Add visit margin for MCTS final child selection

When selecting the best action at the root node, MCTS traditionally uses
visit count (robust child selection). However, with limited time budgets
and many similar actions (e.g., multiple START_FIRE targets), UCB
exploration spreads visits thinly, causing near-ties.

This change adds a 10% margin: when visit counts are within 10% of each
other, use lookahead score to decide instead. This handles cases where
UCB exploration creates artificial ties between actions of different
quality.

Test updated to use 5s budget matching production max.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.bazelrc

@@ -26,17 +26,10 @@ common --host_cxxopt="--std=c++23"
 common --javacopt="-Xlint:-options"
 
 # suppress warnings due to https://developer.apple.com/forums/thread/733317
-# Use host_linkopt for macOS-specific flags to avoid passing them to Linux cross-compilation
-common:macos --host_linkopt=-Wl,-no_warn_duplicate_libraries
-
-# Fix Xcode version caching issue - avoids need for `bazel clean --expunge` after Xcode updates
-common:macos --repo_env=DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
+common --linkopt=-Wl
+common:macos --linkopt=-Wl,-no_warn_duplicate_libraries
 
 common --java_language_version=17
 common --java_runtime_version=remotejdk_17
 common --tool_java_language_version=17
 common --tool_java_runtime_version=remotejdk_17
-
-# Workspace status for build stamping (git commit, timestamp)
-common --workspace_status_command=tools/workspace_status.sh
-common --stamp

.gitattributes

@@ -6,7 +6,4 @@
 *.bytes filter=lfs diff=lfs merge=lfs -text
 *.psd filter=lfs diff=lfs merge=lfs -text
 *.ttf filter=lfs diff=lfs merge=lfs -text
-# Exclude pre-existing font files that were committed as blobs (not LFS pointers)
-src/main/csharp/**/GUI[[:space:]]Pro[[:space:]]Kit*/**/*.ttf !filter !diff !merge
-src/main/csharp/**/Modern[[:space:]]UI[[:space:]]Pack/**/*.ttf !filter !diff !merge
 *.herodata filter=lfs diff=lfs merge=lfs -text

.github/workflows/auth_build.yml

@@ -1,187 +0,0 @@
-name: Auth Service Build and Deploy
-
-on:
-  push:
-    branches: [ "main" ]
-    paths:
-      - 'src/main/go/net/eagle0/authservice/**'
-      - 'src/main/go/net/eagle0/authcli/**'
-      - 'src/main/protobuf/net/eagle0/eagle/api/auth.proto'
-      - 'src/main/protobuf/net/eagle0/eagle/api/admin/**'
-      - 'src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
-      - 'ci/BUILD.bazel'
-      - '.github/workflows/auth_build.yml'
-  workflow_dispatch:
-    inputs:
-      push_images:
-        description: 'Push images to container registry'
-        required: true
-        default: 'false'
-        type: boolean
-
-permissions:
-  contents: read
-
-jobs:
-  build-auth:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-auth.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build Auth Server Docker image
-        id: build-auth
-        run: |
-          set -ex
-
-          # Build auth server image (Go binary has explicit goos/goarch in BUILD.bazel)
-          bazel build //ci:auth_server_image
-
-          # Save the resolved path before any other bazel command changes bazel-bin symlink
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/auth_server_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push Auth image to DO registry
-        id: push-auth
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          AUTH_IMAGE="${{ steps.build-auth.outputs.image_path }}"
-          echo "Using Auth image: $AUTH_IMAGE"
-
-          if [ -z "$AUTH_IMAGE" ] || [ ! -d "$AUTH_IMAGE" ]; then
-            echo "ERROR: Auth image not found at: $AUTH_IMAGE"
-            exit 1
-          fi
-
-          # Build the push target to get crane in runfiles
-          bazel build //ci:auth_server_push
-
-          # Use crane directly for push
-          CRANE="bazel-bin/ci/push_auth_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
-          echo "Using crane: $CRANE"
-
-          # Push with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/auth-server:${GIT_SHA}"
-          echo "Pushing auth image: $IMAGE_TAG"
-          $CRANE push "$AUTH_IMAGE" "$IMAGE_TAG"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/auth-server:latest"
-
-  deploy:
-    runs-on: ubuntu-latest
-    needs: [build-auth]
-    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-    environment: production
-    env:
-      AUTH_IMAGE: ${{ needs.build-auth.outputs.image_tag }}
-      DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
-      DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
-      GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
-      GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
-      JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
-      FASTMAIL_API_TOKEN: ${{ secrets.FASTMAIL_API_TOKEN }}
-      FASTMAIL_FROM_EMAIL: ${{ secrets.FASTMAIL_FROM_EMAIL }}
-      FASTMAIL_FROM_NAME: ${{ secrets.FASTMAIL_FROM_NAME }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Deploy auth service to production
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.DO_DROPLET_IP }}
-          username: deploy
-          key: ${{ secrets.DO_SSH_KEY }}
-          script_stop: true
-          envs: AUTH_IMAGE,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,JWT_PRIVATE_KEY,FASTMAIL_API_TOKEN,FASTMAIL_FROM_EMAIL,FASTMAIL_FROM_NAME
-          script: |
-            set -x
-            cd /opt/eagle0
-
-            # Update AUTH_IMAGE in .env file (preserve other vars)
-            if [ -f .env ]; then
-              # Remove old AUTH_IMAGE line and add new one
-              grep -v '^AUTH_IMAGE=' .env > .env.tmp || true
-              echo "AUTH_IMAGE=${AUTH_IMAGE}" >> .env.tmp
-              # Also update OAuth credentials
-              grep -v '^DISCORD_CLIENT_ID=' .env.tmp > .env.tmp2 || true
-              echo "DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID:-}" >> .env.tmp2
-              grep -v '^DISCORD_CLIENT_SECRET=' .env.tmp2 > .env.tmp3 || true
-              echo "DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET:-}" >> .env.tmp3
-              grep -v '^GOOGLE_CLIENT_ID=' .env.tmp3 > .env.tmp4 || true
-              echo "GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}" >> .env.tmp4
-              grep -v '^GOOGLE_CLIENT_SECRET=' .env.tmp4 > .env.tmp5 || true
-              echo "GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}" >> .env.tmp5
-              # Update JWT private key (JWK format for auth service bootstrap)
-              grep -v '^JWT_PRIVATE_KEY=' .env.tmp5 > .env.tmp6 || true
-              echo "JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY:-}" >> .env.tmp6
-              # Update Fastmail JMAP credentials for email sending
-              grep -v '^FASTMAIL_API_TOKEN=' .env.tmp6 > .env.tmp7 || true
-              echo "FASTMAIL_API_TOKEN=${FASTMAIL_API_TOKEN:-}" >> .env.tmp7
-              grep -v '^FASTMAIL_FROM_EMAIL=' .env.tmp7 > .env.tmp8 || true
-              echo "FASTMAIL_FROM_EMAIL=${FASTMAIL_FROM_EMAIL:-}" >> .env.tmp8
-              grep -v '^FASTMAIL_FROM_NAME=' .env.tmp8 > .env || true
-              echo "FASTMAIL_FROM_NAME=${FASTMAIL_FROM_NAME:-}" >> .env
-              rm -f .env.tmp .env.tmp2 .env.tmp3 .env.tmp4 .env.tmp5 .env.tmp6 .env.tmp7 .env.tmp8
-              chmod 600 .env
-            else
-              echo "ERROR: .env file not found. Run main deploy first."
-              exit 1
-            fi
-
-            # Login to registry
-            echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "${{ secrets.DO_REGISTRY_TOKEN }}" --password-stdin
-
-            echo "Deploying auth service: $AUTH_IMAGE"
-
-            # Use crane to pull image
-            echo "Installing crane..."
-            curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
-            chmod +x crane
-
-            echo "Pulling Auth image with crane..."
-            ./crane pull "${AUTH_IMAGE}" auth.tar || { echo "ERROR: Failed to pull auth image"; exit 1; }
-            echo "Loading Auth image into Docker..."
-            docker load -i auth.tar
-            rm auth.tar
-            rm ./crane
-
-            # Only recreate the auth container (not eagle, shardok, etc.)
-            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate auth
-
-            # Wait for health check
-            sleep 5
-            docker compose -f docker-compose.prod.yml ps auth
-
-            # Verify container is using correct image
-            echo "=== Verifying auth container image ==="
-            docker compose -f docker-compose.prod.yml images auth
-
-            # Cleanup old images
-            docker image prune -f

.github/workflows/build_sysroot.yml

@@ -1,137 +0,0 @@
-name: Build Linux Sysroot
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Sysroot version (e.g., v2, v3)'
-        required: true
-        default: 'v2'
-        type: string
-      architecture:
-        description: 'Target architecture'
-        required: true
-        default: 'amd64'
-        type: choice
-        options:
-          - amd64
-          - arm64
-          - both
-
-permissions:
-  contents: read
-
-jobs:
-  build-sysroot-amd64:
-    if: ${{ inputs.architecture == 'amd64' || inputs.architecture == 'both' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Build sysroot
-        run: ./tools/sysroot/build_sysroot.sh
-
-      - name: Upload sysroot artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ubuntu-noble-sysroot-amd64
-          path: tools/sysroot/output/
-
-      - name: Install AWS CLI
-        run: |
-          if ! command -v aws &> /dev/null; then
-            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-            unzip -q awscliv2.zip
-            sudo ./aws/install
-          fi
-
-      - name: Upload to DigitalOcean Spaces
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.SECRET_KEY }}
-        run: |
-          # Upload sysroot tarball to DO Spaces
-          aws s3 cp tools/sysroot/output/ubuntu_noble_amd64_sysroot.tar.xz \
-            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz \
-            --endpoint-url https://sfo3.digitaloceanspaces.com \
-            --acl public-read
-
-          # Upload sha256 file
-          aws s3 cp tools/sysroot/output/ubuntu_noble_amd64_sysroot.sha256 \
-            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.sha256 \
-            --endpoint-url https://sfo3.digitaloceanspaces.com \
-            --acl public-read
-
-          echo ""
-          echo "=== AMD64 Sysroot uploaded ==="
-          echo "URL: https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz"
-          echo "SHA256: $(cat tools/sysroot/output/ubuntu_noble_amd64_sysroot.sha256)"
-          echo ""
-          echo "Update MODULE.bazel with:"
-          echo "sysroot("
-          echo "    name = \"linux_sysroot\","
-          echo "    sha256 = \"$(cat tools/sysroot/output/ubuntu_noble_amd64_sysroot.sha256)\","
-          echo "    urls = [\"https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz\"],"
-          echo ")"
-
-  build-sysroot-arm64:
-    if: ${{ inputs.architecture == 'arm64' || inputs.architecture == 'both' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up QEMU for ARM64 emulation
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build ARM64 sysroot
-        run: ./tools/sysroot/build_sysroot_arm64.sh
-
-      - name: Upload sysroot artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ubuntu-noble-sysroot-arm64
-          path: tools/sysroot/output/
-
-      - name: Install AWS CLI
-        run: |
-          if ! command -v aws &> /dev/null; then
-            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-            unzip -q awscliv2.zip
-            sudo ./aws/install
-          fi
-
-      - name: Upload to DigitalOcean Spaces
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.SECRET_KEY }}
-        run: |
-          # Upload sysroot tarball to DO Spaces
-          aws s3 cp tools/sysroot/output/ubuntu_noble_arm64_sysroot.tar.xz \
-            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.tar.xz \
-            --endpoint-url https://sfo3.digitaloceanspaces.com \
-            --acl public-read
-
-          # Upload sha256 file
-          aws s3 cp tools/sysroot/output/ubuntu_noble_arm64_sysroot.sha256 \
-            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.sha256 \
-            --endpoint-url https://sfo3.digitaloceanspaces.com \
-            --acl public-read
-
-          echo ""
-          echo "=== ARM64 Sysroot uploaded ==="
-          echo "URL: https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.tar.xz"
-          echo "SHA256: $(cat tools/sysroot/output/ubuntu_noble_arm64_sysroot.sha256)"
-          echo ""
-          echo "Update MODULE.bazel with:"
-          echo "sysroot("
-          echo "    name = \"linux_sysroot_arm64\","
-          echo "    sha256 = \"$(cat tools/sysroot/output/ubuntu_noble_arm64_sysroot.sha256)\","
-          echo "    urls = [\"https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.tar.xz\"],"
-          echo ")"

