"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:checksums-spi": {
       "shasums": {
-        "jar": "b17c77ca39e9b0e263fc9101cadfc8c0f80154b830b99d5941ff43133307215b"
+        "jar": "b3dfcbb293b1ec7d2c7004c66b4dfeb1dc45b564e0974e1e7ecfb422cc558b8f"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:crt-core": {
       "shasums": {
-        "jar": "9c9c11c2c81fe6bd2e1b2a0be998de2c4558e399e6eb4f2d8f0f5e2370522499"
+        "jar": "a376745be7ff748996a3c11ae3ee5d702eac07197d1c4690c58d67dd313e6be6"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:endpoints-spi": {
       "shasums": {
-        "jar": "327346ed4ac231de6c0b941b82a103e111c3398d6465680fe5325595ab8a72d1"
+        "jar": "2176cf79255a9f7b5b3ab687b5b24a94faa0f626cd4368307db59d1a4f438d7e"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:http-auth": {
       "shasums": {
-        "jar": "1f3a01603ee338261326739b2305c75f06945fba095824b25d9618a831096663"
+        "jar": "c1332af673bebee0485e0b92c6fdc9f2022339c0b34a39c56458f1b293dbfe96"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:http-auth-aws": {
       "shasums": {
-        "jar": "cc12522d777a90ec8b24210889fc5a3304eb8b44c84a1663a1777add1697a571"
+        "jar": "01904850fba39ef2658931116ddb6ad00e3491e65ee09d4763ede7ce65b95574"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:http-auth-aws-eventstream": {
       "shasums": {
-        "jar": "6c42fa55bc91bd9ffcfdce1ad27c40f53053ac331afa40f597eda9f55afafd58"
+        "jar": "7294716ba8fd2f77ab917ca39ba0fad9e30c5d65329a98c6fde37bdd47aa0550"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:http-auth-spi": {
       "shasums": {
-        "jar": "363542d7632ec1d0b4950a0458a0ab67b0dfa9297c536ea518f2359c13e9fa66"
+        "jar": "1bec31a85ba3261e6e3ffde62f1a45834df1accf45262c42d0fd354c299752ba"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:http-client-spi": {
       "shasums": {
-        "jar": "da646c041506463aab868c6fd44148e743b177abc7e59c31c0a4d72cda6800de"
+        "jar": "590ad7e05bdf79b4a873f47767a8cef8b906023f7cfbced58050c85af28bfd0b"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:identity-spi": {
       "shasums": {
-        "jar": "41712b35f2194e0551512762de18c5be5588d3ef0968f160bd1f9d18710fbb55"
+        "jar": "8d8857f2f1243ccb6bb9c13beaa9e1ccce5087fe0a2599f4a801eafe2f8c0783"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:json-utils": {
       "shasums": {
-        "jar": "3315c8ad3f1c71938d462e10435ecd0391f44441dcfe31e8a9d344fb7e43721f"
+        "jar": "7b8209883466083d3cd405679f1a75298e56926dc2e19640c377b3c8e2592969"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:metrics-spi": {
       "shasums": {
-        "jar": "871fb80426158d296e3c7b695944aa2dcc4535f49a97d4a1616a7cdb21d66994"
+        "jar": "1f58e5147bcbb57f24ca6ab3534ca62fa7b35cc119eb0739cfb2a561a3c89c29"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:netty-nio-client": {
       "shasums": {
-        "jar": "ce410946eb8f20421293ee9f6931e76d80a0c89d6ea31bdbf223ba07f316f2e3"
+        "jar": "798550b0b59307a3d00801cc1dced02cde77c69268ff25455bb0aeeddecbe242"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:profiles": {
       "shasums": {
-        "jar": "5789b27935bf6137884e35c86b3f3a246081209ecc511716b3d058e0e41c0719"
+        "jar": "b11c9b445f9bd16853ccf7130ae659ad76f2b749254c9920745c2a04230195b7"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:protocol-core": {
       "shasums": {
-        "jar": "8e5bb55d4fe57951cbe6e06b66823f2bf5b5f93e9332ae6f2fc06599e0436544"
+        "jar": "8b0e21264c340b49e677b98c1303bd8916140e33cdad96bba8c8e831b7cbdd81"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:regions": {
       "shasums": {
-        "jar": "fb8020d6c948366384e1f669542170779764b5efdc127fa4b2b01d38e92c592a"
+        "jar": "3d493a84884636d1fd6d8ef008e40d88639c9f8e38832d0cd99dc3ba3332c258"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:retries": {
       "shasums": {
-        "jar": "4a175be77663ddd5657d6919bf681fef71bf5782b5c00b683c73f32b639c6e3f"
+        "jar": "dbc0a5d16cc37cf325d60313e47ed41e9a683d46168920e72e13faa000bc7bcd"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:retries-spi": {
       "shasums": {
-        "jar": "57013438cf22c138a420c3c621a68202e0a7ee5f7a65de7681d9e2b308a01671"
+        "jar": "65aa3abb7bf5bac9ffac6ec20b5a70e7d4cb077f57edd3e4a0347180c75f82e5"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:s3": {
       "shasums": {
-        "jar": "2fa7b521592c0df9b9d5a8c6619132b84c9154fe2964ec32b408d386ad640169"
+        "jar": "06ca194e7bc633013a50ee8da497f83c2b275d2f41673ae63d0da2f61a352e90"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:s3-transfer-manager": {
       "shasums": {
-        "jar": "c05103cedc46ca416c4f5556561a113133d21deafe3c54682afb054ff0388647"
+        "jar": "c56152a84c1c291414f3e33523887f0a2cf551613b8a8eb4661fd9b66478b385"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:sdk-core": {
       "shasums": {
-        "jar": "5b7d8a82c65af05f1ab789d3ca29aaf9a0fdc8656053e9114609feb49399a5bf"
+        "jar": "f09e0cce359200dec42d5f8d59e1c7e4159dfa6d27c38acff176deccda348fa7"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:third-party-jackson-core": {
       "shasums": {
-        "jar": "84e86f09375ebc378b390e968ad0c945af670241149e814e5fbe40ac87e0ae52"
+        "jar": "23e0c862fd5573c952bbf7fb35e7632a4328d37a188591e1e40f3c15d409690b"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
     },
     "software.amazon.awssdk:utils": {
       "shasums": {
-        "jar": "38d869eeb74e9fc16ae1d707b919cbf71186f00920b81fe7a68f93a4db9b7d84"
+        "jar": "3d4bec1ab45fe5316337e285eb5f6729122388af538807927624c7f5cb5d4a91"
       },
-      "version": "2.28.1"
+      "version": "2.41.18"
+    },
+    "software.amazon.awssdk:utils-lite": {
+      "shasums": {
+        "jar": "b42350e316ced8ef805f1443dc1716e6854865ae882729b2d21e8ce6416fc8fd"
+      },
+      "version": "2.41.18"
     },
     "software.amazon.eventstream:eventstream": {
       "shasums": {
@@ -1110,6 +1116,7 @@
     ],
     "software.amazon.awssdk:auth": [
       "software.amazon.awssdk:annotations",
+      "software.amazon.awssdk:checksums-spi",
       "software.amazon.awssdk:http-auth",
       "software.amazon.awssdk:http-auth-aws",
       "software.amazon.awssdk:http-auth-aws-eventstream",
@@ -1138,6 +1145,7 @@
       "software.amazon.awssdk:retries-spi",
       "software.amazon.awssdk:sdk-core",
       "software.amazon.awssdk:utils",
+      "software.amazon.awssdk:utils-lite",
       "software.amazon.eventstream:eventstream"
     ],
     "software.amazon.awssdk:aws-query-protocol": [
@@ -1159,7 +1167,8 @@
     ],
     "software.amazon.awssdk:checksums": [
       "software.amazon.awssdk:annotations",
-      "software.amazon.awssdk:checksums-spi"
+      "software.amazon.awssdk:checksums-spi",
+      "software.amazon.awssdk:utils"
     ],
     "software.amazon.awssdk:checksums-spi": [
       "software.amazon.awssdk:annotations"
@@ -1194,6 +1203,7 @@
     "software.amazon.awssdk:http-auth-spi": [
       "org.reactivestreams:reactive-streams",
       "software.amazon.awssdk:annotations",
+      "software.amazon.awssdk:checksums-spi",
       "software.amazon.awssdk:http-client-spi",
       "software.amazon.awssdk:identity-spi",
       "software.amazon.awssdk:utils"
@@ -1321,6 +1331,9 @@
       "org.reactivestreams:reactive-streams",
       "org.slf4j:slf4j-api",
       "software.amazon.awssdk:annotations"
+    ],
+    "software.amazon.awssdk:utils-lite": [
+      "software.amazon.awssdk:annotations"
     ]
   },
   "packages": {
@@ -1795,21 +1808,31 @@
       "io.sentry",
       "io.sentry.backpressure",
       "io.sentry.cache",
+      "io.sentry.cache.tape",
       "io.sentry.clientreport",
       "io.sentry.config",
       "io.sentry.exception",
+      "io.sentry.featureflags",
       "io.sentry.hints",
       "io.sentry.instrumentation.file",
+      "io.sentry.internal",
       "io.sentry.internal.debugmeta",
+      "io.sentry.internal.eventprocessor",
       "io.sentry.internal.gestures",
       "io.sentry.internal.modules",
       "io.sentry.internal.viewhierarchy",
+      "io.sentry.logger",
       "io.sentry.metrics",
+      "io.sentry.opentelemetry",
       "io.sentry.profilemeasurements",
+      "io.sentry.profiling",
       "io.sentry.protocol",
+      "io.sentry.protocol.profiling",
       "io.sentry.rrweb",
       "io.sentry.transport",
       "io.sentry.util",
+      "io.sentry.util.network",
+      "io.sentry.util.runtime",
       "io.sentry.util.thread",
       "io.sentry.vendor",
       "io.sentry.vendor.gson.internal.bind.util",
@@ -2147,6 +2170,7 @@
     ],
     "software.amazon.awssdk:aws-core": [
       "software.amazon.awssdk.awscore",
+      "software.amazon.awssdk.awscore.auth",
       "software.amazon.awssdk.awscore.client.builder",
       "software.amazon.awssdk.awscore.client.config",
       "software.amazon.awssdk.awscore.client.handler",
@@ -2158,11 +2182,13 @@
       "software.amazon.awssdk.awscore.exception",
       "software.amazon.awssdk.awscore.interceptor",
       "software.amazon.awssdk.awscore.internal",
+      "software.amazon.awssdk.awscore.internal.auth",
       "software.amazon.awssdk.awscore.internal.authcontext",
       "software.amazon.awssdk.awscore.internal.client.config",
       "software.amazon.awssdk.awscore.internal.defaultsmode",
       "software.amazon.awssdk.awscore.internal.interceptor",
       "software.amazon.awssdk.awscore.internal.token",
+      "software.amazon.awssdk.awscore.internal.useragent",
       "software.amazon.awssdk.awscore.presigner",
       "software.amazon.awssdk.awscore.retry",
       "software.amazon.awssdk.awscore.retry.conditions",
@@ -2180,7 +2206,8 @@
       "software.amazon.awssdk.protocols.xml.internal.unmarshall"
     ],
     "software.amazon.awssdk:checksums": [
-      "software.amazon.awssdk.checksums"
+      "software.amazon.awssdk.checksums",
+      "software.amazon.awssdk.checksums.internal"
     ],
     "software.amazon.awssdk:checksums-spi": [
       "software.amazon.awssdk.checksums.spi"
@@ -2340,7 +2367,7 @@
       "software.amazon.awssdk.core.internal",
       "software.amazon.awssdk.core.internal.async",
       "software.amazon.awssdk.core.internal.capacity",
-      "software.amazon.awssdk.core.internal.checksums.factory",
+      "software.amazon.awssdk.core.internal.checksums",
       "software.amazon.awssdk.core.internal.chunked",
       "software.amazon.awssdk.core.internal.compression",
       "software.amazon.awssdk.core.internal.handler",
@@ -2376,6 +2403,7 @@
       "software.amazon.awssdk.core.signer",
       "software.amazon.awssdk.core.sync",
       "software.amazon.awssdk.core.traits",
+      "software.amazon.awssdk.core.useragent",
       "software.amazon.awssdk.core.util",
       "software.amazon.awssdk.core.waiters"
     ],
@@ -2386,8 +2414,8 @@
       "software.amazon.awssdk.thirdparty.jackson.core.exc",
       "software.amazon.awssdk.thirdparty.jackson.core.filter",
       "software.amazon.awssdk.thirdparty.jackson.core.format",
+      "software.amazon.awssdk.thirdparty.jackson.core.internal.shaded.fdp.v2_18_5",
       "software.amazon.awssdk.thirdparty.jackson.core.io",
-      "software.amazon.awssdk.thirdparty.jackson.core.io.doubleparser",
       "software.amazon.awssdk.thirdparty.jackson.core.io.schubfach",
       "software.amazon.awssdk.thirdparty.jackson.core.json",
       "software.amazon.awssdk.thirdparty.jackson.core.json.async",
@@ -2400,11 +2428,18 @@
       "software.amazon.awssdk.utils.async",
       "software.amazon.awssdk.utils.builder",
       "software.amazon.awssdk.utils.cache",
+      "software.amazon.awssdk.utils.cache.bounded",
       "software.amazon.awssdk.utils.cache.lru",
       "software.amazon.awssdk.utils.http",
       "software.amazon.awssdk.utils.internal",
       "software.amazon.awssdk.utils.internal.async",
-      "software.amazon.awssdk.utils.internal.proxy"
+      "software.amazon.awssdk.utils.internal.proxy",
+      "software.amazon.awssdk.utils.io",
+      "software.amazon.awssdk.utils.uri",
+      "software.amazon.awssdk.utils.uri.internal"
+    ],
+    "software.amazon.awssdk:utils-lite": [
+      "software.amazon.awssdk.utilslite"
     ],
     "software.amazon.eventstream:eventstream": [
       "software.amazon.eventstream"
@@ -2541,6 +2576,7 @@
       "software.amazon.awssdk:sdk-core",
       "software.amazon.awssdk:third-party-jackson-core",
       "software.amazon.awssdk:utils",
+      "software.amazon.awssdk:utils-lite",
       "software.amazon.eventstream:eventstream"
     ]
   },