.github/workflows/docker_build.yml

@@ -1,636 +0,0 @@
-name: Docker Build and Push
-
-on:
-  push:
-    branches: [ "main" ]
-    paths:
-      - 'src/main/cpp/**'
-      - 'src/main/go/**'
-      - 'src/main/scala/**'
-      - 'src/main/protobuf/**'
-      - 'src/main/resources/**'
-      - 'ci/BUILD.bazel'
-      - 'MODULE.bazel'
-      - 'docker-compose.prod.yml'
-      - 'nginx/**'
-      - '.github/workflows/docker_build.yml'
-  workflow_dispatch:
-    inputs:
-      push_images:
-        description: 'Push images to container registry'
-        required: true
-        default: 'false'
-        type: boolean
-
-permissions:
-  contents: read
-
-jobs:
-  build-eagle:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-eagle.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build Eagle Docker image
-        id: build-eagle
-        run: |
-          set -ex
-          bazel build --platforms=//:linux_x86_64 //ci:eagle_server_image
-
-          # Also build the warmup tool for Linux
-          bazel build //src/main/go/net/eagle0/warmup:warmup_linux_amd64
-
-          # Copy warmup binary to scripts/ so it gets deployed with other scripts
-          mkdir -p scripts/bin
-          cp bazel-bin/src/main/go/net/eagle0/warmup/warmup_linux_amd64_/warmup_linux_amd64 scripts/bin/warmup
-
-          # Save the resolved path before any other bazel command changes bazel-bin symlink
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/eagle_server_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          # Also set for current directory in case Bazel uses different home
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push Eagle image to DO registry
-        id: push-eagle
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          # Use cross-compiled image path from build step
-          EAGLE_IMAGE="${{ steps.build-eagle.outputs.image_path }}"
-          echo "Using Eagle image: $EAGLE_IMAGE"
-
-          if [ -z "$EAGLE_IMAGE" ] || [ ! -d "$EAGLE_IMAGE" ]; then
-            echo "ERROR: Eagle image not found at: $EAGLE_IMAGE"
-            exit 1
-          fi
-
-          # Debug: show OCI layout contents
-          echo "=== OCI Layout Contents ==="
-          cat "$EAGLE_IMAGE/index.json"
-          echo ""
-          echo "=== Blobs ==="
-          ls -la "$EAGLE_IMAGE/blobs/sha256/" | head -20
-
-          # Verify OCI layout consistency before pushing
-          echo "=== Verifying OCI layout consistency ==="
-          for digest in $(cat "$EAGLE_IMAGE/index.json" | grep -o '"sha256:[^"]*"' | tr -d '"'); do
-            blob_path="$EAGLE_IMAGE/blobs/${digest/://}"
-            if [ ! -f "$blob_path" ]; then
-              echo "ERROR: Blob not found: $blob_path"
-              exit 1
-            fi
-            actual_digest="sha256:$(shasum -a 256 "$blob_path" | cut -d' ' -f1)"
-            if [ "$digest" != "$actual_digest" ]; then
-              echo "ERROR: Digest mismatch for $blob_path"
-              echo "  Index says: $digest"
-              echo "  Actual: $actual_digest"
-              exit 1
-            fi
-            echo "✓ Verified: $digest"
-          done
-
-          # Build the push target to get crane in runfiles
-          bazel build //ci:eagle_server_push
-
-          # Use crane directly for push (avoids OCI->Docker digest mismatch)
-          CRANE="bazel-bin/ci/push_eagle_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
-          echo "Using crane: $CRANE"
-
-          # Push with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/eagle-server:${GIT_SHA}"
-          echo "Pushing eagle image: $IMAGE_TAG"
-          $CRANE push "$EAGLE_IMAGE" "$IMAGE_TAG"
-
-          # Verify push by checking what's in the registry
-          echo "=== Verifying push ==="
-          $CRANE manifest "$IMAGE_TAG" | head -50
-          PUSHED_DIGEST=$($CRANE digest "$IMAGE_TAG")
-          echo "Registry reports digest: $PUSHED_DIGEST"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience (but deploy won't use it)
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/eagle-server:latest"
-
-  build-shardok:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-shardok.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build Shardok binary (cross-compile for Linux)
-        run: |
-          set -ex
-
-          # Step 1: Build JUST the binary with cross-compilation
-          # We need --extra_toolchains to force the Linux toolchain to be used
-          # because toolchains_llvm registers with dev_dependency=True
-          echo "=== Building shardok-server binary for linux-x86_64 ==="
-          bazel build \
-            --platforms=//:linux_x86_64 \
-            --extra_toolchains=@llvm_toolchain_linux//:all \
-            //src/main/cpp/net/eagle0/shardok:shardok-server
-
-          # Step 2: Check the binary directly from bazel-bin
-          # bazel-bin is a symlink that points to the correct output directory
-          LINUX_BIN="bazel-bin/src/main/cpp/net/eagle0/shardok/shardok-server"
-          echo "=== Checking binary at: $LINUX_BIN ==="
-
-          if [ ! -f "$LINUX_BIN" ]; then
-            echo "ERROR: Binary not found at $LINUX_BIN"
-            exit 1
-          fi
-
-          # Debug: show what bazel-bin points to
-          echo "bazel-bin symlink target: $(readlink bazel-bin || echo 'not a symlink')"
-
-          # Step 3: Verify it's ELF (Linux) not Mach-O (macOS)
-          echo "=== Verifying binary format ==="
-          MAGIC=$(head -c 4 "$LINUX_BIN" | xxd -p)
-          echo "Binary magic bytes: $MAGIC"
-
-          if [ "$MAGIC" = "7f454c46" ]; then
-            echo "SUCCESS: Binary is ELF format (Linux)"
-          elif [ "$MAGIC" = "cfaeedfe" ] || [ "$MAGIC" = "cffaedfe" ]; then
-            echo "ERROR: Binary is Mach-O format (macOS) - cross-compilation failed!"
-            echo ""
-            echo "Debug info:"
-            echo "- bazel-bin points to: $(readlink bazel-bin)"
-            file "$LINUX_BIN" || true
-            exit 1
-          else
-            echo "WARNING: Unknown binary format: $MAGIC"
-            file "$LINUX_BIN" || true
-          fi
-
-      - name: Build Shardok Docker image
-        id: build-shardok
-        run: |
-          set -ex
-
-          # Build the OCI image with cross-compilation flags
-          bazel build \
-            --platforms=//:linux_x86_64 \
-            --extra_toolchains=@llvm_toolchain_linux//:all \
-            //ci:shardok_server_image
-
-          # The image is output to bazel-bin which is a symlink.
-          # Resolve it now before any other bazel commands change where it points.
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/shardok_server_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-          # Verify the binary inside the tar layer is ELF
-          echo "=== Verifying binary in image tar ==="
-          BINARY_TAR="bazel-bin/ci/shardok_binary_layer.tar"
-          if [ -f "$BINARY_TAR" ]; then
-            echo "Checking binary in $BINARY_TAR"
-            # Extract just the first 4 bytes of the binary from the tar
-            MAGIC=$(tar -xOf "$BINARY_TAR" app/shardok-server 2>/dev/null | head -c 4 | xxd -p)
-            echo "Binary magic in tar: $MAGIC"
-            if [ "$MAGIC" = "7f454c46" ]; then
-              echo "SUCCESS: Binary in tar is ELF format (Linux)"
-            else
-              echo "ERROR: Binary in tar is NOT ELF format!"
-              echo "This means pkg_tar is packaging the wrong binary."
-              exit 1
-            fi
-          else
-            echo "WARNING: Could not find $BINARY_TAR"
-          fi
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          # Also set for current directory in case Bazel uses different home
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push Shardok image to DO registry
-        id: push-shardok
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          # Use cross-compiled image path from build step
-          CROSS_IMAGE="${{ steps.build-shardok.outputs.image_path }}"
-          echo "Using cross-compiled image: $CROSS_IMAGE"
-
-          if [ -z "$CROSS_IMAGE" ] || [ ! -d "$CROSS_IMAGE" ]; then
-            echo "ERROR: Cross-compiled image not found at: $CROSS_IMAGE"
-            exit 1
-          fi
-
-          # Get crane from Eagle push target (which doesn't need cross-compilation)
-          # This gives us a macOS crane binary we can actually run.
-          # We can't build shardok_server_push with platform flags because it would
-          # download a Linux crane that can't run on macOS.
-          bazel build //ci:eagle_server_push
-
-          # Find the Darwin crane binary (may be a symlink)
-          RUNFILES="bazel-bin/ci/push_eagle_server_push.sh.runfiles"
-          CRANE=$(find "$RUNFILES" -path "*darwin*" -name crane 2>/dev/null | head -1)
-          if [ -z "$CRANE" ]; then
-            # Fallback to any crane
-            CRANE=$(find "$RUNFILES" -name crane 2>/dev/null | head -1)
-          fi
-          if [ -z "$CRANE" ] || [ ! -e "$CRANE" ]; then
-            echo "ERROR: crane not found. Listing runfiles:"
-            find "$RUNFILES" -name crane 2>/dev/null || true
-            exit 1
-          fi
-          echo "Using crane: $CRANE"
-
-          # Push the cross-compiled image with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/shardok-server:${GIT_SHA}"
-          echo "Pushing shardok image: $IMAGE_TAG"
-          $CRANE push "$CROSS_IMAGE" "$IMAGE_TAG"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience (but deploy won't use it)
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/shardok-server:latest"
-
-  build-admin:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-admin.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build Admin Server Docker image
-        id: build-admin
-        run: |
-          set -ex
-
-          # Build admin server image (Go binary has explicit goos/goarch in BUILD.bazel)
-          bazel build //ci:admin_server_image
-
-          # Save the resolved path before any other bazel command changes bazel-bin symlink
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/admin_server_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push Admin image to DO registry
-        id: push-admin
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          ADMIN_IMAGE="${{ steps.build-admin.outputs.image_path }}"
-          echo "Using Admin image: $ADMIN_IMAGE"
-
-          if [ -z "$ADMIN_IMAGE" ] || [ ! -d "$ADMIN_IMAGE" ]; then
-            echo "ERROR: Admin image not found at: $ADMIN_IMAGE"
-            exit 1
-          fi
-
-          # Build the push target to get crane in runfiles
-          bazel build //ci:admin_server_push
-
-          # Use crane directly for push
-          CRANE="bazel-bin/ci/push_admin_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
-          echo "Using crane: $CRANE"
-
-          # Push with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/admin-server:${GIT_SHA}"
-          echo "Pushing admin image: $IMAGE_TAG"
-          $CRANE push "$ADMIN_IMAGE" "$IMAGE_TAG"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/admin-server:latest"
-
-  build-jfr-sidecar:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-jfr-sidecar.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build JFR Sidecar Docker image
-        id: build-jfr-sidecar
-        run: |
-          set -ex
-
-          # Build JFR sidecar image (Go binary has explicit goos/goarch in BUILD.bazel)
-          bazel build //ci:jfr_sidecar_image
-
-          # Save the resolved path before any other bazel command changes bazel-bin symlink
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/jfr_sidecar_image)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-          mkdir -p .docker
-          cp ~/.docker/config.json .docker/
-
-      - name: Push JFR Sidecar image to DO registry
-        id: push-jfr-sidecar
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DOCKER_CONFIG: ${{ github.workspace }}/.docker
-        run: |
-          set -ex
-
-          JFR_IMAGE="${{ steps.build-jfr-sidecar.outputs.image_path }}"
-          echo "Using JFR Sidecar image: $JFR_IMAGE"
-
-          if [ -z "$JFR_IMAGE" ] || [ ! -d "$JFR_IMAGE" ]; then
-            echo "ERROR: JFR Sidecar image not found at: $JFR_IMAGE"
-            exit 1
-          fi
-
-          # Build the push target to get crane in runfiles
-          bazel build //ci:jfr_sidecar_push
-
-          # Use crane directly for push
-          CRANE="bazel-bin/ci/push_jfr_sidecar_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
-          echo "Using crane: $CRANE"
-
-          # Push with SHA tag
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/jfr-sidecar:${GIT_SHA}"
-          echo "Pushing JFR sidecar image: $IMAGE_TAG"
-          $CRANE push "$JFR_IMAGE" "$IMAGE_TAG"
-
-          # Output the full image tag for deploy step
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :latest for convenience
-          echo "Copying to :latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/jfr-sidecar:latest"
-
-  deploy:
-    runs-on: self-hosted
-    needs: [build-eagle, build-shardok, build-admin, build-jfr-sidecar]
-    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-    environment: production
-    env:
-      EAGLE_IMAGE: ${{ needs.build-eagle.outputs.image_tag }}
-      SHARDOK_IMAGE: ${{ needs.build-shardok.outputs.image_tag }}
-      ADMIN_IMAGE: ${{ needs.build-admin.outputs.image_tag }}
-      JFR_SIDECAR_IMAGE: ${{ needs.build-jfr-sidecar.outputs.image_tag }}
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-      GPT_MODEL_NAME: ${{ secrets.GPT_MODEL_NAME }}
-      EAGLE_ENABLE_S3: ${{ secrets.EAGLE_ENABLE_S3 }}
-      DO_SPACES_ACCESS_KEY: ${{ secrets.DO_SPACES_ACCESS_KEY }}
-      DO_SPACES_SECRET_KEY: ${{ secrets.DO_SPACES_SECRET_KEY }}
-      JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
-      DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
-      DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
-      GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
-      GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
-      SHARDOK_ADDRESS: ${{ secrets.SHARDOK_ADDRESS }}
-      SHARDOK_AUTH_TOKEN: ${{ secrets.SHARDOK_AUTH_TOKEN }}
-      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      DO_DROPLET_IP: ${{ secrets.DO_DROPLET_IP }}
-      DO_REGISTRY_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup SSH key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DO_SSH_KEY }}" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -H "$DO_DROPLET_IP" >> ~/.ssh/known_hosts 2>/dev/null || true
-
-      - name: Build warmup tool
-        run: |
-          bazel build //src/main/go/net/eagle0/warmup:warmup_linux_amd64
-          mkdir -p scripts/bin
-          cp bazel-bin/src/main/go/net/eagle0/warmup/warmup_linux_amd64_/warmup_linux_amd64 scripts/bin/warmup
-
-      - name: Copy config files to droplet
-        run: |
-          # Create directory structure on remote
-          ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" "mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx"
-          # Copy files preserving structure
-          scp -i ~/.ssh/deploy_key docker-compose.prod.yml deploy@"$DO_DROPLET_IP":/opt/eagle0/
-          scp -i ~/.ssh/deploy_key nginx/nginx.conf deploy@"$DO_DROPLET_IP":/opt/eagle0/nginx/
-          scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/
-          scp -i ~/.ssh/deploy_key scripts/bin/warmup deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/bin/
-
-      - name: Deploy to production droplet
-        run: |
-          ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" bash -s << DEPLOY_SCRIPT
-          set -ex
-          cd /opt/eagle0
-
-          # Environment variables passed via heredoc
-          EAGLE_IMAGE="${EAGLE_IMAGE}"
-          SHARDOK_IMAGE="${SHARDOK_IMAGE}"
-          ADMIN_IMAGE="${ADMIN_IMAGE}"
-          JFR_SIDECAR_IMAGE="${JFR_SIDECAR_IMAGE}"
-          OPENAI_API_KEY="${OPENAI_API_KEY}"
-          GPT_MODEL_NAME="${GPT_MODEL_NAME}"
-          EAGLE_ENABLE_S3="${EAGLE_ENABLE_S3}"
-          DO_SPACES_ACCESS_KEY="${DO_SPACES_ACCESS_KEY}"
-          DO_SPACES_SECRET_KEY="${DO_SPACES_SECRET_KEY}"
-          JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
-          DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
-          DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
-          GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
-          GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
-          SHARDOK_ADDRESS="${SHARDOK_ADDRESS}"
-          SHARDOK_AUTH_TOKEN="${SHARDOK_AUTH_TOKEN}"
-          SENTRY_DSN="${SENTRY_DSN}"
-          DO_REGISTRY_TOKEN="${DO_REGISTRY_TOKEN}"
-
-          # Check Docker has IPv6 support for connecting to Hetzner Shardok
-          # (One-time setup: sudo tee /etc/docker/daemon.json <<< '{"ipv6": true, "ip6tables": true, "experimental": true, "fixed-cidr-v6": "fd00::/80"}' && sudo systemctl restart docker)
-          if ! cat /etc/docker/daemon.json 2>/dev/null | grep -q '"ip6tables"'; then
-            echo "WARNING: Docker IPv6 not configured. Eagle may not reach Hetzner Shardok."
-            echo "Run: sudo tee /etc/docker/daemon.json <<< '{\"ipv6\": true, \"ip6tables\": true, \"experimental\": true, \"fixed-cidr-v6\": \"fd00::/80\"}' && sudo systemctl restart docker"
-          fi
-
-          # Write env vars to .env file for docker-compose
-          # Preserve AUTH_IMAGE if it exists (managed by auth_build.yml)
-          EXISTING_AUTH_IMAGE=""
-          if [ -f .env ]; then
-            EXISTING_AUTH_IMAGE=\$(grep '^AUTH_IMAGE=' .env | cut -d= -f2- || true)
-          fi
-
-          rm -f .env 2>/dev/null || true
-          cat > .env << EOF
-          EAGLE_IMAGE=\${EAGLE_IMAGE}
-          SHARDOK_IMAGE=\${SHARDOK_IMAGE}
-          ADMIN_IMAGE=\${ADMIN_IMAGE}
-          JFR_SIDECAR_IMAGE=\${JFR_SIDECAR_IMAGE}
-          AUTH_IMAGE=\${EXISTING_AUTH_IMAGE:-registry.digitalocean.com/eagle0/auth-server:latest}
-          OPENAI_API_KEY=\${OPENAI_API_KEY:-}
-          GPT_MODEL_NAME=\${GPT_MODEL_NAME:-gpt-4o}
-          EAGLE_ENABLE_S3=\${EAGLE_ENABLE_S3:-false}
-          DO_SPACES_ACCESS_KEY=\${DO_SPACES_ACCESS_KEY:-}
-          DO_SPACES_SECRET_KEY=\${DO_SPACES_SECRET_KEY:-}
-          JWT_PRIVATE_KEY=\${JWT_PRIVATE_KEY:-}
-          DISCORD_CLIENT_ID=\${DISCORD_CLIENT_ID:-}
-          DISCORD_CLIENT_SECRET=\${DISCORD_CLIENT_SECRET:-}
-          GOOGLE_CLIENT_ID=\${GOOGLE_CLIENT_ID:-}
-          GOOGLE_CLIENT_SECRET=\${GOOGLE_CLIENT_SECRET:-}
-          SHARDOK_ADDRESS=\${SHARDOK_ADDRESS:-shardok:40042}
-          SHARDOK_AUTH_TOKEN=\${SHARDOK_AUTH_TOKEN:-}
-          SENTRY_DSN=\${SENTRY_DSN:-}
-          EOF
-          chmod 600 .env
-
-          # Login to registry
-          echo "\$DO_REGISTRY_TOKEN" | docker login registry.digitalocean.com -u "\$DO_REGISTRY_TOKEN" --password-stdin
-
-          # Use exact image tags passed from build jobs (no :latest fallback)
-          # Note: AUTH_IMAGE is managed separately by auth_build.yml
-          echo "Using images: \$EAGLE_IMAGE, \$SHARDOK_IMAGE, \$ADMIN_IMAGE, \$JFR_SIDECAR_IMAGE"
-
-          # Use crane to pull images (handles OCI format correctly) then load into Docker
-          # This avoids digest mismatch from DO registry's OCI->Docker format conversion
-          echo "Installing crane..."
-          curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
-          chmod +x crane
-
-          # crane uses Docker config for auth
-          echo "Pulling Eagle image with crane..."
-          ./crane pull "\${EAGLE_IMAGE}" eagle.tar || { echo "ERROR: Failed to pull eagle image"; exit 1; }
-          echo "Loading Eagle image into Docker..."
-          docker load -i eagle.tar
-          rm eagle.tar
-
-          echo "Pulling Shardok image with crane..."
-          ./crane pull "\${SHARDOK_IMAGE}" shardok.tar || { echo "ERROR: Failed to pull shardok image"; exit 1; }
-          echo "Loading Shardok image into Docker..."
-          docker load -i shardok.tar
-          rm shardok.tar
-
-          echo "Pulling Admin image with crane..."
-          ./crane pull "\${ADMIN_IMAGE}" admin.tar || { echo "ERROR: Failed to pull admin image"; exit 1; }
-          echo "Loading Admin image into Docker..."
-          docker load -i admin.tar
-          rm admin.tar
-
-          echo "Pulling JFR Sidecar image with crane..."
-          ./crane pull "\${JFR_SIDECAR_IMAGE}" jfr-sidecar.tar || { echo "ERROR: Failed to pull jfr-sidecar image"; exit 1; }
-          echo "Loading JFR Sidecar image into Docker..."
-          docker load -i jfr-sidecar.tar
-          rm jfr-sidecar.tar
-
-          rm ./crane
-
-          # Also pull other compose images
-          docker pull nginx:alpine || true
-          docker pull certbot/certbot || true
-
-          echo "All images pulled successfully"
-
-          # Recreate non-Eagle services (not auth - managed by auth_build.yml)
-          # Note: jfr-sidecar must start after eagle-blue due to PID namespace sharing
-          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate shardok admin
-
-          # Deploy Eagle with blue-green (zero-downtime) if scripts are available
-          if [ -x "/opt/eagle0/scripts/deploy-blue-green.sh" ]; then
-            echo "Using blue-green deployment for Eagle..."
-            chmod +x /opt/eagle0/scripts/*.sh
-            # Make warmup binary executable if present
-            if [ -f "/opt/eagle0/scripts/bin/warmup" ]; then
-              chmod +x /opt/eagle0/scripts/bin/warmup
-            fi
-            GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://')
-            /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}" || {
-              echo "Blue-green deployment failed, falling back to direct restart"
-              docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate eagle-blue
-            }
-          else
-            echo "Blue-green scripts not found, using direct restart..."
-            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate eagle-blue
-          fi
-
-          # Start jfr-sidecar after eagle-blue (shares PID namespace with eagle-blue)
-          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate jfr-sidecar
-
-          # Ensure auth is running (but don't force-recreate it)
-          docker compose -f docker-compose.prod.yml up -d auth
-
-          # Restart nginx to pick up new container IPs
-          # (nginx caches DNS at startup, so it needs restart after eagle/shardok)
-          docker compose -f docker-compose.prod.yml up -d --force-recreate nginx
-
-          # Cleanup orphaned containers
-          docker compose -f docker-compose.prod.yml up -d --remove-orphans
-
-          # Wait for health checks
-          sleep 10
-          docker compose -f docker-compose.prod.yml ps
-
-          # Verify containers are using correct images
-          echo "=== Verifying container image tags ==="
-          docker compose -f docker-compose.prod.yml images
-
-          # Cleanup old images
-          docker image prune -f
-          DEPLOY_SCRIPT