nginx/nginx.conf

@@ -3,6 +3,9 @@ events {
 }
 
 http {
+    # Allow large request bodies for game uploads (default is 1MB)
+    client_max_body_size 50M;
+
     # Logging
     log_format grpc_json escape=json '{'
         '"time":"$time_iso8601",'
@@ -24,19 +27,19 @@ http {
     # This prevents stale IP caching when containers restart
     resolver 127.0.0.11 valid=10s ipv6=off;
 
-    # Upstream for Eagle gRPC server
-    # For blue-green deployments, this is switched between eagle-blue:40032 and eagle-green:40032
-    # by scripts/deploy-blue-green.sh, then nginx is reloaded with 'nginx -s reload'
-    upstream eagle_grpc {
-        server eagle-blue:40032;
-        keepalive 100;
+    # Eagle backend - blue-green deployment with variable-based routing
+    # Uses a variable so nginx only resolves the configured backend (not all backends).
+    # This allows nginx to start/reload even when the inactive backend is stopped.
+    # The deploy script updates this map, then recreates nginx.
+    map $host $eagle_backend {
+        default "eagle-blue:40032";
     }
 
     # HTTP server for Let's Encrypt challenge and redirect
     server {
         listen 80;
         listen [::]:80;
-        server_name prod.eagle0.net;
+        server_name prod.eagle0.net eagle0.net;
 
         # Let's Encrypt challenge
         location /.well-known/acme-challenge/ {
@@ -54,7 +57,7 @@ http {
         listen 443 ssl;
         listen [::]:443 ssl;
         http2 on;
-        server_name prod.eagle0.net;
+        server_name prod.eagle0.net eagle0.net;
 
         # SSL certificates (managed by certbot)
         ssl_certificate /etc/letsencrypt/live/prod.eagle0.net/fullchain.pem;
@@ -73,8 +76,8 @@ http {
             # Rate limiting
             limit_req zone=grpc_limit burst=50 nodelay;
 
-            # gRPC proxy
-            grpc_pass grpc://eagle_grpc;
+            # gRPC proxy - uses variable for blue-green deployment
+            grpc_pass grpc://$eagle_backend;
 
             # Timeouts for long-running streams
             grpc_read_timeout 1200s;
@@ -85,13 +88,14 @@ http {
             error_page 502 = /error502grpc;
         }
 
-        # gRPC proxy for Auth service
+        # gRPC proxy for Auth service (routes to Go auth service, not Eagle)
         location /net.eagle0.eagle.api.auth.Auth {
             # Rate limiting
             limit_req zone=grpc_limit burst=50 nodelay;
 
-            # gRPC proxy
-            grpc_pass grpc://eagle_grpc;
+            # Route to auth service directly (not through Eagle)
+            set $auth_backend "auth:40033";
+            grpc_pass grpc://$auth_backend;
 
             # Timeouts
             grpc_read_timeout 30s;
@@ -108,6 +112,20 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
         }
 
+        # Apple OAuth callback (Apple uses POST with form_post response mode)
+        location /oauth/apple/callback {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # Steam OAuth callback (Steam uses OpenID 2.0)
+        location /oauth/steam/callback {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
         # Invitation landing page (proxied to Go auth service)
         location /invite/ {
             proxy_pass http://auth:8080;
@@ -115,6 +133,13 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
         }
 
+        # Credits/attributions page (proxied to Go auth service)
+        location /credits {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
         # Health check endpoint
         location /health {
             access_log off;
@@ -244,4 +269,44 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
     }
+
+    # HTTP server for Accounts Console (Let's Encrypt + redirect)
+    server {
+        listen 80;
+        listen [::]:80;
+        server_name accounts.prod.eagle0.net accounts.eagle0.net;
+
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    # HTTPS server for Accounts Console (user self-service portal)
+    server {
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        server_name accounts.prod.eagle0.net accounts.eagle0.net;
+
+        ssl_certificate /etc/letsencrypt/live/accounts.eagle0.net/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/accounts.eagle0.net/privkey.pem;
+
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+        ssl_prefer_server_ciphers off;
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_tickets off;
+
+        location / {
+            proxy_pass http://admin:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
 }

scripts/build_mac_plugin.sh

@@ -8,3 +8,6 @@ ZIP_LOCATION=$(bazel cquery --config=mactools --output=files @net_eagle0_unity_g
 /usr/bin/unzip -o $ZIP_LOCATION -d src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/
 
 /usr/bin/plutil -convert xml1 src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/DarwinGodiceBundle.bundle/Contents/Info.plist
+
+/bin/echo "building sparkle plugin"
+./scripts/build_sparkle_plugin.sh

scripts/build_sparkle_plugin.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# Build the SparklePlugin native library for Unity using Bazel
+#
+# Usage: build_sparkle_plugin.sh [output_dir]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+OUTPUT_DIR="${1:-$PROJECT_ROOT/src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/macOS}"
+
+echo "=== Building SparklePlugin with Bazel ==="
+
+bazel build --config=mactools //src/main/objc/net/eagle0/sparkle:SparklePlugin
+
+# Get the zip path from bazel
+ZIP_PATH=$(bazel cquery --config=mactools --output=files //src/main/objc/net/eagle0/sparkle:SparklePlugin 2>/dev/null)
+
+echo "=== Extracting SparklePlugin.bundle ==="
+mkdir -p "$OUTPUT_DIR"
+rm -rf "$OUTPUT_DIR/SparklePlugin.bundle"
+unzip -o "$ZIP_PATH" -d "$OUTPUT_DIR/"
+
+# Convert Info.plist from binary to XML format (Unity requires XML)
+/usr/bin/plutil -convert xml1 "$OUTPUT_DIR/SparklePlugin.bundle/Contents/Info.plist"
+
+echo "=== SparklePlugin built successfully ==="
+ls -la "$OUTPUT_DIR/SparklePlugin.bundle/"

scripts/check_build_deps.sh

@@ -0,0 +1,129 @@
+#!/bin/bash
+# Check BUILD.bazel dependency constraints
+# This script enforces architectural boundaries in the codebase.
+#
+# Usage:
+#   ./scripts/check_build_deps.sh           # Check all rules
+#   ./scripts/check_build_deps.sh --ci      # CI mode (fail on any violation)
+#   ./scripts/check_build_deps.sh --count   # Just count current violations (for tracking progress)
+#   ./scripts/check_build_deps.sh --strict  # Same as --ci (strict enforcement)
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+MODE="${1:-check}"
+EXIT_CODE=0
+
+# Rule 1: src/main should not depend on src/test
+check_main_depends_on_test() {
+    echo -e "${YELLOW}Checking: src/main should not depend on src/test...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/...) intersect //src/test/...' 2>/dev/null || true)
+
+    if [ -n "$violations" ]; then
+        echo -e "${RED}VIOLATION: src/main depends on src/test:${NC}"
+        echo "$violations"
+        return 1
+    else
+        echo -e "${GREEN}✓ No violations${NC}"
+        return 0
+    fi
+}
+
+# Rule 2: library/ should not depend on Scala proto types
+# C++/Go proto deps are allowed (they're build-time deps for map generation tools)
+check_library_depends_on_scala_proto() {
+    echo -e "${YELLOW}Checking: library/ should not depend on Scala proto types...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep "_scala_proto" || true)
+    if [ -z "$violations" ]; then
+        count=0
+    else
+        count=$(echo "$violations" | grep -c "^//" || true)
+    fi
+
+    if [ "$count" -gt 0 ]; then
+        echo -e "${RED}VIOLATION: Found $count Scala proto dependencies in library/:${NC}"
+        echo "$violations"
+        return 1
+    else
+        echo -e "${GREEN}✓ No Scala proto dependencies in library/${NC}"
+        return 0
+    fi
+}
+
+# Rule 3: library/ should not depend on proto_converters
+# Proto conversions should happen at service boundaries, not in library code
+check_library_depends_on_proto_converters() {
+    echo -e "${YELLOW}Checking: library/ should not depend on proto_converters...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/scala/net/eagle0/eagle/model/proto_converters/...' 2>/dev/null | grep "^//" || true)
+
+    if [ -n "$violations" ]; then
+        count=$(echo "$violations" | wc -l | tr -d ' ')
+        echo -e "${RED}VIOLATION: library/ depends on $count proto_converters targets:${NC}"
+        echo "$violations"
+        echo ""
+        echo "Proto conversions should happen at service boundaries (ShardokInterfaceGrpcClient,"
+        echo "EagleServiceImpl, etc.), not in library code."
+        return 1
+    else
+        echo -e "${GREEN}✓ No proto_converters dependencies in library/${NC}"
+        return 0
+    fi
+}
+
+# Count proto deps for informational purposes
+count_proto_deps() {
+    echo -e "${YELLOW}=== Proto dependency counts ===${NC}"
+
+    scala_proto_results=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep "_scala_proto" || true)
+    if [ -z "$scala_proto_results" ]; then
+        scala_proto_count=0
+    else
+        scala_proto_count=$(echo "$scala_proto_results" | wc -l | tr -d ' ')
+    fi
+    echo "library/ Scala proto deps: $scala_proto_count"
+
+    # C++/Go proto deps are expected (map generation tools)
+    all_proto_count=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | wc -l | tr -d ' ')
+    echo "library/ all proto deps (includes C++/Go build tools): $all_proto_count"
+}
+
+echo "=== BUILD.bazel Dependency Check ==="
+echo ""
+
+case "$MODE" in
+    --count)
+        count_proto_deps
+        ;;
+    --ci|--strict)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_library_depends_on_scala_proto || EXIT_CODE=1
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        ;;
+    *)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_library_depends_on_scala_proto || EXIT_CODE=1
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        echo ""
+        count_proto_deps
+        ;;
+esac
+
+echo ""
+if [ $EXIT_CODE -eq 0 ]; then
+    echo -e "${GREEN}=== All checks passed ===${NC}"
+else
+    echo -e "${RED}=== Some checks failed ===${NC}"
+fi
+
+exit $EXIT_CODE

scripts/codesign_mac_app.sh

@@ -5,24 +5,58 @@
 #
 # Environment variables:
 #   SIGNING_IDENTITY - The signing identity (default: "Developer ID Application")
-#   KEYCHAIN_PASSWORD - Password to unlock the build keychain (optional)
+#   KEYCHAIN_PASSWORD - Password to unlock the keychain (optional, CI only)
+#   KEYCHAIN_NAME - Name of the keychain containing the signing certificate (optional, CI only)
+#                   When set, looks for certificate in this specific keychain.
+#                   When not set, searches all keychains (local dev mode).
 
 set -euxo pipefail
 
 APP_PATH="$1"
 ENTITLEMENTS_PATH="${2:-}"
 SIGNING_IDENTITY="${SIGNING_IDENTITY:-Developer ID Application}"
+# KEYCHAIN_NAME is set by CI workflow - don't set a default here so we can detect if we're in CI
 
 if [ ! -d "$APP_PATH" ]; then
     echo "ERROR: App not found at $APP_PATH"
     exit 1
 fi
 
-# Unlock keychain if password provided
-if [ -n "${KEYCHAIN_PASSWORD:-}" ]; then
-    security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain || true
+# Unlock keychain if password and keychain name are provided (CI environment)
+if [ -n "${KEYCHAIN_PASSWORD:-}" ] && [ -n "${KEYCHAIN_NAME:-}" ]; then
+    security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME" || true
 fi
 
+# Get the SHA-1 hash of the signing certificate
+# Using the hash avoids "ambiguous" errors when the same identity exists in multiple keychains
+# We look in the build keychain specifically if KEYCHAIN_NAME is set (CI environment)
+# Otherwise fall back to searching all keychains (local dev)
+
+if [ -n "${KEYCHAIN_NAME:-}" ]; then
+    # CI environment: look for certificate in the build keychain specifically
+    KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db"
+    echo "Looking for signing identity in build keychain: $KEYCHAIN_PATH"
+    echo "Available identities in build keychain:"
+    security find-identity -v -p codesigning "$KEYCHAIN_PATH"
+
+    CERT_HASH=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | grep -E '^\s+[0-9]+\)' | head -1 | awk '{print $2}')
+else
+    # Local dev: search all keychains
+    echo "Available codesigning identities:"
+    security find-identity -v -p codesigning
+
+    CERT_HASH=$(security find-identity -v -p codesigning | grep -E '^\s+[0-9]+\)' | head -1 | awk '{print $2}')
+fi
+
+if [ -z "$CERT_HASH" ]; then
+    echo "ERROR: No valid signing identity found"
+    exit 1
+fi
+echo "Using certificate hash: $CERT_HASH"
+
+# Use the hash as the signing identity to avoid ambiguity
+SIGNING_IDENTITY="$CERT_HASH"
+
 echo "=== Signing nested components first ==="
 
 # Sign all dylibs
@@ -39,32 +73,51 @@ find "$APP_PATH" -name "*.bundle" -print0 | while IFS= read -r -d '' item; do
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign XPC services (inside Sparkle framework)
+# Sign XPC services (but skip ones inside Sparkle.framework - they're already signed)
 find "$APP_PATH" -name "*.xpc" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle XPC service (pre-signed): $item"
+        continue
+    fi
     echo "Signing XPC service: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign nested apps (like Sparkle's Updater.app)
+# Sign nested apps (but skip ones inside Sparkle.framework - they're already signed)
 find "$APP_PATH" -path "*/Frameworks/*.app" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle nested app (pre-signed): $item"
+        continue
+    fi
     echo "Signing nested app: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign standalone executables inside frameworks (like Autoupdate)
+# Sign standalone executables inside frameworks (but skip Sparkle.framework internals)
 find "$APP_PATH" -path "*/Frameworks/*/Versions/*/Autoupdate" -type f -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle executable (pre-signed): $item"
+        continue
+    fi
     echo "Signing executable: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
 # Sign all frameworks (after their contents are signed)
+# Use --deep for Sparkle.framework to handle its XPC services
 find "$APP_PATH" -name "*.framework" -print0 | while IFS= read -r -d '' item; do
-    echo "Signing framework: $item"
-    codesign --force --verify --verbose --timestamp --options runtime \
-        --sign "$SIGNING_IDENTITY" "$item"
+    if [[ "$item" == *"Sparkle.framework" ]]; then
+        echo "Signing Sparkle framework with --deep: $item"
+        codesign --deep --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    else
+        echo "Signing framework: $item"
+        codesign --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    fi
 done
 
 echo "=== Signing main app bundle ==="

scripts/deploy-blue-green.sh

@@ -2,14 +2,21 @@
 #
 # Blue-Green Deployment Script for Eagle Server
 #
-# This script performs a zero-downtime deployment by:
-# 1. Starting the new version on a staging port (green)
-# 2. Waiting for it to become healthy
-# 3. Running warmup traffic to pre-heat the JIT
-# 4. Stopping the old version (blue) - which flushes state to disk
-# 5. Telling green to reload games from disk
-# 6. Switching nginx to route traffic to green
-# 7. Cleaning up
+# This script performs a zero-downtime deployment with state consistency:
+# 1. Create .deployment_in_progress marker (signals deployment started)
+# 2. Start the staging instance (green) with new image
+# 3. Run warmup/smoke tests against staging (warms JIT)
+# 4. Switch nginx to staging (zero downtime - users immediately route to staging)
+# 5. Stop the active instance (blue) - blocks until flush completes
+# 6. Create .flush_complete marker (signals disk state is fresh)
+#
+# The flush marker coordination ensures green never serves stale game data:
+# - When users reconnect to green and trigger lazy-load, the code checks for markers
+# - If .deployment_in_progress exists, lazy-load WAITS for .flush_complete
+# - Once blue's flush completes and marker is created, lazy-load proceeds with fresh data
+#
+# Key insight: nginx switches to green BEFORE blue stops, achieving zero downtime.
+# Users who trigger lazy-load during blue's shutdown will wait for the flush marker.
 #
 # Usage: ./deploy-blue-green.sh [NEW_IMAGE_TAG]
 #
@@ -25,6 +32,10 @@ APP_DIR="${APP_DIR:-/opt/eagle0}"
 NGINX_CONF="${APP_DIR}/nginx/nginx.conf"
 COMPOSE_FILE="${APP_DIR}/docker-compose.prod.yml"
 WARMUP_SCRIPT="${SCRIPT_DIR}/warmup-eagle.sh"
+SAVES_DIR="${APP_DIR}/saves"
+FLUSH_MARKER="${SAVES_DIR}/.flush_complete"
+DEPLOYMENT_IN_PROGRESS="${SAVES_DIR}/.deployment_in_progress"
+ACTIVE_INSTANCE_FILE="${APP_DIR}/.active-instance"
 