.github/workflows/mac_history_build.yml

@@ -0,0 +1,29 @@
+name: Mac History Editor Build
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - ".github/workflows/mac_history_build.yml"
+      - "src/main/swift/net/eagle0/EagleGameHistoryViewer/**"
+      - "src/main/protobuf/net/eagle0/eagle/**"
+  pull_request:
+    paths:
+      - ".github/workflows/mac_history_build.yml"
+      - "src/main/swift/net/eagle0/EagleGameHistoryViewer/**"
+      - "src/main/protobuf/net/eagle0/eagle/**"
+
+permissions:
+  contents: read
+
+jobs:
+  mac-history-build:
+    runs-on: self-hosted
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: false
+          clean: false
+      - name: Build the mac history
+        run: ./ci/github_actions/build_mac_history.sh

.github/workflows/registry_cleanup.yml

@@ -1,92 +0,0 @@
-name: Cleanup Old Container Images
-
-on:
-  schedule:
-    # Run daily at 3am UTC
-    - cron: '0 3 * * *'
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Dry run (show what would be deleted without deleting)'
-        required: true
-        default: 'true'
-        type: boolean
-
-permissions:
-  contents: read
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install doctl
-        uses: digitalocean/action-doctl@v2
-        with:
-          token: ${{ secrets.DO_REGISTRY_TOKEN }}
-
-      - name: Cleanup old images
-        env:
-          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true' }}
-        run: |
-          set -e
-
-          RETENTION_DAYS=5
-          CUTOFF_DATE=$(date -d "-${RETENTION_DAYS} days" +%s)
-          REGISTRY="eagle0"
-
-          echo "Cleaning up images older than ${RETENTION_DAYS} days"
-          echo "Cutoff date: $(date -d "@${CUTOFF_DATE}" -Iseconds)"
-          echo "Dry run: ${DRY_RUN}"
-          echo ""
-
-          # List of repositories to clean
-          # Use tail to skip header row in case --no-header doesn't work
-          REPOS=$(doctl registry repository list-v2 --format Name --no-header | grep -v '^Name$' | grep -v '^$')
-
-          for REPO in $REPOS; do
-            echo "=== Processing repository: ${REPO} ==="
-
-            # Get all manifests with their tags and dates
-            # Filter out header row and empty lines
-            MANIFESTS=$(doctl registry repository list-manifests "${REPO}" --format Digest,UpdatedAt,Tags --no-header 2>/dev/null | grep -v '^Digest' | grep -v '^$' || echo "")
-
-            if [ -z "$MANIFESTS" ]; then
-              echo "  No manifests found"
-              continue
-            fi
-
-            echo "$MANIFESTS" | while read -r DIGEST UPDATED_AT TAGS; do
-              # Skip if no digest or if it doesn't look like a valid digest (sha256:...)
-              if [ -z "$DIGEST" ] || ! echo "$DIGEST" | grep -q '^sha256:'; then
-                continue
-              fi
-
-              # Parse the date
-              MANIFEST_DATE=$(date -d "$UPDATED_AT" +%s 2>/dev/null || echo "0")
-
-              # Skip protected tags (latest, arm64-latest)
-              if echo "$TAGS" | grep -qE '(^|,)(latest|arm64-latest)(,|$)'; then
-                echo "  KEEP: ${DIGEST:0:20}... (protected tag: $TAGS)"
-                continue
-              fi
-
-              # Check if older than cutoff
-              if [ "$MANIFEST_DATE" -lt "$CUTOFF_DATE" ]; then
-                echo "  DELETE: ${DIGEST:0:20}... (updated: $UPDATED_AT, tags: $TAGS)"
-                if [ "$DRY_RUN" != "true" ]; then
-                  doctl registry repository delete-manifest "${REPO}" "$DIGEST" --force
-                fi
-              else
-                echo "  KEEP: ${DIGEST:0:20}... (updated: $UPDATED_AT, tags: $TAGS)"
-              fi
-            done
-
-            echo ""
-          done
-
-      - name: Run garbage collection
-        if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'false')
-        run: |
-          echo "Starting garbage collection..."
-          doctl registry garbage-collection start --force
-          echo "Garbage collection started. It may take a few minutes to complete."

.github/workflows/shardok_arm64_build.yml

@@ -1,221 +0,0 @@
-name: Shardok ARM64 Build and Push
-
-on:
-  push:
-    branches: [ "main" ]
-    paths:
-      - 'src/main/cpp/**'
-      - 'src/main/protobuf/net/eagle0/shardok/**'
-      - 'src/main/protobuf/net/eagle0/common/**'
-      - 'src/main/resources/net/eagle0/shardok/**'
-      - 'ci/BUILD.bazel'
-      - 'MODULE.bazel'
-      - '.github/workflows/shardok_arm64_build.yml'
-  workflow_dispatch:
-    inputs:
-      push_images:
-        description: 'Push images to container registry'
-        required: true
-        default: 'true'
-        type: boolean
-
-permissions:
-  contents: read
-
-jobs:
-  build-shardok-arm64:
-    runs-on: self-hosted
-    outputs:
-      image_tag: ${{ steps.push-shardok.outputs.image_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Build Shardok ARM64 binary (cross-compile for Linux ARM64)
-        run: |
-          set -ex
-
-          echo "=== Building shardok-server binary for linux-aarch64 ==="
-          bazel build \
-            --platforms=//:linux_arm64 \
-            --extra_toolchains=@llvm_toolchain_linux_arm64//:all \
-            //src/main/cpp/net/eagle0/shardok:shardok-server
-
-          LINUX_BIN="bazel-bin/src/main/cpp/net/eagle0/shardok/shardok-server"
-          echo "=== Checking binary at: $LINUX_BIN ==="
-
-          if [ ! -f "$LINUX_BIN" ]; then
-            echo "ERROR: Binary not found at $LINUX_BIN"
-            exit 1
-          fi
-
-          # Verify it's ELF (Linux) not Mach-O (macOS)
-          echo "=== Verifying binary format ==="
-          MAGIC=$(head -c 4 "$LINUX_BIN" | xxd -p)
-          echo "Binary magic bytes: $MAGIC"
-
-          if [ "$MAGIC" = "7f454c46" ]; then
-            echo "SUCCESS: Binary is ELF format (Linux)"
-            # Check if it's ARM64 (e_machine = 0xB7 = 183 for aarch64)
-            E_MACHINE=$(od -An -j18 -N2 -tx2 "$LINUX_BIN" | tr -d ' ')
-            echo "ELF e_machine: $E_MACHINE"
-            if [ "$E_MACHINE" = "b700" ]; then
-              echo "SUCCESS: Binary is ARM64 (aarch64)"
-            else
-              echo "WARNING: Binary e_machine is $E_MACHINE (expected b700 for aarch64)"
-            fi
-          elif [ "$MAGIC" = "cfaeedfe" ] || [ "$MAGIC" = "cffaedfe" ]; then
-            echo "ERROR: Binary is Mach-O format (macOS) - cross-compilation failed!"
-            exit 1
-          else
-            echo "WARNING: Unknown binary format: $MAGIC"
-            file "$LINUX_BIN" || true
-          fi
-
-      - name: Build Shardok ARM64 Docker image
-        id: build-shardok
-        run: |
-          set -ex
-
-          bazel build \
-            --platforms=//:linux_arm64 \
-            --extra_toolchains=@llvm_toolchain_linux_arm64//:all \
-            //ci:shardok_server_image_arm64
-
-          IMAGE_PATH=$(readlink -f bazel-bin/ci/shardok_server_image_arm64)
-          echo "Image path: $IMAGE_PATH"
-          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
-
-          # Verify the binary inside the tar layer is ARM64 ELF
-          echo "=== Verifying binary in image tar ==="
-          BINARY_TAR="bazel-bin/ci/shardok_binary_layer_arm64.tar"
-          if [ -f "$BINARY_TAR" ]; then
-            echo "Checking binary in $BINARY_TAR"
-            MAGIC=$(tar -xOf "$BINARY_TAR" app/shardok-server 2>/dev/null | head -c 4 | xxd -p)
-            echo "Binary magic in tar: $MAGIC"
-            if [ "$MAGIC" = "7f454c46" ]; then
-              echo "SUCCESS: Binary in tar is ELF format (Linux)"
-            else
-              echo "ERROR: Binary in tar is NOT ELF format!"
-              exit 1
-            fi
-          else
-            echo "WARNING: Could not find $BINARY_TAR"
-          fi
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_REGISTRY_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
-        run: |
-          AUTH=$(echo -n "${DO_REGISTRY_TOKEN}:${DO_REGISTRY_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
-
-      - name: Push Shardok ARM64 image to DigitalOcean
-        id: push-shardok
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        run: |
-          set -ex
-
-          CROSS_IMAGE="${{ steps.build-shardok.outputs.image_path }}"
-          echo "Using cross-compiled image: $CROSS_IMAGE"
-
-          if [ -z "$CROSS_IMAGE" ] || [ ! -d "$CROSS_IMAGE" ]; then
-            echo "ERROR: Cross-compiled image not found at: $CROSS_IMAGE"
-            exit 1
-          fi
-
-          # Build a push target to get crane in runfiles
-          bazel build //ci:eagle_server_push
-
-          # Find the Darwin crane binary
-          RUNFILES="bazel-bin/ci/push_eagle_server_push.sh.runfiles"
-          CRANE=$(find "$RUNFILES" -path "*darwin*" -name crane 2>/dev/null | head -1)
-          if [ -z "$CRANE" ]; then
-            CRANE=$(find "$RUNFILES" -name crane 2>/dev/null | head -1)
-          fi
-          if [ -z "$CRANE" ] || [ ! -e "$CRANE" ]; then
-            echo "ERROR: crane not found"
-            exit 1
-          fi
-          echo "Using crane: $CRANE"
-
-          # Push with arm64-prefixed SHA tag (same repo as x86, different tag)
-          GIT_SHA=$(git rev-parse --short=8 HEAD)
-          IMAGE_TAG="registry.digitalocean.com/eagle0/shardok-server:arm64-${GIT_SHA}"
-          echo "Pushing shardok ARM64 image: $IMAGE_TAG"
-          $CRANE push "$CROSS_IMAGE" "$IMAGE_TAG"
-
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          # Also update :arm64-latest tag for convenience
-          echo "Copying to :arm64-latest tag"
-          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/shardok-server:arm64-latest"
-
-          echo "=== Push complete ==="
-          echo "Image: $IMAGE_TAG"
-          echo "Also tagged as: registry.digitalocean.com/eagle0/shardok-server:arm64-latest"
-
-  deploy-hetzner:
-    runs-on: self-hosted
-    needs: [build-shardok-arm64]
-    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-    environment: production
-    env:
-      SHARDOK_IMAGE: ${{ needs.build-shardok-arm64.outputs.image_tag }}
-    steps:
-      - name: Setup SSH key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.HETZNER_SSH_KEY }}" > ~/.ssh/hetzner_deploy
-          chmod 600 ~/.ssh/hetzner_deploy
-          # Add host key to known_hosts to avoid prompt
-          ssh-keyscan -H ${{ secrets.HETZNER_IP }} >> ~/.ssh/known_hosts 2>/dev/null || true
-
-      - name: Deploy to Hetzner
-        run: |
-          ssh -i ~/.ssh/hetzner_deploy -o StrictHostKeyChecking=accept-new deploy@${{ secrets.HETZNER_IP }} << 'ENDSSH'
-          set -ex
-          cd /opt/eagle0
-
-          # Login to registry
-          echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "${{ secrets.DO_REGISTRY_TOKEN }}" --password-stdin
-
-          echo "Deploying Shardok ARM64: ${{ needs.build-shardok-arm64.outputs.image_tag }}"
-
-          # Pull the new image
-          docker pull "${{ needs.build-shardok-arm64.outputs.image_tag }}"
-
-          # Stop and remove any container using port 40042 or named shardok*
-          docker ps -q --filter "publish=40042" | xargs -r docker stop
-          docker ps -aq --filter "name=shardok" | xargs -r docker rm -f
-          docker ps -aq --filter "publish=40042" | xargs -r docker rm -f
-
-          # Run new container
-          docker run -d \
-            --name shardok-ai \
-            --restart unless-stopped \
-            -p 40042:40042 \
-            -v /opt/eagle0/data:/data \
-            -v /etc/shardok:/etc/shardok:ro \
-            -v /etc/letsencrypt:/etc/letsencrypt:ro \
-            -v /usr/local/share/eagle0:/usr/local/share/eagle0:ro \
-            -e SHARDOK_RESOURCES_PATH=/app/resources \
-            -e SHARDOK_MAPS_PATH=/app/resources/maps \
-            "${{ needs.build-shardok-arm64.outputs.image_tag }}"
-
-          # Wait and verify
-          sleep 5
-          docker ps | grep shardok-ai
-
-          # Cleanup old images
-          docker image prune -f
-
-          echo "=== Hetzner deployment complete ==="
-          ENDSSH
-
-      - name: Cleanup SSH key
-        if: always()
-        run: rm -f ~/.ssh/hetzner_deploy

.github/workflows/unity_build.yml

@@ -52,14 +52,14 @@ jobs:
       - name: Persist Library/
         run: ./ci/github_actions/persist_library.sh
       - name: Deploy Windows unity
-        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: success() #&& github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
         run: bazel run //src/main/go/net/eagle0/build/unity3d_windows_build_handler:unity3d_windows_build_handler -- "/tmp/eagle0/eagle0WIN" "/tmp/unity_manifest.txt"
 
       - name: Update unified manifest
-        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: success() #&& github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}

.gitignore

@@ -37,4 +37,3 @@ scripts/refresh_name_layers/refresh_name_layers.zip
 .metals
 api_keys.txt
 
-src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/Packages/com.unity.dedicated-server/

.pre-commit-config.yaml

@@ -32,6 +32,12 @@ repos:
       - id: gazelle
         name: gazelle
         language: system
-        entry: ./scripts/pre-commit-gazelle.sh
+        entry: bazel run //:gazelle
         files: '(\.go|\.proto|BUILD\.bazel|BUILD|WORKSPACE|WORKSPACE\.bazel|\.bzl)$'
-        pass_filenames: false
+-   repo: local
+    hooks:
+    -   id: update-action-result-types
+        name: update-action-result-types
+        language: system
+        entry: ./scripts/updateActionResultTypes.sh
+        files: 'src/main/protobuf/net/eagle0/eagle/common/action_result_type.proto'