 # Colors for output
 RED='\033[0;31m'
@@ -36,15 +47,57 @@ log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 
-# Determine which instance is currently active
-get_active_instance() {
-    if grep -q "eagle-blue:40032" "${NGINX_CONF}"; then
+# Marker file operations use docker exec because saves directory is owned by root (Docker).
+# We run commands inside a container that has the saves directory mounted.
+create_deployment_marker() {
+    local deploy_id=$1
+    local container=$2  # Container to use for file operations
+    docker exec "${container}" rm -f /app/saves/.flush_complete
+    docker exec "${container}" sh -c "echo '${deploy_id}' > /app/saves/.deployment_in_progress"
+}
+
+create_flush_marker() {
+    local deploy_id=$1
+    local container=$2  # Container to use for file operations
+    docker exec "${container}" sh -c "echo '${deploy_id}' > /app/saves/.flush_complete"
+    docker exec "${container}" rm -f /app/saves/.deployment_in_progress
+}
+
+cleanup_markers_on_failure() {
+    local container=$1  # Container to use for file operations
+    docker exec "${container}" rm -f /app/saves/.deployment_in_progress 2>/dev/null || true
+    docker exec "${container}" touch /app/saves/.flush_complete 2>/dev/null || true
+}
+
+remove_stale_deployment_marker() {
+    # Try any running eagle container
+    local container
+    container=$(docker ps --filter "name=eagle-" --format "{{.Names}}" | head -1)
+    if [ -n "${container}" ]; then
+        docker exec "${container}" rm -f /app/saves/.deployment_in_progress 2>/dev/null || true
+    fi
+}
+
+# Determine which instance is currently running (not from nginx config)
+get_running_instance() {
+    local blue_running green_running
+    blue_running=$(docker inspect --format='{{.State.Running}}' eagle-blue 2>/dev/null || echo "false")
+    green_running=$(docker inspect --format='{{.State.Running}}' eagle-green 2>/dev/null || echo "false")
+
+    if [ "$blue_running" = "true" ] && [ "$green_running" = "true" ]; then
+        # Both running - use nginx config to determine primary
+        if grep -q "server eagle-blue:40032;" "${NGINX_CONF}" | head -1 | grep -qv backup; then
+            echo "blue"
+        else
+            echo "green"
+        fi
+    elif [ "$blue_running" = "true" ]; then
         echo "blue"
-    elif grep -q "eagle-green:40032" "${NGINX_CONF}"; then
+    elif [ "$green_running" = "true" ]; then
         echo "green"
     else
-        log_error "Cannot determine active instance from nginx config"
-        exit 1
+        # Neither running - default to blue (first deploy or recovery)
+        echo "none"
     fi
 }
 
@@ -54,6 +107,12 @@ pull_with_retry() {
     local max_attempts=${2:-3}
     local attempt=1
 
+    # Skip pull if image already exists locally (e.g., CI already pulled it)
+    if docker image inspect "${image}" &>/dev/null; then
+        log_info "Image ${image} already exists locally, skipping pull"
+        return 0
+    fi
+
     # Use crane if available (handles OCI format correctly)
     if [ -x "${APP_DIR}/crane" ]; then
         while [ $attempt -le $max_attempts ]; do
@@ -114,46 +173,63 @@ main() {
     local registry="registry.digitalocean.com/eagle0/eagle-server"
     local new_image="${registry}:${new_tag}"
 
+    # Generate deployment ID for log correlation with server logs
+    local deploy_id
+    deploy_id=$(date +%s)
+    local deploy_start_time=$deploy_id
+
+    log_info "========================================="
     log_info "Starting blue-green deployment"
+    log_info "Deployment ID: ${deploy_id}"
     log_info "New image: ${new_image}"
+    log_info "========================================="
 
     cd "${APP_DIR}"
 
-    # Determine current active instance
-    local active=$(get_active_instance)
+    # Determine current active instance (need this before creating marker)
+    local active=$(get_running_instance)
     local staging
-    if [ "$active" = "blue" ]; then
+    if [ "$active" = "blue" ] || [ "$active" = "none" ]; then
         staging="green"
+        active="blue"  # Normalize "none" to "blue" for first deploy
     else
         staging="blue"
     fi
 
-    log_info "Active instance: eagle-${active}"
-    log_info "Staging instance: eagle-${staging}"
+    # Step 1: Signal deployment in progress
+    log_info "[DEPLOY:${deploy_id}] Step 1: Signaling deployment in progress..."
+    # Use active container for marker operations (it's the one currently running)
+    if [ "$active" != "none" ] && docker ps --filter "name=eagle-${active}" --format "{{.Names}}" | grep -q .; then
+        create_deployment_marker "${deploy_id}" "eagle-${active}"
+        log_info "[DEPLOY:${deploy_id}] Deployment marker created via eagle-${active}"
+    else
+        log_warn "[DEPLOY:${deploy_id}] No running container to create marker (first deploy?)"
+    fi
 
     # Pull the new image (with retry for intermittent registry issues)
     if ! pull_with_retry "${new_image}" 3; then
         log_error "Failed to pull new image, aborting deployment"
+        cleanup_markers_on_failure "eagle-${active}"
         exit 1
     fi
 
-    # Start staging instance with new image
-    log_info "Starting eagle-${staging} with new image..."
+    # Step 2: Start staging instance with new image
+    log_info "Step 2: Starting eagle-${staging} with new image..."
     if [ "$staging" = "green" ]; then
-        EAGLE_IMAGE_NEW="${new_image}" docker compose -f "${COMPOSE_FILE}" --profile blue-green up -d eagle-green
+        EAGLE_IMAGE_NEW="${new_image}" docker compose -f "${COMPOSE_FILE}" --profile blue-green up -d eagle-green jfr-sidecar-green
     else
-        EAGLE_IMAGE="${new_image}" docker compose -f "${COMPOSE_FILE}" up -d eagle-blue
+        EAGLE_IMAGE="${new_image}" docker compose -f "${COMPOSE_FILE}" up -d eagle-blue jfr-sidecar
     fi
 
     # Wait for staging to be healthy
     if ! wait_for_healthy "eagle-${staging}" 90; then
         log_error "Staging instance failed health check, aborting deployment"
         docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
-        docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${staging}"
+        cleanup_markers_on_failure "eagle-${active}"
         exit 1
     fi
 
-    # Run warmup/smoke test
+    # Step 3: Run warmup/smoke test
     local staging_port
     if [ "$staging" = "green" ]; then
         staging_port=40034
@@ -161,12 +237,12 @@ main() {
         staging_port=40032
     fi
 
-    log_info "Running warmup against eagle-${staging}..."
+    log_info "Step 3: Running warmup against eagle-${staging}..."
     if [ -x "${WARMUP_SCRIPT}" ]; then
         if ! "${WARMUP_SCRIPT}" "localhost:${staging_port}"; then
             log_error "Warmup/smoke test failed, aborting deployment"
             docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
-            docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${staging}"
+            cleanup_markers_on_failure "eagle-${active}"
             exit 1
         fi
     else
@@ -174,49 +250,116 @@ main() {
         log_warn "JIT will be cold on first requests"
     fi
 
-    # Stop the active instance (this flushes state to disk)
-    log_info "Stopping eagle-${active} (flushing state to disk)..."
-    docker compose -f "${COMPOSE_FILE}" stop "eagle-${active}"
+    # Step 4: Switch nginx to staging BEFORE stopping active
+    # This achieves zero downtime - users immediately route to staging.
+    # Any lazy-loads will wait for the flush marker (created in step 6).
+    local nginx_switch_start
+    nginx_switch_start=$(date +%s)
+    log_info "[DEPLOY:${deploy_id}] Step 4: Switching nginx to eagle-${staging}..."
 
-    # Tell staging to reload games from disk
-    log_info "Telling eagle-${staging} to reload games from disk..."
-    if command -v grpcurl &> /dev/null; then
-        grpcurl -plaintext -d '{}' "localhost:${staging_port}" net.eagle0.eagle.api.Eagle/ReloadGames || true
-    else
-        log_warn "grpcurl not installed, skipping game reload"
-        log_warn "New instance will use games loaded at startup"
-    fi
-
-    # Switch nginx upstream
-    log_info "Switching nginx upstream to eagle-${staging}..."
+    # Update nginx config (variable-based routing)
     if [ "$staging" = "green" ]; then
         sed -i.bak 's/eagle-blue:40032/eagle-green:40032/g' "${NGINX_CONF}"
     else
         sed -i.bak 's/eagle-green:40032/eagle-blue:40032/g' "${NGINX_CONF}"
     fi
 
-    # Reload nginx
-    log_info "Reloading nginx..."
-    docker compose -f "${COMPOSE_FILE}" exec nginx nginx -s reload
+    # Recreate nginx to pick up new config
+    # Use --no-deps to prevent cascading to auth (which has secrets not available here)
+    docker compose -f "${COMPOSE_FILE}" up -d --force-recreate --no-deps nginx
 