BUILD.bazel

@@ -3,24 +3,6 @@ load("@io_bazel_rules_go//go:def.bzl", "nogo")
 
 package(default_visibility = ["//visibility:public"])
 
-# Platform for cross-compiling to Linux x86_64
-platform(
-    name = "linux_x86_64",
-    constraint_values = [
-        "@platforms//os:linux",
-        "@platforms//cpu:x86_64",
-    ],
-)
-
-# Platform for cross-compiling to Linux ARM64
-platform(
-    name = "linux_arm64",
-    constraint_values = [
-        "@platforms//os:linux",
-        "@platforms//cpu:aarch64",
-    ],
-)
-
 gazelle(name = "gazelle")
 
 # gazelle:proto file

CLAUDE.md

@@ -85,16 +85,6 @@ bazel run gazelle              # Update Go build files
 ./scripts/updateActionResultTypes.sh   # Update protocol buffer mappings
 ```
 
-### Pre-Commit Checklist
-
-**MANDATORY: Before running `git commit`, verify:**
-
-1. **If you modified any BUILD.bazel file:** Run `bazel run gazelle` and stage any changes it makes
-2. **If you modified C++ or C# files:** Run `clang-format -i` on the modified files
-3. **If you modified Scala files:** scalafmt will run automatically via pre-commit hook
-
-The pre-commit hook runs gazelle but only checks if it succeeds - it does NOT verify the BUILD files are in canonical format. The `gazelle_test` will fail if deps are not alphabetically sorted. **Always run gazelle manually after BUILD file changes.**
-
 ### Code Formatting
 
 ```bash
@@ -216,31 +206,6 @@ to be used for different players or game situations within the same server proce
 - Map validation tests ensure game content integrity
 - Use `GameSettings_test_utils.cpp` and `ShardokEngineBasedTestData.cpp` for C++ test helpers
 
-### Scala Testing Patterns
-
-**Use `inside()` instead of `asInstanceOf` for type matching in tests:**
-
-Never use `asInstanceOf` in tests. Instead, use ScalaTest's `inside()` pattern for safe type matching:
-
-```scala
-// BAD - don't do this
-val changedHero = result.changedHeroes.head.asInstanceOf[ChangedHeroC]
-changedHero.heroId shouldBe 19
-
-// GOOD - use inside() pattern
-import org.scalatest.Inside.inside
-
-inside(result.changedHeroes.head) { case changedHero: ChangedHeroC =>
-  changedHero.heroId shouldBe 19
-  changedHero.vigorChange shouldBe StatDelta(17.2)
-}
-```
-
-The `inside()` pattern:
-- Provides better error messages when the type doesn't match
-- Is idiomatic ScalaTest
-- Works with pattern matching for more complex assertions
-
 ## Performance Testing
 
 When making performance-related changes to the AI or engine:
@@ -279,32 +244,6 @@ done
 - **Always test performance changes** - what seems like an optimization may sometimes have unexpected overhead or
   behavior changes.
 
-## Troubleshooting Scala Build Errors
-
-### MissingType Errors
-
-When you see errors like:
-```
-dotty.tools.dotc.core.MissingType: Cannot resolve reference to type net.eagle0.eagle.internal.game_state.type.GameState
-```
-
-**This is NOT a Scala compiler crash.** This is a missing dependency in BUILD.bazel.
-
-**How to fix:**
-1. Identify the missing type from the error message (e.g., `game_state.GameState`)
-2. Find the Bazel target that provides this type (e.g., `//src/main/protobuf/net/eagle0/eagle/internal:game_state_scala_proto`)
-3. Add it to the `deps` of the failing target
-4. If the type appears in a public method signature, also add it to `exports` so downstream targets can see it
-
-**Common pattern:** When adding a method to a class that takes or returns a proto type, the proto dependency often needs to be added to both `deps` AND `exports`.
-
-### Bazel Clean
-
-**NEVER run `bazel clean` without asking first.** It rarely fixes actual issues and wastes significant rebuild time. The issues that seem like they need `bazel clean` are usually:
-- Missing imports in Scala code
-- Missing dependencies in BUILD.bazel
-- Missing exports for types used in public signatures
-
 ## Game Content
 
 **Maps:** `.e0mj` files in `/src/main/resources/net/eagle0/shardok/maps/`

DEPROTO_PLAN.md

@@ -1,213 +0,0 @@
-# Deproto Migration Plan
-
-This document tracks the migration from protobuf types to native Scala models inside the Eagle game engine.
-
-## Architectural Decisions
-
-1. **Keep proto for persistence**: Yes - protobuf is used for persisting game state
-2. **Keep proto for Shardok communication**: Yes - protobuf is used for Eagle-Shardok gRPC communication
-3. **Use Scala views inside the library**: Yes - use native Scala types like `ProvinceView`, `FactionView`, `HeroView`, etc. within the library code
-
-## Recent Completed Work
-
-### GameState Round-Trip Elimination (PRs #4913, #4914, #4915)
-
-Eliminated wasteful Scala→proto→Scala conversions in the hot path:
-
-1. **LLM Pipeline** (#4913): `LlmRequestWithGameState` now uses Scala `GameState` instead of proto. All ~38 prompt generators updated to use Scala model types (`FactionT`, `HeroT`, `ProvinceT`).
-
-2. **ActionWithResultingState Caching** (#4914): Added `precomputedScalaState: Option[GameState]` to cache Scala state when available, avoiding `fromProto()` conversion in `stateAfter()`.
-
-3. **PostResults Simplification** (#4915): Changed `PostResults.gameState` from proto to `Option[GameState]` (Scala), eliminating `toProto()` calls when creating PostResults.
-
-## Migration Pattern
-
-The codebase follows a **Legacy* pattern** for separating proto-dependent and protoless code:
-
-- **Protoless utilities**: `FactionUtils`, `HeroUtils`, `ProvinceUtils`, `ProvinceDistances`, etc.
-- **Proto-dependent utilities**: `LegacyFactionUtils`, `LegacyHeroUtils`, `LegacyProvinceUtils`, `LegacyProvinceDistances`, etc.
-
-When migrating a file:
-1. Create a `Legacy*` version containing the proto-dependent methods
-2. Keep the original file name for protoless methods
-3. Update callers to use the appropriate version based on their context
-
-## Migration Status
-
-### Fully Protoless (no proto imports)
-
-**Utilities:**
-- [x] `FactionUtils` - has protoless `ownedNeighbors` method
-- [x] `ProvinceDistances` - split into protoless + `LegacyProvinceDistances`
-- [x] `SwornBrotherChooser` - fully protoless (removed `bestChoiceProto`)
-
-**Command Selectors (all use native GameState):**
-- [x] `AllianceOfferCommandSelector`
-- [x] `AlmsCommandSelector`
-- [x] `AttackCommandChooser`
-- [x] `ExpandCommandSelector`
-- [x] `HeroGiftCommandSelector`
-- [x] `ImproveCommandSelector`
-- [x] `MarchTowardProvinceCommandChooser` - in AI folder, uses native GameState (callers convert)
-- [x] `OrganizeCommandSelector`
-- [x] `RansomOfferHelpers`
-- [x] `SeekMoreLeadersCommandChooser` - in AI folder, uses native GameState
-- [x] `TruceOfferCommandSelector`
-- [x] `TrustForDiplomacy`
-
-**Quest Command Selectors (all protoless):**
-- [x] `AllianceQuestCommandChooser`
-- [x] `AlmsAcrossRealmQuestCommandChooser`
-- [x] `AlmsToProvinceQuestCommandChooser`
-- [x] `DismissSpecificVassalCommandChooser`
-- [x] `GiveToHeroesAcrossRealmQuestCommandChooser`
-- [x] `GiveToHeroesInProvinceQuestCommandChooser`
-- [x] `ImproveQuestCommandChooser`
-- [x] `QuestCommandChooser`
-- [x] `TruceCountQuestCommandChooser`
-- [x] `TruceWithFactionQuestCommandChooser`
-
-### Fully Protoless
-
-- [x] `AIClientUtils` - has protoless overloads (`takenHeroIdsForMarchTowardFocus`, `mostPowerfulHeroes`)
-- [x] `AttackCommandChooser` - uses Scala `GameState` and `BattalionViewC` (Scala view type)
-- [x] `BattalionPower` - has `estimatedPower(BattalionViewC)` for recon data with optional stats
-- [x] `CommandChoiceHelpers` - fully protoless, uses Scala `GameState` throughout
-- [x] `ProvinceGoldSurplusCalculator` - fully protoless (callers use converters)
-- [x] `HeroSelector` - fully protoless (removed dead `minimallyFatiguedHeroesProto`)
-
-### AI Layer ✅ COMPLETE
-
-All AI and command chooser code is now fully protoless:
-- [x] `AttackDecisionCommandChooser` - uses Scala GameState
-- [x] `CommandChooser` - trait uses Scala GameState
-- [x] `FulfillQuestsCommandSelector` - uses Scala GameState
-- [x] `MidGameAIClient` - uses Scala GameState internally
-
-### Still Using Proto GameState (Boundary Code)
-
-These files use proto GameState because they're at system boundaries:
-
-**View Filters (client projection):**
-- `view_filters/GameStateViewFilter` - has Scala overload, uses Scala sub-filters
-- `view_filters/ProvinceViewFilter` - has Scala overloads for some methods
-- `view_filters/FactionViewFilter` - has Scala overload
-- `view_filters/HeroViewFilter` - has Scala overload
-- `view_filters/BattalionNameFilter` - has Scala overload
-- `view_filters/BattleFilter` - has Scala overload
-
-**Legacy Utilities (to be deprecated):**
-- `LegacyProvinceDistances`, `LegacyFactionUtils`, `LegacyHeroUtils`, etc.
-- Used by code that still needs proto GameState
-
-**Persistence/Action System:**
-- `ActionResultTApplier`, `ActionResultProtoApplier` - apply results to proto state
-- `ActionWithResultingState` - caches both proto and Scala state
-
-**Shardok Interface (gRPC boundary):**
-- `ShardokInterfaceGrpcClient`, `ShardokInterfaceProxy` - must use proto for C++ communication
-
-## Next Steps
-
-### Phase 1-3: AI Layer ✅ COMPLETE
-
-The entire AI decision-making layer is now protoless.
-
-### Phase 4: View Filters ✅ COMPLETE
-
-The view_filters package migration is complete:
-
-**Completed:**
-- [x] `GameStateViewFilter` - added Scala GameState overload (uses Scala sub-filters)
-- [x] `ProvinceViewFilter` - already has Scala overloads for server-side views
-- [x] `HumanPlayerClientConnectionState` - updated to pass Scala GameState directly
-- [x] `HeroViewFilter` - added Scala overload
-- [x] `FactionViewFilter` - added Scala overload
-- [x] `Visibility` - added Scala overloads
-
-**Still Using Proto:**
-- [x] `BattalionNameFilter` - has Scala overload
-- [x] `BattleFilter` - has Scala overload
-- [ ] `ActionResultFilter` - uses proto internally (boundary code)
-
-**Strategy:**
-1. Add Scala GameState overloads to view filter methods
-2. Update callers to pass Scala GameState where available
-3. Eventually deprecate proto versions
-
-### Phase 5: Legacy Utility Cleanup (IN PROGRESS)
-
-Remove Legacy* utilities by migrating remaining callers:
-1. Identify callers of each Legacy* util
-2. Update callers to use protoless versions
-3. Delete Legacy* files when no longer needed
-
-**Deleted (no production callers):**
-- [x] `LegacyProvinceDistances` - deleted (no callers)
-- [x] `LegacyBattalionSuitability` - deleted (no callers)
-- [x] `LegacyFoodConsumptionUtils` - deleted (no callers)
-- [x] `LegacyHandleRiotUtils` - deleted (no callers)
-
-**Refactored to Thin Wrappers (delegating to protoless versions):**
-- [x] `LegacyRansomValidity` - already a thin wrapper delegating to `RansomValidity`
-- [x] `LegacyRecruitmentOdds` - refactored to delegate to `RecruitmentOdds`
-
-**Parallel Implementations (proto mirrors protoless):**
-- [x] `FactionUtils` / `LegacyFactionUtils` - both have matching APIs; LegacyFactionUtils used by boundary code (24+ callers)
-- [x] `HeroUtils` / `LegacyHeroUtils` - both have matching APIs; LegacyHeroUtils used by boundary code (10 callers)
-- [x] `ProvinceUtils` / `LegacyProvinceUtils` - both have matching APIs; LegacyProvinceUtils used by boundary code (20 callers: availability factories, view filters)
-
-**Parallel Implementations (awaiting migration of callers):**
-- [x] `BattalionUtils` / `LegacyBattalionUtils` - both have matching core methods; LegacyBattalionUtils used by boundary code (4 callers)
-- [x] `BattalionViewFilter` / `LegacyBattalionViewFilter` - protoless version exists; Legacy used by view filters, action appliers (3 callers)
-- [x] `BattalionTypeFinder` / `LegacyBattalionTypeFinder` - protoless version exists; Legacy used by validators (1 caller: RuntimeValidator)
-
-### Recent Caller Migration
-
-**CheckForFulfilledQuestsAction** - migrated to use protoless `BattalionTypeFinder`:
-- Changed `battalionTypes` parameter from proto `Vector[BattalionType]` to Scala `Vector[BattalionType]`
-- Updated callers (EngineImpl, EndVassalCommandsPhaseAction) to pass Scala types directly
-- Eliminated wasteful `BattalionTypeConverter.toProto()` conversions
-
-**ExpandedUnaffiliatedHeroUtils** - added Scala overload:
-- New overload takes Scala `GameState` and `UnaffiliatedHeroT` directly
-- Added `UnaffiliatedHeroConverter.unaffiliatedHeroTypeToProto()` helper for efficient enum conversion
-- Proto overload retained for backward compatibility
-
-**AvailablePleaseRecruitMeCommandFactory** - eliminated wasteful proto conversions:
-- Now uses `ExpandedUnaffiliatedHeroUtils.expandedUnaffiliatedHero(ScalaGameState, UnaffiliatedHeroT)` directly
-- Removed `GameStateConverter.toProto()` and `UnaffiliatedHeroConverter.toProto()` calls
-- Factory is now fully protoless internally (still returns proto types for API boundary)
-
-**ProvinceViewFilter** - added Scala overload with faction filtering:
-- New `filteredProvinceView(province: ProvinceT, gs: ScalaGameState, factionId: FactionId)` overload
-- Uses protoless `FactionUtils.hasAlliance`, `Visibility.hasFullVisibility`, and `ProvinceUtils.incomingOthers`
-- Handles reconned provinces directly from Scala `FactionT.reconnedProvinces` (already Scala type)
-- Added helper methods: `fullProvinceInfoScala`, `maybeIncomingAttackersScala`, `unaffiliatedHeroInfoScala`
-- Events still converted to proto at the end (ProvinceView.knownEvents uses proto events)
-
-**GameStateViewFilter** - eliminated GameStateConverter.toProto() call:
-- Scala overload now fully protoless internally
-- Uses the new ProvinceViewFilter Scala overload with faction filtering
-- Converts `battalionTypes` and `chronicleEntries` to proto only at output boundary
-
-## Key Files
-
-### Protoless Model Types
-
-- `src/main/scala/net/eagle0/eagle/model/state/game_state/GameState.scala` - native Scala GameState
-- `src/main/scala/net/eagle0/eagle/model/state/province/ProvinceView.scala` - province view type
-- `src/main/scala/net/eagle0/eagle/model/state/faction/FactionView.scala` - faction view type
-- `src/main/scala/net/eagle0/eagle/model/state/hero/HeroView.scala` - hero view type
-
-### Proto Converters
-
-- `src/main/scala/net/eagle0/eagle/model/proto_converters/game_state/` - converts between proto and Scala types
-
-## Notes
-
-- The AI client code (`src/main/scala/net/eagle0/eagle/ai/`) is now fully protoless
-- Proto GameState is still needed at boundaries: persistence, gRPC to Shardok
-- `PerformUnaffiliatedHeroesAction` and the LLM pipeline use protoless `GameState`
-- `GameStateViewFilter` Scala overload is now fully protoless internally (converts to proto only at output)
-- `ProvinceViewFilter` has Scala overloads for all three modes: no filtering, faction filtering, and withdrawn-from view