-    # Clean up old instance
-    log_info "Removing old eagle-${active} container..."
-    docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${active}"
-
-    # Update the staging instance's restart policy and image var
-    # For blue, we need to update EAGLE_IMAGE; for green, update EAGLE_IMAGE_NEW
-    if [ "$staging" = "blue" ]; then
-        log_info "Updating EAGLE_IMAGE to ${new_image} for future restarts"
-        # User should update their .env file
+    # Verify nginx picked up the correct config
+    local nginx_backend
+    nginx_backend=$(docker exec nginx grep -o 'eagle-[a-z]*:40032' /etc/nginx/nginx.conf | head -1 || echo "unknown")
+    if [ "$nginx_backend" = "eagle-${staging}:40032" ]; then
+        log_info "[DEPLOY:${deploy_id}] Verified: nginx routing to eagle-${staging}"
     else
-        log_info "Green is now active. Consider switching to blue on next deployment."
+        log_error "[DEPLOY:${deploy_id}] nginx config mismatch! Expected eagle-${staging}:40032, got ${nginx_backend}"
+        exit 1
+    fi
+    log_info "[DEPLOY:${deploy_id}] Traffic switched to eagle-${staging} (lazy-loads will wait for flush marker)"
+    local nginx_switch_end
+    nginx_switch_end=$(date +%s)
+
+    # Step 5: Stop active instance (blocks until exit, ensuring flush completes)
+    # Users may be lazy-loading on staging during this time - they'll wait for the marker.
+    local flush_start
+    flush_start=$(date +%s)
+    log_info "[DEPLOY:${deploy_id}] Step 5: Stopping eagle-${active} (waiting for flush)..."
+    docker compose -f "${COMPOSE_FILE}" stop "eagle-${active}"
+    local flush_end
+    flush_end=$(date +%s)
+    local flush_duration=$((flush_end - flush_start))
+    log_info "[DEPLOY:${deploy_id}] eagle-${active} stopped, flush completed in ${flush_duration}s"
+
+    # Step 6: Create flush marker - signals that disk state is fresh
+    # Any waiting lazy-loads on staging will now proceed with fresh data.
+    # The Eagle server automatically detects the flush marker update and invalidates any stale cached games.
+    log_info "[DEPLOY:${deploy_id}] Step 6: Creating flush marker..."
+    create_flush_marker "${deploy_id}" "eagle-${staging}"
+    log_info "[DEPLOY:${deploy_id}] Flush marker created - server will auto-invalidate stale cache"
+
+    # Write active instance file for eagle-exec helper
+    echo "eagle-${staging}" > "${ACTIVE_INSTANCE_FILE}"
+    log_info "[DEPLOY:${deploy_id}] Active instance file updated: eagle-${staging}"
+
+    # Update .env for admin service
+    local env_file="${APP_DIR}/.env"
+    if [ "$staging" = "green" ]; then
+        log_info "Updating .env for green instance..."
+        sed -i.bak '/^EAGLE_ADDR=/d; /^JFR_SIDECAR_ADDR=/d' "${env_file}" 2>/dev/null || true
+        echo "EAGLE_ADDR=eagle-green:40032" >> "${env_file}"
+        echo "JFR_SIDECAR_ADDR=jfr-sidecar-green:8081" >> "${env_file}"
+    else
+        log_info "Updating .env for blue instance..."
+        sed -i.bak '/^EAGLE_ADDR=/d; /^JFR_SIDECAR_ADDR=/d' "${env_file}" 2>/dev/null || true
+        echo "EAGLE_ADDR=eagle-blue:40032" >> "${env_file}"
+        echo "JFR_SIDECAR_ADDR=jfr-sidecar:8081" >> "${env_file}"
     fi
 
-    log_info "Deployment complete!"
-    log_info "Active instance: eagle-${staging}"
+    # Restart admin to pick up new .env and ensure latest image
+    # Use --no-deps to prevent cascading to auth (which has secrets not available here)
+    log_info "Restarting admin service..."
+    docker compose -f "${COMPOSE_FILE}" up -d --force-recreate --no-deps admin
+
+    # Verify admin container is running
+    sleep 3
+    if ! docker inspect admin-server --format '{{.State.Running}}' 2>/dev/null | grep -q "true"; then
+        log_error "Admin container failed to start!"
+        log_error "Container logs:"
+        docker logs admin-server --tail 20 2>&1 || true
+        log_error "Container inspect:"
+        docker inspect admin-server 2>&1 | head -50 || true
+        exit 1
+    fi
+    log_info "Admin service restarted successfully"
+
+    # Clean up old instance
+    log_info "Cleaning up old eagle-${active}..."
+    docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${active}" 2>/dev/null || true
+
+    # Stop the old jfr-sidecar (it can't attach to removed container anyway)
+    if [ "$active" = "green" ]; then
+        docker compose -f "${COMPOSE_FILE}" stop "jfr-sidecar-green" 2>/dev/null || true
+        docker compose -f "${COMPOSE_FILE}" rm -f "jfr-sidecar-green" 2>/dev/null || true
+    else
+        docker compose -f "${COMPOSE_FILE}" stop "jfr-sidecar" 2>/dev/null || true
+        docker compose -f "${COMPOSE_FILE}" rm -f "jfr-sidecar" 2>/dev/null || true
+    fi
+
+    local deploy_end_time
+    deploy_end_time=$(date +%s)
+    local total_duration=$((deploy_end_time - deploy_start_time))
+    local user_wait_window=$((flush_end - nginx_switch_end))
+
     log_info ""
-    log_info "Note: Update your .env file with EAGLE_IMAGE=${new_image}"
-    log_info "      if you want future 'docker compose up' to use this version."
+    log_info "========================================="
+    log_info "[DEPLOY:${deploy_id}] Deployment complete!"
+    log_info "  Active instance: eagle-${staging}"
+    log_info "  Total duration: ${total_duration}s"
+    log_info "  Flush duration: ${flush_duration}s"
+    log_info "  Max user wait window: ${user_wait_window}s"
+    log_info "========================================="
 }
 
 # Check for required tools
@@ -240,6 +383,18 @@ check_requirements() {
         log_error "docker-compose file not found at ${COMPOSE_FILE}"
         exit 1
     fi
+
+    # Ensure saves directory exists
+    if [ ! -d "${SAVES_DIR}" ]; then
+        log_info "Creating saves directory at ${SAVES_DIR}"
+        mkdir -p "${SAVES_DIR}"
+    fi
+
+    # Clean up any stale deployment-in-progress marker from a previous failed deploy
+    if [ -f "${DEPLOYMENT_IN_PROGRESS}" ]; then
+        log_warn "Found stale deployment-in-progress marker, removing it"
+        remove_stale_deployment_marker
+    fi
 }
 
 # Run

scripts/eagle-exec.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# Helper to run docker exec against the active Eagle instance.
+# Reads the active instance from /opt/eagle0/.active-instance (set by deploy-blue-green.sh).
+#
+# Usage:
+#   eagle-exec printenv GEMINI_API_KEY
+#   eagle-exec jcmd 1 VM.flags
+#   eagle-exec sh    # Get a shell
+#
+# To create an alias, add to ~/.bashrc:
+#   alias eagle-exec='/opt/eagle0/scripts/eagle-exec.sh'
+#
+
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-/opt/eagle0}"
+ACTIVE_FILE="${APP_DIR}/.active-instance"
+
+# Read active instance from file, with fallback
+if [ -f "$ACTIVE_FILE" ]; then
+    ACTIVE=$(cat "$ACTIVE_FILE")
+else
+    # Fallback: check which container is actually running
+    if docker inspect --format='{{.State.Running}}' eagle-blue 2>/dev/null | grep -q true; then
+        ACTIVE="eagle-blue"
+    elif docker inspect --format='{{.State.Running}}' eagle-green 2>/dev/null | grep -q true; then
+        ACTIVE="eagle-green"
+    else
+        ACTIVE=""
+    fi
+fi
+
+if [ -z "$ACTIVE" ]; then
+    echo "Error: No active Eagle instance found" >&2
+    exit 1
+fi
+
+if [ $# -eq 0 ]; then
+    echo "Active instance: $ACTIVE"
+    echo "Usage: $0 <command> [args...]"
+    echo "Example: $0 printenv GEMINI_API_KEY"
+    exit 0
+fi
+
+exec docker exec "$ACTIVE" "$@"

scripts/eagle-logs.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+#
+# Helper to tail logs from the active Eagle instance.
+# Reads the active instance from /opt/eagle0/.active-instance (set by deploy-blue-green.sh).
+#
+# Usage:
+#   eagle-logs           # Tail logs (follow mode)
+#   eagle-logs -n 100    # Show last 100 lines and follow
+#   eagle-logs --no-follow -n 50   # Show last 50 lines without following
+#
+# To create an alias, add to ~/.bashrc:
+#   alias eagle-logs='/opt/eagle0/scripts/eagle-logs.sh'
+#
+
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-/opt/eagle0}"
+ACTIVE_FILE="${APP_DIR}/.active-instance"
+
+# Read active instance from file, with fallback
+if [ -f "$ACTIVE_FILE" ]; then
+    ACTIVE=$(cat "$ACTIVE_FILE")
+else
+    # Fallback: check which container is actually running
+    if docker inspect --format='{{.State.Running}}' eagle-blue 2>/dev/null | grep -q true; then
+        ACTIVE="eagle-blue"
+    elif docker inspect --format='{{.State.Running}}' eagle-green 2>/dev/null | grep -q true; then
+        ACTIVE="eagle-green"
+    else
+        ACTIVE=""
+    fi
+fi
+
+if [ -z "$ACTIVE" ]; then
+    echo "Error: No active Eagle instance found" >&2
+    exit 1
+fi
+
+# Default to follow mode if no args provided
+if [ $# -eq 0 ]; then
+    exec docker logs -f "$ACTIVE"
+else
+    exec docker logs "$@" "$ACTIVE"
+fi

scripts/generate_changelog.sh

@@ -373,6 +373,115 @@ send_email_fastmail() {
     echo "Email sent successfully"
 }
 
+# Generate player-friendly "What's New" summary
+# This creates a short summary suitable for in-game display
+generate_whats_new_summary() {
+    local pr_file="$1"
+    local output_file="/tmp/eagle0_whats_new_$$.txt"
+
+    echo "Generating player-friendly What's New summary..." >&2
+
+    # Create a prompt for player-facing summary
+    local prompt_file="/tmp/eagle0_whats_new_prompt_$$.txt"
+
+    cat > "$prompt_file" <<'WHATS_NEW_PROMPT'
+Based on these merged PRs, write a SHORT player-friendly summary.
+Focus only on changes players will notice. Ignore internal/technical changes.
+
+Output format (exactly this format, no markdown, no extra text):
+TITLE: (5-10 words describing the main change)
+DESCRIPTION: (1-2 sentences, what players can now do differently)
+CATEGORY: (one of: feature, improvement, fix, content)
+
+If there are multiple notable player-visible changes, pick the single most important one.
+If there are no player-visible changes at all, output exactly: NONE
+
+Examples of good output:
+TITLE: Bug Reporting
+DESCRIPTION: You can now report bugs directly from the Settings menu.
+CATEGORY: feature
+
+TITLE: Faster Reconnection
+DESCRIPTION: The game now reconnects more smoothly after network interruptions.
+CATEGORY: improvement
+
+Here are the merged PRs:
+
+WHATS_NEW_PROMPT
+
+    cat "$pr_file" >> "$prompt_file"
+
+    # Use Claude CLI to generate the summary
+    if ! command -v claude &> /dev/null; then
+        echo "NONE"
+        rm -f "$prompt_file"
+        return
+    fi
+
+    cat "$prompt_file" | claude --print > "$output_file" 2>/dev/null
+
+    rm -f "$prompt_file"
+
+    # Check if the output is NONE
+    if grep -q "^NONE$" "$output_file"; then
+        echo "NONE"
+        rm -f "$output_file"
+        return
+    fi
+
+    # Return the output
+    cat "$output_file"
+    rm -f "$output_file"
+}
+
+# URL encode a string for use in query parameters
+urlencode() {
+    local string="$1"
+    local strlen=${#string}
+    local encoded=""
+    local pos c o
+
+    for (( pos=0 ; pos<strlen ; pos++ )); do
+        c=${string:$pos:1}
+        case "$c" in
+            [-_.~a-zA-Z0-9] ) o="${c}" ;;
+            * )               printf -v o '%%%02x' "'$c"
+        esac
+        encoded+="${o}"
+    done
+    echo "${encoded}"
+}
+
+# Open the admin console with pre-populated what's new content
+open_whats_new_preview() {
+    local title="$1"
+    local description="$2"
+    local category="$3"
+
+    local encoded_title=$(urlencode "$title")
+    local encoded_desc=$(urlencode "$description")
+    local encoded_cat=$(urlencode "$category")
+
+    local preview_url="https://admin.eagle0.net/whats-new?preview=true&title=${encoded_title}&description=${encoded_desc}&category=${encoded_cat}"
+
+    echo ""
+    echo "=== What's New Preview ==="
+    echo "Title: $title"
+    echo "Description: $description"
+    echo "Category: $category"
+    echo ""
+    echo "Opening admin console preview..."
+
+    # Open the URL in the default browser
+    if [[ "$(uname)" == "Darwin" ]]; then
+        open "$preview_url"
+    elif command -v xdg-open &> /dev/null; then
+        xdg-open "$preview_url"
+    else
+        echo "Preview URL: $preview_url"
+    fi
+}
+
 # Update the tag to mark this run
 update_tag() {
     echo "Updating $TAG_NAME tag..."
@@ -462,6 +571,26 @@ main() {
 
         # Update tag for next run
         update_tag
+
+        # Generate player-friendly What's New summary and open admin preview
+        echo ""
+        echo "Generating What's New summary for in-game display..."
+        whats_new_output=$(generate_whats_new_summary "$pr_file")
+
+        if [[ "$whats_new_output" != "NONE" ]]; then
+            # Parse the output
+            title=$(echo "$whats_new_output" | grep "^TITLE:" | sed 's/^TITLE:[[:space:]]*//')
+            description=$(echo "$whats_new_output" | grep "^DESCRIPTION:" | sed 's/^DESCRIPTION:[[:space:]]*//')
+            category=$(echo "$whats_new_output" | grep "^CATEGORY:" | sed 's/^CATEGORY:[[:space:]]*//')
+
+            if [[ -n "$title" && -n "$description" ]]; then
+                open_whats_new_preview "$title" "$description" "$category"
+            else
+                echo "Could not parse What's New output, skipping preview"
+            fi
+        else
+            echo "No player-visible changes detected, skipping What's New preview"
+        fi
     fi
 
     echo ""

scripts/generate_manifest_keys.go

@@ -0,0 +1,41 @@
+// +build ignore
+
+// Script to generate Ed25519 key pair for manifest signing.
+// Run with: go run scripts/generate_manifest_keys.go
+//
+// This will output:
+// - Private key (base64): Store as MANIFEST_SIGNING_KEY GitHub secret
+// - Public key (base64): Embed in EagleInstaller for verification
+
+package main
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"log"
+)
+
+func main() {
+	// Generate Ed25519 key pair
+	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		log.Fatalf("Failed to generate key pair: %v", err)
+	}
+
+	// Encode keys as base64
+	privateKeyB64 := base64.StdEncoding.EncodeToString(privateKey)
+	publicKeyB64 := base64.StdEncoding.EncodeToString(publicKey)
+
+	fmt.Println("=== Ed25519 Key Pair for Manifest Signing ===")
+	fmt.Println()
+	fmt.Println("PRIVATE KEY (store as GitHub secret MANIFEST_SIGNING_KEY):")
+	fmt.Println(privateKeyB64)
+	fmt.Println()
+	fmt.Println("PUBLIC KEY (embed in EagleInstaller.cs for verification):")
+	fmt.Println(publicKeyB64)
+	fmt.Println()
+	fmt.Printf("Private key size: %d bytes\n", len(privateKey))
+	fmt.Printf("Public key size: %d bytes\n", len(publicKey))
+}

scripts/inject_sparkle.sh

@@ -27,33 +27,59 @@ if [ -z "${SPARKLE_EDDSA_PUBLIC_KEY:-}" ]; then
     exit 1
 fi
 
-# Download Sparkle if not cached
+# Always use a fresh Sparkle download to avoid cache corruption issues
 SPARKLE_DIR="$SPARKLE_CACHE_DIR/Sparkle-$SPARKLE_VERSION"
-if [ ! -d "$SPARKLE_DIR/Sparkle.framework" ]; then
-    echo "=== Downloading Sparkle $SPARKLE_VERSION ==="
-    mkdir -p "$SPARKLE_CACHE_DIR"
-    SPARKLE_URL="https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
-    curl -L "$SPARKLE_URL" | tar -xJ -C "$SPARKLE_CACHE_DIR"
-    mv "$SPARKLE_CACHE_DIR/Sparkle-$SPARKLE_VERSION" "$SPARKLE_DIR" 2>/dev/null || true
-    # If the extracted directory doesn't match version pattern, it may just be "Sparkle"
-    if [ ! -d "$SPARKLE_DIR" ]; then
-        mkdir -p "$SPARKLE_DIR"
-        mv "$SPARKLE_CACHE_DIR/Sparkle.framework" "$SPARKLE_DIR/" 2>/dev/null || true
-        mv "$SPARKLE_CACHE_DIR/bin" "$SPARKLE_DIR/" 2>/dev/null || true
-    fi
+echo "=== Clearing Sparkle cache and downloading fresh copy ==="
+rm -rf "$SPARKLE_DIR"
+mkdir -p "$SPARKLE_DIR"
+
+SPARKLE_URL="https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
+echo "Downloading from: $SPARKLE_URL"
+curl -L "$SPARKLE_URL" -o /tmp/sparkle.tar.xz
+tar -xJf /tmp/sparkle.tar.xz -C "$SPARKLE_DIR"
+rm /tmp/sparkle.tar.xz
+
+# Show what was extracted
+echo "=== Extracted contents ==="
+ls -la "$SPARKLE_DIR/"
+
+# The tarball extracts files directly, not into a subdirectory
+# Verify the framework has proper symlink structure
+echo "=== Verifying Sparkle.framework structure ==="
+ls -la "$SPARKLE_DIR/Sparkle.framework/"
+
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Sparkle.framework/Sparkle is not a symlink"
+    file "$SPARKLE_DIR/Sparkle.framework/Sparkle"
+    exit 1
 fi
 
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Versions/Current" ]; then
+    echo "ERROR: Sparkle.framework/Versions/Current is not a symlink"
+    ls -la "$SPARKLE_DIR/Sparkle.framework/Versions/"
+    exit 1
+fi
+
+echo "Sparkle framework structure verified OK"
+
 echo "=== Injecting Sparkle framework ==="
 FRAMEWORKS_DIR="$APP_PATH/Contents/Frameworks"
 mkdir -p "$FRAMEWORKS_DIR"
 
-# Copy Sparkle framework
-cp -R "$SPARKLE_DIR/Sparkle.framework" "$FRAMEWORKS_DIR/"
+# Remove any existing Sparkle.framework in the app
+rm -rf "$FRAMEWORKS_DIR/Sparkle.framework"
 
-# Also copy the XPC services if present
-if [ -d "$SPARKLE_DIR/Sparkle.framework/Versions/B/XPCServices" ]; then
-    echo "Sparkle XPC services present"
+# Copy Sparkle framework (use ditto to preserve symlinks and bundle structure)
+ditto "$SPARKLE_DIR/Sparkle.framework" "$FRAMEWORKS_DIR/Sparkle.framework"
+
+# Verify the copied framework still has proper structure
+echo "=== Verifying copied Sparkle.framework structure ==="
+ls -la "$FRAMEWORKS_DIR/Sparkle.framework/"
+if [ ! -L "$FRAMEWORKS_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Copied framework lost symlink structure"
+    exit 1
 fi
+echo "Copied framework structure OK"
 
 echo "=== Updating Info.plist ==="
 PLIST_PATH="$APP_PATH/Contents/Info.plist"
@@ -69,8 +95,9 @@ PLIST_PATH="$APP_PATH/Contents/Info.plist"
 /usr/libexec/PlistBuddy -c "Add :SUEnableAutomaticChecks bool true" "$PLIST_PATH"
 
 # Set bundle version from git for Sparkle version comparison
-VERSION=$(git describe --tags --always 2>/dev/null || echo "1.0.0")
+# Use commit count for automatic incrementing versions (e.g., 1.0.9548)
 BUILD_NUMBER=$(git rev-list --count HEAD 2>/dev/null || echo "1")
+VERSION="1.0.${BUILD_NUMBER}"
 
 echo "Setting version: $VERSION (build $BUILD_NUMBER)"
 /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" "$PLIST_PATH" 2>/dev/null || \
@@ -83,7 +110,7 @@ echo "=== Adding URL scheme for invitation codes ==="
 /usr/libexec/PlistBuddy -c "Delete :CFBundleURLTypes" "$PLIST_PATH" 2>/dev/null || true
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes array" "$PLIST_PATH"
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0 dict" "$PLIST_PATH"
-/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLName string 'com.Shardok-Games.eagle0'" "$PLIST_PATH"
+/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLName string 'net.eagle0.eagle0'" "$PLIST_PATH"
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLSchemes array" "$PLIST_PATH"
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLSchemes:0 string 'eagle0'" "$PLIST_PATH"
 

scripts/notarize_mac_app.sh

@@ -31,17 +31,51 @@ echo "=== Creating ZIP for notarization: $ZIP_PATH ==="
 ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
 
 echo "=== Submitting to Apple for notarization ==="
-xcrun notarytool submit "$ZIP_PATH" \
+SUBMIT_OUTPUT=$(xcrun notarytool submit "$ZIP_PATH" \
     --apple-id "$APPLE_ID" \
     --password "$APP_SPECIFIC_PASSWORD" \
     --team-id "$TEAM_ID" \
-    --wait
+    --wait 2>&1) || true
 