MODULE.bazel

@@ -26,99 +26,56 @@ scala_config = use_extension(
     "@rules_scala//scala/extensions:config.bzl",
     "scala_config",
 )
+
 scala_config.settings(scala_version = SCALA_VERSION)
 
 scala_deps = use_extension(
     "@rules_scala//scala/extensions:deps.bzl",
     "scala_deps",
 )
+
 scala_deps.scala()
+
 scala_deps.scalatest()
+
 scala_deps.scala_proto()
 
 #
 # Language Support - C++
 #
 
-bazel_dep(name = "toolchains_llvm", version = "1.6.0")
+bazel_dep(name = "toolchains_llvm", version = "1.4.0")
 
 llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
 
-# Native toolchain (macOS -> macOS, Linux -> Linux)
 llvm.toolchain(
     name = "llvm_toolchain",
     llvm_version = "20.1.2",
 )
 
-# Cross-compilation toolchain (macOS -> Linux x86_64)
-# Uses the same LLVM distribution but with a Linux sysroot
-llvm.toolchain(
-    name = "llvm_toolchain_linux",
-    llvm_version = "20.1.2",
-)
-
-# Linux x86_64 sysroot for cross-compilation
-llvm.sysroot(
-    name = "llvm_toolchain_linux",
-    label = "@linux_sysroot//sysroot",
-    targets = ["linux-x86_64"],
-)
-
-# Cross-compilation toolchain (macOS -> Linux ARM64)
-llvm.toolchain(
-    name = "llvm_toolchain_linux_arm64",
-    llvm_version = "20.1.2",
-)
-
-# Linux ARM64 sysroot for cross-compilation
-llvm.sysroot(
-    name = "llvm_toolchain_linux_arm64",
-    label = "@linux_sysroot_arm64//sysroot",
-    targets = ["linux-aarch64"],
-)
-
-use_repo(llvm, "llvm_toolchain", "llvm_toolchain_linux", "llvm_toolchain_linux_arm64")
-
-# Download the Linux sysroots (Ubuntu 24.04 Noble for C++23 support)
-# Built by: .github/workflows/build_sysroot.yml
-# To rebuild: Run the "Build Linux Sysroot" workflow with a new version, then update sha256 and URL
-sysroot = use_repo_rule("@toolchains_llvm//toolchain:sysroot.bzl", "sysroot")
-
-# x86_64 sysroot
-sysroot(
-    name = "linux_sysroot",
-    sha256 = "a06475004fe8003ae7ccb4fe1d5511feb9b27cce4a8826eb1dfd686ed83f3dba",
-    urls = ["https://eagle0-sysroot.sfo3.digitaloceanspaces.com/v3/ubuntu_noble_amd64_sysroot.tar.xz"],
-)
-
-# ARM64 sysroot
-sysroot(
-    name = "linux_sysroot_arm64",
-    sha256 = "87469137737e09bc73855007dab835477eb10a7b3ce3f725f93f64e25747f3f9",
-    urls = ["https://eagle0-sysroot.sfo3.digitaloceanspaces.com/v4/ubuntu_noble_arm64_sysroot.tar.xz"],
-)
+use_repo(llvm, "llvm_toolchain")
 
 #
 # Language Support - Go
 #
 
-bazel_dep(name = "rules_go", version = "0.56.1", repo_name = "io_bazel_rules_go")
-bazel_dep(name = "gazelle", version = "0.45.0", repo_name = "bazel_gazelle")
+bazel_dep(name = "rules_go", repo_name = "io_bazel_rules_go", version = "0.56.1")
+bazel_dep(name = "gazelle", repo_name = "bazel_gazelle", version = "0.45.0")
 
 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
+
 go_sdk.download(version = "1.23.3")
 
 go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
+
 go_deps.from_file(go_mod = "//:go.mod")
+
 use_repo(
     go_deps,
     "com_github_aws_aws_sdk_go_v2",
     "com_github_aws_aws_sdk_go_v2_config",
     "com_github_aws_aws_sdk_go_v2_credentials",
     "com_github_aws_aws_sdk_go_v2_service_s3",
-    "com_github_golang_jwt_jwt_v5",
-    "com_github_google_uuid",
-    "org_golang_google_grpc",
     "org_golang_google_protobuf",
 )
 
@@ -126,15 +83,15 @@ use_repo(
 # Platform Support - Apple/iOS
 #
 
-bazel_dep(name = "apple_support", version = "1.21.1", repo_name = "build_bazel_apple_support")
-bazel_dep(name = "rules_apple", version = "3.16.1", repo_name = "build_bazel_rules_apple")
-bazel_dep(name = "rules_swift", version = "2.3.1", repo_name = "build_bazel_rules_swift")
+bazel_dep(name = "apple_support", repo_name = "build_bazel_apple_support", version = "1.21.1")
+bazel_dep(name = "rules_apple", repo_name = "build_bazel_rules_apple", version = "3.16.1")
+bazel_dep(name = "rules_swift", repo_name = "build_bazel_rules_swift", version = "2.3.1")
 
 #
 # Protocol Buffers & RPC
 #
 
-bazel_dep(name = "protobuf", version = "29.2", repo_name = "com_google_protobuf")
+bazel_dep(name = "protobuf", repo_name = "com_google_protobuf", version = "29.2")
 bazel_dep(name = "grpc", version = "1.71.0")
 bazel_dep(name = "grpc-java", version = "1.71.0")
 bazel_dep(name = "flatbuffers", version = "25.2.10")
@@ -145,43 +102,6 @@ bazel_dep(name = "flatbuffers", version = "25.2.10")
 
 bazel_dep(name = "googletest", version = "1.17.0")
 
-#
-# Container Images (OCI)
-#
-
-bazel_dep(name = "rules_oci", version = "2.2.6")
-bazel_dep(name = "aspect_bazel_lib", version = "2.16.0")
-
-oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
-
-# Base image for Eagle (Java 17 JDK - includes jcmd for JFR dumps)
-oci.pull(
-    name = "eclipse_temurin_17",
-    image = "docker.io/library/eclipse-temurin",
-    platforms = ["linux/amd64"],
-    tag = "17-jdk",
-)
-
-# Base image for Shardok (Ubuntu 24.04 for C++ runtime)
-oci.pull(
-    name = "ubuntu_24_04",
-    image = "docker.io/library/ubuntu",
-    platforms = [
-        "linux/amd64",
-        "linux/arm64/v8",
-    ],
-    tag = "24.04",
-)
-
-# Base image for Admin Server (Alpine for lightweight Go binary)
-oci.pull(
-    name = "alpine_linux",
-    image = "docker.io/library/alpine",
-    platforms = ["linux/amd64"],
-    tag = "3.21",
-)
-use_repo(oci, "alpine_linux", "alpine_linux_linux_amd64", "eclipse_temurin_17", "eclipse_temurin_17_linux_amd64", "ubuntu_24_04", "ubuntu_24_04_linux_amd64", "ubuntu_24_04_linux_arm64_v8")
-
 #
 # Java/Scala Dependencies
 #
@@ -189,6 +109,7 @@ use_repo(oci, "alpine_linux", "alpine_linux_linux_amd64", "eclipse_temurin_17",
 bazel_dep(name = "rules_jvm_external", version = "6.3")
 
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
+
 maven.install(
     artifacts = [
         # Netty
@@ -239,16 +160,6 @@ maven.install(
         # Other
         "org.reactivestreams:reactive-streams:1.0.4",
         "javax.xml.bind:jaxb-api:2.3.1",
-
-        # OkHttp (for SSE with read timeout support, OAuth HTTP calls)
-        "com.squareup.okhttp3:okhttp:4.12.0",
-        "com.squareup.okhttp3:okhttp-sse:4.12.0",
-
-        # JWT (for OAuth token handling)
-        "com.nimbusds:nimbus-jose-jwt:9.37.3",
-
-        # Error tracking
-        "io.sentry:sentry:7.19.0",
     ],
     duplicate_version_warning = "error",
     fail_if_repin_required = True,
@@ -257,6 +168,7 @@ maven.install(
         "https://repo1.maven.org/maven2",
     ],
 )
+
 use_repo(maven, "maven", "unpinned_maven")
 
 #
@@ -264,7 +176,6 @@ use_repo(maven, "maven", "unpinned_maven")
 #
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 
 # GTL (for parallel_hashmap)
 GTL_VERSION = "1.2.0"
@@ -293,24 +204,6 @@ http_archive(
     ],
 )
 