-# Clean up the zip
-rm "$ZIP_PATH"
+echo "$SUBMIT_OUTPUT"
+
+# Extract submission ID and status (look for "  status:" to avoid matching "Current status:")
+SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
+STATUS=$(echo "$SUBMIT_OUTPUT" | grep "^  status:" | awk '{print $2}')
+
+echo "Submission ID: $SUBMISSION_ID"
+echo "Status: $STATUS"
+
+# Clean up the zip (use -f to avoid failure if already deleted)
+rm -f "$ZIP_PATH"
+
+if [ "$STATUS" != "Accepted" ]; then
+    echo "=== Notarization failed! Fetching log for details ==="
+    xcrun notarytool log "$SUBMISSION_ID" \
+        --apple-id "$APPLE_ID" \
+        --password "$APP_SPECIFIC_PASSWORD" \
+        --team-id "$TEAM_ID"
+    exit 1
+fi
 
 echo "=== Stapling notarization ticket to app ==="
-xcrun stapler staple "$APP_PATH"
+# Retry stapling - Apple's CloudKit can have a brief delay after notarization completes
+MAX_STAPLE_ATTEMPTS=5
+STAPLE_ATTEMPT=1
+while [ $STAPLE_ATTEMPT -le $MAX_STAPLE_ATTEMPTS ]; do
+    echo "Stapling attempt $STAPLE_ATTEMPT/$MAX_STAPLE_ATTEMPTS..."
+    if xcrun stapler staple "$APP_PATH"; then
+        echo "Stapling successful"
+        break
+    fi
+    if [ $STAPLE_ATTEMPT -eq $MAX_STAPLE_ATTEMPTS ]; then
+        echo "ERROR: Stapling failed after $MAX_STAPLE_ATTEMPTS attempts"
+        exit 1
+    fi
+    echo "Stapling failed, waiting 10 seconds before retry..."
+    sleep 10
+    STAPLE_ATTEMPT=$((STAPLE_ATTEMPT + 1))
+done
 
 echo "=== Verifying notarization ==="
 xcrun stapler validate "$APP_PATH"

scripts/notarize_submit.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# Submit a macOS .app bundle to Apple for notarization (no waiting)
+# Usage: notarize_submit.sh <app_path>
+# Outputs: submission_id=<id> to stdout (for GitHub Actions)
+#
+# Environment variables (required):
+#   APPLE_ID - Apple Developer account email
+#   APP_SPECIFIC_PASSWORD - App-specific password for notarytool
+#   TEAM_ID - Apple Developer Team ID
+
+set -euo pipefail
+
+APP_PATH="$1"
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH" >&2
+    exit 1
+fi
+
+if [ -z "${APPLE_ID:-}" ] || [ -z "${APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${TEAM_ID:-}" ]; then
+    echo "ERROR: Required environment variables not set" >&2
+    echo "  APPLE_ID: ${APPLE_ID:-<not set>}" >&2
+    echo "  APP_SPECIFIC_PASSWORD: ${APP_SPECIFIC_PASSWORD:+<set>}" >&2
+    echo "  TEAM_ID: ${TEAM_ID:-<not set>}" >&2
+    exit 1
+fi
+
+# Create ZIP for notarization submission
+ZIP_PATH="${APP_PATH%.app}.zip"
+echo "=== Creating ZIP for notarization: $ZIP_PATH ===" >&2
+ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
+
+echo "=== Submitting to Apple for notarization ===" >&2
+SUBMIT_OUTPUT=$(xcrun notarytool submit "$ZIP_PATH" \
+    --apple-id "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" \
+    --team-id "$TEAM_ID" 2>&1)
+
+echo "$SUBMIT_OUTPUT" >&2
+
+# Extract submission ID
+SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
+
+if [ -z "$SUBMISSION_ID" ]; then
+    echo "ERROR: Failed to get submission ID" >&2
+    exit 1
+fi
+
+# Clean up the zip
+rm "$ZIP_PATH"
+
+echo "Submission ID: $SUBMISSION_ID" >&2
+
+# Output for GitHub Actions
+echo "submission_id=$SUBMISSION_ID"

scripts/notarize_wait.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+#
+# Wait for Apple notarization to complete and staple the ticket
+# Usage: notarize_wait.sh <submission_id> <app_path>
+#
+# Environment variables (required):
+#   APPLE_ID - Apple Developer account email
+#   APP_SPECIFIC_PASSWORD - App-specific password for notarytool
+#   TEAM_ID - Apple Developer Team ID
+
+set -euo pipefail
+
+SUBMISSION_ID="$1"
+APP_PATH="$2"
+
+if [ -z "$SUBMISSION_ID" ]; then
+    echo "ERROR: submission_id is required" >&2
+    exit 1
+fi
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH" >&2
+    exit 1
+fi
+
+if [ -z "${APPLE_ID:-}" ] || [ -z "${APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${TEAM_ID:-}" ]; then
+    echo "ERROR: Required environment variables not set" >&2
+    exit 1
+fi
+
+echo "=== Waiting for notarization of submission $SUBMISSION_ID ==="
+WAIT_OUTPUT=$(xcrun notarytool wait "$SUBMISSION_ID" \
+    --apple-id "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" \
+    --team-id "$TEAM_ID" 2>&1) || true
+
+echo "$WAIT_OUTPUT"
+
+# Extract status (look for "  status:" to avoid matching "Current status:")
+STATUS=$(echo "$WAIT_OUTPUT" | grep "^  status:" | awk '{print $2}')
+
+echo "Status: $STATUS"
+
+if [ "$STATUS" != "Accepted" ]; then
+    echo "=== Notarization failed! Fetching log for details ==="
+    xcrun notarytool log "$SUBMISSION_ID" \
+        --apple-id "$APPLE_ID" \
+        --password "$APP_SPECIFIC_PASSWORD" \
+        --team-id "$TEAM_ID"
+    exit 1
+fi
+
+echo "=== Verifying code signature before stapling ==="
+if ! codesign --verify --deep --strict "$APP_PATH" 2>&1; then
+    echo "ERROR: Code signature verification failed - app may have been damaged during transfer"
+    echo "Attempting to show signature details:"
+    codesign -dvvv "$APP_PATH" 2>&1 || true
+    exit 1
+fi
+echo "Code signature verified successfully"
+
+echo "=== Stapling notarization ticket to app ==="
+# Retry stapling - Apple's CloudKit can take several minutes to propagate the ticket
+MAX_STAPLE_ATTEMPTS=10
+STAPLE_WAIT_SECONDS=30
+STAPLE_ATTEMPT=1
+while [ $STAPLE_ATTEMPT -le $MAX_STAPLE_ATTEMPTS ]; do
+    echo "Stapling attempt $STAPLE_ATTEMPT/$MAX_STAPLE_ATTEMPTS..."
+    if STAPLE_OUTPUT=$(xcrun stapler staple "$APP_PATH" 2>&1); then
+        echo "$STAPLE_OUTPUT"
+        echo "Stapling successful"
+        break
+    fi
+    echo "Stapler output: $STAPLE_OUTPUT"
+    if [ $STAPLE_ATTEMPT -eq $MAX_STAPLE_ATTEMPTS ]; then
+        echo "ERROR: Stapling failed after $MAX_STAPLE_ATTEMPTS attempts (total wait: $((MAX_STAPLE_ATTEMPTS * STAPLE_WAIT_SECONDS)) seconds)"
+        exit 1
+    fi
+    echo "Stapling failed, waiting $STAPLE_WAIT_SECONDS seconds before retry..."
+    sleep $STAPLE_WAIT_SECONDS
+    STAPLE_ATTEMPT=$((STAPLE_ATTEMPT + 1))
+done
+
+echo "=== Verifying notarization ==="
+xcrun stapler validate "$APP_PATH"
+spctl --assess --type exec -v "$APP_PATH"
+
+echo "Notarization complete: $APP_PATH"

scripts/warmup-eagle.sh

@@ -65,7 +65,8 @@ fi
 # If we found the Go tool, use it
 if [ -n "${WARMUP_TOOL}" ]; then
     log_info "Using Go warmup tool: ${WARMUP_TOOL}"
-    if "${WARMUP_TOOL}" --address="${HOST}" --timeout=60s; then
+    # Use 5 minute timeout to allow for slow operations on cold JVM
+    if "${WARMUP_TOOL}" --address="${HOST}" --timeout=300s; then
         log_info "Warmup complete!"
         exit 0
     else

src/main/cpp/net/eagle0/shardok/ai/AIWaterCrossingCalculator.cpp

@@ -20,8 +20,9 @@ auto UnitIdsRequiringWaterCrossing(
     fb::HexMapW mapCopy = fb::CopyHexMap(gameState->hex_map());
     for (uint32_t index = 0; index < mapCopy->terrain()->size(); index++) {
         if (IsWater(mapCopy->terrain()->Get(index)->type())) continue;
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
+        // const_cast is safe because we own the mutable buffer (mapCopy)
+        const_cast<net::eagle0::shardok::storage::fb::Terrain *>(
+                mapCopy->mutable_terrain()->GetMutableObject(index))
                 ->mutable_modifier()
                 .mutable_fire()
                 .mutate_present(false);
@@ -164,16 +165,11 @@ auto WaterCrossingTiles(
         if (modifier.ice().present() && !modifier.fire().present()) continue;
 
         // Now try adding a bridge to the tile to see if it helps
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_bridge()
-                .mutate_present(true);
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_fire()
-                .mutate_present(false);
+        // const_cast is safe because we own the mutable buffer (mapCopy)
+        auto *terr = const_cast<net::eagle0::shardok::storage::fb::Terrain *>(
+                mapCopy->mutable_terrain()->GetMutableObject(index));
+        terr->mutable_modifier().mutable_bridge().mutate_present(true);
+        terr->mutable_modifier().mutable_fire().mutate_present(false);
 
         auto hash = ActionPointDistancesCache::GetMapId(mapCopy);
 
@@ -183,11 +179,7 @@ auto WaterCrossingTiles(
         }
 
         // Undo the new bridge for the next iteration of the loop
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_bridge()
-                .mutate_present(false);
+        terr->mutable_modifier().mutable_bridge().mutate_present(false);
     }
 
     return returnCoords;

src/main/cpp/net/eagle0/shardok/library/action_point_distances/ActionPointDistancesCache.cpp

@@ -76,11 +76,13 @@ static auto CreateIceClearedMap(const HexMap* map) -> fb::HexMapW {
 