-# Busybox static binary for Docker health checks (provides nc, wget, etc.)
-# https://busybox.net/downloads/binaries/
-http_file(
-    name = "busybox_x86_64",
-    sha256 = "6e123e7f3202a8c1e9b1f94d8941580a25135382b99e8d3e34fb858bba311348",
-    urls = ["https://busybox.net/downloads/binaries/1.35.0-x86_64-linux-musl/busybox"],
-    downloaded_file_path = "busybox",
-    executable = True,
-)
-
-http_file(
-    name = "busybox_aarch64",
-    sha256 = "141adb1b625a6f44c4b114f76b4387b4ea4f7ab802b88eb40e0d2f6adcccb1c3",
-    urls = ["https://busybox.net/downloads/binaries/1.35.0-aarch64-linux-musl/busybox"],
-    downloaded_file_path = "busybox",
-    executable = True,
-)
-
 #
 # Toolchain Registration
 #
@@ -323,7 +216,5 @@ register_toolchains(
 # Set dev_dependency so we can turn this off for swift MacOS builds
 register_toolchains(
     "@llvm_toolchain//:all",
-    "@llvm_toolchain_linux//:all",
-    "@llvm_toolchain_linux_arm64//:all",
     dev_dependency = True,
 )

MODULE.bazel.lock

@@ -26,11 +26,7 @@
     "https://bcr.bazel.build/modules/aspect_bazel_lib/1.38.0/MODULE.bazel": "6307fec451ba9962c1c969eb516ebfe1e46528f7fa92e1c9ac8646bef4cdaa3f",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/1.40.3/MODULE.bazel": "668e6bcb4d957fc0e284316dba546b705c8d43c857f87119619ee83c4555b859",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.11.0/MODULE.bazel": "cb1ba9f9999ed0bc08600c221f532c1ddd8d217686b32ba7d45b0713b5131452",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.14.0/MODULE.bazel": "2b31ffcc9bdc8295b2167e07a757dbbc9ac8906e7028e5170a3708cecaac119f",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.16.0/MODULE.bazel": "852f9ebbda017572a7c113a2434592dd3b2f55cd9a0faea3d4be5a09a59e4900",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.19.3/MODULE.bazel": "253d739ba126f62a5767d832765b12b59e9f8d2bc88cc1572f4a73e46eb298ca",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.19.3/source.json": "ffab9254c65ba945f8369297ad97ca0dec213d3adc6e07877e23a48624a8b456",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.7.2/MODULE.bazel": "780d1a6522b28f5edb7ea09630748720721dfe27690d65a2d33aa7509de77e07",
+    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.11.0/source.json": "92494d5aa43b96665397dd13ee16023097470fa85e276b93674d62a244de47ee",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.7.7/MODULE.bazel": "491f8681205e31bb57892d67442ce448cda4f472a8e6b3dc062865e29a64f89c",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.8.1/MODULE.bazel": "812d2dd42f65dca362152101fbec418029cc8fd34cbad1a2fde905383d705838",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.9.3/MODULE.bazel": "66baf724dbae7aff4787bf2245cc188d50cb08e07789769730151c0943587c14",
@@ -55,11 +51,8 @@
     "https://bcr.bazel.build/modules/bazel_features/1.19.0/MODULE.bazel": "59adcdf28230d220f0067b1f435b8537dd033bfff8db21335ef9217919c7fb58",
     "https://bcr.bazel.build/modules/bazel_features/1.21.0/MODULE.bazel": "675642261665d8eea09989aa3b8afb5c37627f1be178382c320d1b46afba5e3b",
     "https://bcr.bazel.build/modules/bazel_features/1.27.0/MODULE.bazel": "621eeee06c4458a9121d1f104efb80f39d34deff4984e778359c60eaf1a8cb65",
-    "https://bcr.bazel.build/modules/bazel_features/1.28.0/MODULE.bazel": "4b4200e6cbf8fa335b2c3f43e1d6ef3e240319c33d43d60cc0fbd4b87ece299d",
+    "https://bcr.bazel.build/modules/bazel_features/1.27.0/source.json": "ed8cf0ef05c858dce3661689d0a2b110ff398e63994e178e4f1f7555a8067fed",
     "https://bcr.bazel.build/modules/bazel_features/1.3.0/MODULE.bazel": "cdcafe83ec318cda34e02948e81d790aab8df7a929cec6f6969f13a489ccecd9",
-    "https://bcr.bazel.build/modules/bazel_features/1.34.0/MODULE.bazel": "e8475ad7c8965542e0c7aac8af68eb48c4af904be3d614b6aa6274c092c2ea1e",
-    "https://bcr.bazel.build/modules/bazel_features/1.38.0/MODULE.bazel": "f9b8a9c890ebd216b4049fd12a31d3c2602e3403c7af636b04fbbd7453edc9c9",
-    "https://bcr.bazel.build/modules/bazel_features/1.38.0/source.json": "31ba776c122b54a2885e23651642e32f087a87bf025465f8040751894b571277",
     "https://bcr.bazel.build/modules/bazel_features/1.4.1/MODULE.bazel": "e45b6bb2350aff3e442ae1111c555e27eac1d915e77775f6fdc4b351b758b5d7",
     "https://bcr.bazel.build/modules/bazel_features/1.9.0/MODULE.bazel": "885151d58d90d8d9c811eb75e3288c11f850e1d6b481a8c9f766adee4712358b",
     "https://bcr.bazel.build/modules/bazel_features/1.9.1/MODULE.bazel": "8f679097876a9b609ad1f60249c49d68bfab783dd9be012faf9d82547b14815a",
@@ -76,8 +69,7 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.0/MODULE.bazel": "0db596f4563de7938de764cc8deeabec291f55e8ec15299718b93c4423e9796d",
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.1/MODULE.bazel": "3120d80c5861aa616222ec015332e5f8d3171e062e3e804a2a0253e1be26e59b",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/MODULE.bazel": "88ade7293becda963e0e3ea33e7d54d3425127e0a326e0d17da085a5f1f03ff6",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/MODULE.bazel": "69ad6927098316848b34a9142bcc975e018ba27f08c4ff403f50c1b6e646ca67",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/source.json": "34a3c8bcf233b835eb74be9d628899bb32999d3e0eadef1947a0a562a2b16ffb",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/source.json": "7ebaefba0b03efe59cac88ed5bbc67bcf59a3eff33af937345ede2a38b2d368a",
     "https://bcr.bazel.build/modules/bazel_worker_api/0.0.6/MODULE.bazel": "fd1f9432ca04c947e91b500df69ce7c5b6dbfe1bc45ab1820338205dae3383a6",
     "https://bcr.bazel.build/modules/bazel_worker_api/0.0.6/source.json": "5d68545f224904745a3cabd35aea6bc2b6cc5a78b7f49f3f69660eab2eeeb273",
     "https://bcr.bazel.build/modules/boringssl/0.0.0-20211025-d4f1ab9/MODULE.bazel": "6ee6353f8b1a701fe2178e1d925034294971350b6d3ac37e67e5a7d463267834",
@@ -106,8 +98,6 @@
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20250128-4de3c74/source.json": "028519164a2e24563f4b43d810fdedc702daed90e71e7042d45ba82ad807b46f",
     "https://bcr.bazel.build/modules/flatbuffers/25.2.10/MODULE.bazel": "dab15cafe8512d2c4a8daa44c2d7968c5c79f01e220d40076cdc260bf58605e2",
     "https://bcr.bazel.build/modules/flatbuffers/25.2.10/source.json": "7eae7ea3eb913b9802426e4d5df11d6c6072a3573a548f8cabf1e965f5cca4d0",
-    "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/MODULE.bazel": "cdf8cbe5ee750db04b78878c9633cc76e80dcf4416cbe982ac3a9222f80713c8",
-    "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/source.json": "fa7b512dfcb5eafd90ce3959cf42a2a6fe96144ebbb4b3b3928054895f2afac2",
     "https://bcr.bazel.build/modules/gazelle/0.27.0/MODULE.bazel": "3446abd608295de6d90b4a8a118ed64a9ce11dcb3dda2dc3290a22056bd20996",
     "https://bcr.bazel.build/modules/gazelle/0.30.0/MODULE.bazel": "f888a1effe338491f35f0e0e85003b47bb9d8295ccba73c37e07702d8d31c65b",
     "https://bcr.bazel.build/modules/gazelle/0.32.0/MODULE.bazel": "b499f58a5d0d3537f3cf5b76d8ada18242f64ec474d8391247438bf04f58c7b8",
@@ -147,10 +137,6 @@
     "https://bcr.bazel.build/modules/grpc/1.70.1/MODULE.bazel": "b800cd8e3e7555c1e61cba2e02d3a2fcf0e91f66e800db286d965d3b7a6a721a",
     "https://bcr.bazel.build/modules/grpc/1.71.0/MODULE.bazel": "7fcab2c05530373f1a442c362b17740dd0c75b6a2a975eec8f5bf4c70a37928a",
     "https://bcr.bazel.build/modules/grpc/1.71.0/source.json": "60ef8c4c72c8280ae94c05b4f38bf67785acb25477ab8dbac096a9604449ff90",
-    "https://bcr.bazel.build/modules/helly25_bzl/0.3.1/MODULE.bazel": "3a4be20f6fc13be32ad44643b8252ef5af09eee936f1d943cd4fd7867fa92826",
-    "https://bcr.bazel.build/modules/helly25_bzl/0.3.1/source.json": "b129ab1828492de2c163785bbeb4065c166de52d932524b4317beb5b7f917994",
-    "https://bcr.bazel.build/modules/jq.bzl/0.1.0/MODULE.bazel": "2ce69b1af49952cd4121a9c3055faa679e748ce774c7f1fda9657f936cae902f",
-    "https://bcr.bazel.build/modules/jq.bzl/0.1.0/source.json": "746bf13cac0860f091df5e4911d0c593971cd8796b5ad4e809b2f8e133eee3d5",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.5/MODULE.bazel": "31271aedc59e815656f5736f282bb7509a97c7ecb43e927ac1a37966e0578075",
     "https://bcr.bazel.build/modules/jsoncpp/1.9.5/source.json": "4108ee5085dd2885a341c7fab149429db457b3169b86eb081fa245eadf69169d",
     "https://bcr.bazel.build/modules/libpfm/4.11.0/MODULE.bazel": "45061ff025b301940f1e30d2c16bea596c25b176c8b6b3087e92615adbd52902",
@@ -175,7 +161,6 @@
     "https://bcr.bazel.build/modules/opentelemetry-proto/1.5.0/source.json": "046b721ce203e88cdaad44d7dd17a86b7200eab9388b663b234e72e13ff7b143",
     "https://bcr.bazel.build/modules/opentracing-cpp/1.6.0/MODULE.bazel": "b3925269f63561b8b880ae7cf62ccf81f6ece55b62cd791eda9925147ae116ec",
     "https://bcr.bazel.build/modules/opentracing-cpp/1.6.0/source.json": "da1cb1add160f5e5074b7272e9db6fd8f1b3336c15032cd0a653af9d2f484aed",
-    "https://bcr.bazel.build/modules/package_metadata/0.0.2/MODULE.bazel": "fb8d25550742674d63d7b250063d4580ca530499f045d70748b1b142081ebb92",
     "https://bcr.bazel.build/modules/package_metadata/0.0.5/MODULE.bazel": "ef4f9439e3270fdd6b9fd4dbc3d2f29d13888e44c529a1b243f7a31dfbc2e8e4",
     "https://bcr.bazel.build/modules/package_metadata/0.0.5/source.json": "2326db2f6592578177751c3e1f74786b79382cd6008834c9d01ec865b9126a85",
     "https://bcr.bazel.build/modules/platforms/0.0.10/MODULE.bazel": "8cb8efaf200bdeb2150d93e162c40f388529a25852b332cec879373771e48ed5",
@@ -240,14 +225,12 @@
     "https://bcr.bazel.build/modules/rules_cc/0.0.15/MODULE.bazel": "6704c35f7b4a72502ee81f61bf88706b54f06b3cbe5558ac17e2e14666cd5dcc",
     "https://bcr.bazel.build/modules/rules_cc/0.0.16/MODULE.bazel": "7661303b8fc1b4d7f532e54e9d6565771fea666fbdf839e0a86affcd02defe87",
     "https://bcr.bazel.build/modules/rules_cc/0.0.17/MODULE.bazel": "2ae1d8f4238ec67d7185d8861cb0a2cdf4bc608697c331b95bf990e69b62e64a",
+    "https://bcr.bazel.build/modules/rules_cc/0.0.17/source.json": "4db99b3f55c90ab28d14552aa0632533e3e8e5e9aea0f5c24ac0014282c2a7c5",