     // Now modify the ice on the mutable copy
     auto* mutableMap = mapCopy.Get();
-    const auto* terrainVec = mutableMap->mutable_terrain();
+    auto* terrainVec = mutableMap->mutable_terrain();
 
     for (size_t i = 0; i < terrainVec->size(); i++) {
         // Only process tiles with ice
-        if (auto* terrain = terrainVec->GetMutableObject(i); terrain->modifier().ice().present()) {
+        // const_cast is safe here because we own the mutable buffer (mapCopy)
+        if (auto* terrain = const_cast<Terrain*>(terrainVec->GetMutableObject(i));
+            terrain->modifier().ice().present()) {
             terrain->mutable_modifier().mutable_ice().mutate_present(false);
             terrain->mutable_modifier().mutable_ice().mutate_integrity(0.0f);
         }

src/main/cpp/net/eagle0/shardok/library/action_result_applier/ActionResultApplier.cpp

@@ -22,6 +22,13 @@ using std::unique_ptr;
 using ResolvedUnitProto = net::eagle0::shardok::storage::ResolvedUnit;
 using GameState = net::eagle0::shardok::storage::fb::GameState;
 using GameStateT = net::eagle0::shardok::storage::fb::GameStateT;
+using Unit = net::eagle0::shardok::storage::fb::Unit;
+
+// Helper to get a mutable unit from the units vector.
+// const_cast is safe because we're accessing through a mutable GameState pointer.
+inline auto GetMutableUnit(GameState *state, UnitId unitId) -> Unit * {
+    return const_cast<Unit *>(state->mutable_units()->GetMutableObject(unitId));
+}
 using net::eagle0::shardok::storage::fb::DrawType;
 using net::eagle0::shardok::storage::fb::VictoryCondition;
 using net::eagle0::shardok::storage::fb::VictoryType;
@@ -37,7 +44,7 @@ void ApplyResolvedUnit(
     if (unit.has_attached_hero() &&
         unit.attached_hero().control_info().controlled_unit_id() != -1) {
         const UnitId controlledUnitId = unit.attached_hero().control_info().controlled_unit_id();
-        auto *controlledUnit = inoutState->mutable_units()->GetMutableObject(controlledUnitId);
+        auto *controlledUnit = GetMutableUnit(inoutState, controlledUnitId);
         internalAssert(controlledUnit->unit_id() == controlledUnitId);
         internalAssert(controlledUnit->commanding_unit_id() == unitId);
         controlledUnit->mutate_commanding_unit_id(-1);
@@ -47,7 +54,7 @@ void ApplyResolvedUnit(
     if (unit.commanding_unit_id() != -1) {
         const UnitId commandingUnitId = unit.commanding_unit_id();
 
-        auto *commandingUnit = inoutState->mutable_units()->GetMutableObject(commandingUnitId);
+        auto *commandingUnit = GetMutableUnit(inoutState, commandingUnitId);
         internalAssert(commandingUnit->unit_id() == commandingUnitId);
         internalAssert(
                 commandingUnit->attached_hero().control_info().controlled_unit_id() == unitId);
@@ -58,7 +65,7 @@ void ApplyResolvedUnit(
     if (status == net::eagle0::shardok::storage::fb::UnitStatus_CAPTURED_UNIT &&
         unit.has_attached_hero() && unit.attached_hero().is_vip()) {
         for (uint32_t i = 0; i < inoutState->units()->size(); i++) {
-            auto *playerUnit = inoutState->mutable_units()->GetMutableObject(i);
+            auto *playerUnit = GetMutableUnit(inoutState, i);
             if (playerUnit->player_id() != unit.player_id()) continue;
             if (playerUnit->unit_id() == unit.unit_id()) continue;
 
@@ -70,7 +77,7 @@ void ApplyResolvedUnit(
         }
     }
 
-    inoutState->mutable_units()->GetMutableObject(unitId)->mutate_status(status);
+    GetMutableUnit(inoutState, unitId)->mutate_status(status);
 }
 
 void ApplyResolvedUnit(
@@ -189,7 +196,7 @@ void MutatingAddUnits(GameStateW &mutatingState, const ActionResultProto &result
         // We only need to process the units that are being changed
         for (const auto &unitBytes : result.changed_units_fb()) {
             const auto *unit = (Unit *)unitBytes.data();
-            auto *mutableUnit = mutatingState->mutable_units()->GetMutableObject(unit->unit_id());
+            auto *mutableUnit = GetMutableUnit(mutatingState.Get(), unit->unit_id());
             if (mutableUnit->status() ==
                 net::eagle0::shardok::storage::fb::UnitStatus_RESERVED_SLOT) {
                 // Convert this reserved slot to a real unit
@@ -340,7 +347,7 @@ void MutatingApplyResult(
         }
 
         // Capture old position before applying changes
-        auto *mutableUnit = mutatingGameState->units()->GetMutableObject(changedUnit->unit_id());
+        auto *mutableUnit = GetMutableUnit(mutatingGameState.Get(), changedUnit->unit_id());
         const auto oldLocation = mutableUnit->location();
 
         fb::ApplyUnit(mutableUnit, changedUnit, status);

src/main/cpp/net/eagle0/shardok/library/commands/MoveCommand.cpp

@@ -191,6 +191,7 @@ auto MoveCommand::GetCommandProto() const -> CommandProto {
     proto.mutable_action_points()->set_value(pointCost);
     proto.mutable_actor()->set_value(moverId);
     *proto.mutable_target() = ToCoordsProto(interimTargets.back());
+    for (const auto& coords : interimTargets) { *proto.add_path() = ToCoordsProto(coords); }
     for (const auto& fup : followUpCommandTypes) { proto.add_follow_up_command_types(fup); }
     proto.set_will_unhide(willUnhide);
 

src/main/cpp/net/eagle0/shardok/library/util/HexMapUtils.cpp

@@ -64,8 +64,16 @@ auto GetTerrain(const HexMap *map, const Coords &coords) -> const Terrain * {
     return map->terrain()->Get(coords.row() * map->column_count() + coords.column());
 }
 
+auto GetMutableTerrain(HexMap *map, const Coords &coords) -> Terrain * {
+    // const_cast is safe because we're accessing through a mutable HexMap pointer
+    return const_cast<Terrain *>(map->mutable_terrain()->GetMutableObject(
+            coords.row() * map->column_count() + coords.column()));
+}
+
 auto GetMutableTerrain(const HexMap *map, const Coords &coords) -> Terrain * {
-    return map->terrain()->GetMutableObject(coords.row() * map->column_count() + coords.column());
+    // const_cast is safe when the underlying buffer is known to be mutable
+    return const_cast<Terrain *>(
+            map->terrain()->Get(coords.row() * map->column_count() + coords.column()));
 }
 
 auto HasForestAccess(
@@ -597,7 +605,9 @@ void MutatingSetTileModifier(
         const int row,
         const int column,
         const TileModifierProto &TileModifierProto) {
-    auto *terr = hexMap->mutable_terrain()->GetMutableObject(row * hexMap->column_count() + column);
+    // const_cast is safe because we're accessing through a mutable HexMap pointer
+    auto *terr = const_cast<Terrain *>(
+            hexMap->mutable_terrain()->GetMutableObject(row * hexMap->column_count() + column));
 
     if (TileModifierProto.has_bridge()) {
         terr->mutable_modifier().mutable_bridge().mutate_present(true);

src/main/cpp/net/eagle0/shardok/library/util/HexMapUtils.hpp

@@ -82,6 +82,9 @@ auto HasForestAccess(
         PlayerId player) -> bool;
 
 auto GetTerrain(const HexMap *map, const Coords &coords) -> const Terrain *;
+auto GetMutableTerrain(HexMap *map, const Coords &coords) -> Terrain *;
+// Overload for const HexMap - uses const_cast internally. Safe when the underlying buffer is
+// mutable.
 auto GetMutableTerrain(const HexMap *map, const Coords &coords) -> Terrain *;
 
 auto CoordsAreValid(const HexMap *map, const Coords &coords) -> bool;

src/main/cpp/net/eagle0/shardok/library/view_filters/GameStateGuesser.cpp

@@ -29,6 +29,13 @@ using UnitViewProto = net::eagle0::shardok::api::UnitView;
 
 using Coords = net::eagle0::shardok::storage::fb::Coords;
 using Unit = net::eagle0::shardok::storage::fb::Unit;
+using GameState = net::eagle0::shardok::storage::fb::GameState;
+
+// Helper to get a mutable unit from the units vector.
+// const_cast is safe because we're accessing through a mutable GameState pointer.
+inline auto GetMutableUnit(GameState *state, UnitId unitId) -> Unit * {
+    return const_cast<Unit *>(state->mutable_units()->GetMutableObject(unitId));
+}
 
 constexpr int8_t kGuessedHeroStat = 75;
 constexpr int8_t kGuessedBattalionStat = 0;
@@ -412,16 +419,13 @@ auto GameStateGuesser::GuessedState(
         if (unit->has_attached_hero()) {
             UnitId controlledUnitId = unit->attached_hero().control_info().controlled_unit_id();
             if (controlledUnitId != -1) {
-                gsw->mutable_units()
-                        ->GetMutableObject(controlledUnitId)
-                        ->mutate_commanding_unit_id(unitId);
+                GetMutableUnit(gsw.Get(), controlledUnitId)->mutate_commanding_unit_id(unitId);
             }
         }
 
         UnitId commandingUnitId = unit->commanding_unit_id();
         if (unit->commanding_unit_id() != -1) {
-            gsw->mutable_units()
-                    ->GetMutableObject(commandingUnitId)
+            GetMutableUnit(gsw.Get(), commandingUnitId)
                     ->mutable_attached_hero()
                     .mutable_control_info()
                     .mutate_controlled_unit_id(unitId);

src/main/csharp/net/eagle0/clients/unity/eagle0/.gitignore

@@ -37,4 +37,7 @@ sysinfo.txt
 *.apk
 *.unitypackage
 
-mono_crash.*
+mono_crash.*
+
+# Local server data
+ServerData/

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/4000_Fantasy_Icons/InUse.meta

@@ -1,5 +1,5 @@
 fileFormatVersion: 2
-guid: 6ddb90d3140384d50a98a19e72539b62
+guid: fb38e3be95e9247c5a451d60236def15
 folderAsset: yes
 DefaultImporter:
   externalObjects: {}