     "https://bcr.bazel.build/modules/rules_cc/0.0.2/MODULE.bazel": "6915987c90970493ab97393024c156ea8fb9f3bea953b2f3ec05c34f19b5695c",
     "https://bcr.bazel.build/modules/rules_cc/0.0.5/MODULE.bazel": "be41f87587998fe8890cd82ea4e848ed8eb799e053c224f78f3ff7fe1a1d9b74",
     "https://bcr.bazel.build/modules/rules_cc/0.0.6/MODULE.bazel": "abf360251023dfe3efcef65ab9d56beefa8394d4176dd29529750e1c57eaa33f",
     "https://bcr.bazel.build/modules/rules_cc/0.0.8/MODULE.bazel": "964c85c82cfeb6f3855e6a07054fdb159aced38e99a5eecf7bce9d53990afa3e",
     "https://bcr.bazel.build/modules/rules_cc/0.0.9/MODULE.bazel": "836e76439f354b89afe6a911a7adf59a6b2518fafb174483ad78a2a2fde7b1c5",
-    "https://bcr.bazel.build/modules/rules_cc/0.1.1/MODULE.bazel": "2f0222a6f229f0bf44cd711dc13c858dad98c62d52bd51d8fc3a764a83125513",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.14/MODULE.bazel": "353c99ed148887ee89c54a17d4100ae7e7e436593d104b668476019023b58df8",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.14/source.json": "55d0a4587c5592fad350f6e698530f4faf0e7dd15e69d43f8d87e220c78bea54",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.10.1/MODULE.bazel": "b9527010e5fef060af92b6724edb3691970a5b1f76f74b21d39f7d433641be60",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.10.1/source.json": "9300e71df0cdde0952f10afff1401fa664e9fc5d9ae6204660ba1b158d90d6a6",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.9.0/MODULE.bazel": "c9e8c682bf75b0e7c704166d79b599f93b72cfca5ad7477df596947891feeef6",
@@ -306,8 +289,6 @@
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.0/MODULE.bazel": "45345e4aba35dd6e4701c1eebf5a4e67af4ed708def9ebcdc6027585b34ee52d",
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.3/MODULE.bazel": "b66eadebd10f1f1b25f52f95ab5213a57e82c37c3f656fcd9a57ad04d2264ce7",
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.3/source.json": "45bd343155bdfed2543f0e39b80ff3f6840efc31975da4b5795797f4c94147ad",
-    "https://bcr.bazel.build/modules/rules_oci/2.2.6/MODULE.bazel": "2ba6ddd679269e00aeffe9ca04faa2d0ca4129650982c9246d0d459fe2da47d9",
-    "https://bcr.bazel.build/modules/rules_oci/2.2.6/source.json": "94e7decb8f95d9465b0bbea71c65064cd16083be1350c7468f131818641dc4a5",
     "https://bcr.bazel.build/modules/rules_pkg/0.7.0/MODULE.bazel": "df99f03fc7934a4737122518bb87e667e62d780b610910f0447665a7e2be62dc",
     "https://bcr.bazel.build/modules/rules_pkg/1.0.1/MODULE.bazel": "5b1df97dbc29623bccdf2b0dcd0f5cb08e2f2c9050aab1092fd39a41e82686ff",
     "https://bcr.bazel.build/modules/rules_pkg/1.1.0/MODULE.bazel": "9db8031e71b6ef32d1846106e10dd0ee2deac042bd9a2de22b4761b0c3036453",
@@ -340,8 +321,7 @@
     "https://bcr.bazel.build/modules/rules_scala/7.1.1/source.json": "5038cb231d4020c5965c920681cf961a7bf137b40315025e40f3a7b6a0ac1f0f",
     "https://bcr.bazel.build/modules/rules_shell/0.2.0/MODULE.bazel": "fda8a652ab3c7d8fee214de05e7a9916d8b28082234e8d2c0094505c5268ed3c",
     "https://bcr.bazel.build/modules/rules_shell/0.3.0/MODULE.bazel": "de4402cd12f4cc8fda2354fce179fdb068c0b9ca1ec2d2b17b3e21b24c1a937b",
-    "https://bcr.bazel.build/modules/rules_shell/0.4.1/MODULE.bazel": "00e501db01bbf4e3e1dd1595959092c2fadf2087b2852d3f553b5370f5633592",
-    "https://bcr.bazel.build/modules/rules_shell/0.4.1/source.json": "4757bd277fe1567763991c4425b483477bb82e35e777a56fd846eb5cceda324a",
+    "https://bcr.bazel.build/modules/rules_shell/0.3.0/source.json": "c55ed591aa5009401ddf80ded9762ac32c358d2517ee7820be981e2de9756cf3",
     "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca",
     "https://bcr.bazel.build/modules/rules_swift/1.18.0/MODULE.bazel": "a6aba73625d0dc64c7b4a1e831549b6e375fbddb9d2dde9d80c9de6ec45b24c9",
     "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046",
@@ -359,19 +339,14 @@
     "https://bcr.bazel.build/modules/stardoc/0.7.2/source.json": "58b029e5e901d6802967754adf0a9056747e8176f017cfe3607c0851f4d42216",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/source.json": "32bd87e5f4d7acc57c5b2ff7c325ae3061d5e242c0c4c214ae87e0f1c13e54cb",
-    "https://bcr.bazel.build/modules/tar.bzl/0.2.1/MODULE.bazel": "52d1c00a80a8cc67acbd01649e83d8dd6a9dc426a6c0b754a04fe8c219c76468",
-    "https://bcr.bazel.build/modules/tar.bzl/0.6.0/MODULE.bazel": "a3584b4edcfafcabd9b0ef9819808f05b372957bbdff41601429d5fd0aac2e7c",
-    "https://bcr.bazel.build/modules/tar.bzl/0.6.0/source.json": "4a620381df075a16cb3a7ed57bd1d05f7480222394c64a20fa51bdb636fda658",
-    "https://bcr.bazel.build/modules/toolchains_llvm/1.6.0/MODULE.bazel": "39603859cafb1c6830160fcd6370552e836790e6abb2bfb8d13bff53c0c10a64",
-    "https://bcr.bazel.build/modules/toolchains_llvm/1.6.0/source.json": "6bd3ef95a288dd2bb1582eca332af850c9a5428a23bb92cb1c57c2dfe6cb7369",
+    "https://bcr.bazel.build/modules/toolchains_llvm/1.4.0/MODULE.bazel": "05239402b7374293359c2f22806f420b75aa5d6f4b15a2eaa809a2c214d58b31",
+    "https://bcr.bazel.build/modules/toolchains_llvm/1.4.0/source.json": "229a516d282b17a82be54c6e3ae220a1b750fb55a8495567e5c7a9d09423f3e2",
     "https://bcr.bazel.build/modules/upb/0.0.0-20211020-160625a/MODULE.bazel": "6cced416be2dc5b9c05efd5b997049ba795e5e4e6fafbe1624f4587767638928",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
     "https://bcr.bazel.build/modules/upb/0.0.0-20230516-61a97ef/MODULE.bazel": "c0df5e35ad55e264160417fd0875932ee3c9dda63d9fccace35ac62f45e1b6f9",
     "https://bcr.bazel.build/modules/upb/0.0.0-20230907-e7430e6/MODULE.bazel": "3a7dedadf70346e678dc059dbe44d05cbf3ab17f1ce43a1c7a42edc7cbf93fd9",
     "https://bcr.bazel.build/modules/xds/0.0.0-20240423-555b57e/MODULE.bazel": "cea509976a77e34131411684ef05a1d6ad194dd71a8d5816643bc5b0af16dc0f",
     "https://bcr.bazel.build/modules/xds/0.0.0-20240423-555b57e/source.json": "7227e1fcad55f3f3cab1a08691ecd753cb29cc6380a47bc650851be9f9ad6d20",
-    "https://bcr.bazel.build/modules/yq.bzl/0.1.1/MODULE.bazel": "9039681f9bcb8958ee2c87ffc74bdafba9f4369096a2b5634b88abc0eaefa072",
-    "https://bcr.bazel.build/modules/yq.bzl/0.1.1/source.json": "2d2bad780a9f2b9195a4a370314d2c17ae95eaa745cefc2e12fbc49759b15aa3",
     "https://bcr.bazel.build/modules/zlib/1.2.11/MODULE.bazel": "07b389abc85fdbca459b69e2ec656ae5622873af3f845e1c9d80fe179f3effa0",
     "https://bcr.bazel.build/modules/zlib/1.2.12/MODULE.bazel": "3b1a8834ada2a883674be8cbd36ede1b6ec481477ada359cd2d3ddc562340b27",
     "https://bcr.bazel.build/modules/zlib/1.2.13/MODULE.bazel": "aa6deb1b83c18ffecd940c4119aff9567cd0a671d7bba756741cb2ef043a29d5",
@@ -413,7 +388,7 @@
     },
     "@@aspect_rules_esbuild~//esbuild:extensions.bzl%esbuild": {
       "general": {
-        "bzlTransitiveDigest": "8jv3p0xDR/oitFeH8y0+Y5xlyrUbfsTRlc9TSwYkwl8=",
+        "bzlTransitiveDigest": "8iOqbPY5ve3DvjzaI1mJZ8XTiJypN2PeWvcKOvmZLy8=",
         "usagesDigest": "iDVoyPxUeADmfK8ssoyG3Ehq1bj6p7A43LpEiE266os=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
@@ -1290,296 +1265,6 @@
         "recordedRepoMappingEntries": []
       }
     },
-    "@@rules_oci~//oci:extensions.bzl%oci": {
-      "general": {
-        "bzlTransitiveDigest": "FaY+7xb13bB3hmxqwAWaGp3Tf3Q4Nfdlr+F38CP5mcg=",
-        "usagesDigest": "39yHQmifPoGf+JSYpnQSnJGugxbrFVge/+ENmUiqZ6M=",
-        "recordedFileInputs": {},
-        "recordedDirentsInputs": {},
-        "envVariables": {},
-        "generatedRepoSpecs": {
-          "eclipse_temurin_17_linux_amd64": {
-            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
-            "ruleClassName": "oci_pull",
-            "attributes": {
-              "www_authenticate_challenges": {},
-              "scheme": "https",
-              "registry": "index.docker.io",
-              "repository": "library/eclipse-temurin",
-              "identifier": "17-jdk",
-              "platform": "linux/amd64",
-              "target_name": "eclipse_temurin_17_linux_amd64",
-              "bazel_tags": []
-            }
-          },
-          "eclipse_temurin_17": {
-            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
-            "ruleClassName": "oci_alias",
-            "attributes": {
-              "target_name": "eclipse_temurin_17",
-              "www_authenticate_challenges": {},
-              "scheme": "https",
-              "registry": "index.docker.io",
-              "repository": "library/eclipse-temurin",
-              "identifier": "17-jdk",
-              "platforms": {
-                "@@platforms//cpu:x86_64": "@eclipse_temurin_17_linux_amd64"
-              },
-              "bzlmod_repository": "eclipse_temurin_17",
-              "reproducible": true
-            }
-          },
-          "ubuntu_24_04_linux_amd64": {
-            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
-            "ruleClassName": "oci_pull",
-            "attributes": {
-              "www_authenticate_challenges": {},
-              "scheme": "https",
-              "registry": "index.docker.io",
-              "repository": "library/ubuntu",
-              "identifier": "24.04",
-              "platform": "linux/amd64",
-              "target_name": "ubuntu_24_04_linux_amd64",
-              "bazel_tags": []
-            }
-          },
-          "ubuntu_24_04_linux_arm64_v8": {
-            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
-            "ruleClassName": "oci_pull",
-            "attributes": {
-              "www_authenticate_challenges": {},
-              "scheme": "https",
-              "registry": "index.docker.io",
-              "repository": "library/ubuntu",
-              "identifier": "24.04",
-              "platform": "linux/arm64/v8",
-              "target_name": "ubuntu_24_04_linux_arm64_v8",
-              "bazel_tags": []
-            }
-          },
-          "ubuntu_24_04": {
-            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
-            "ruleClassName": "oci_alias",
-            "attributes": {
-              "target_name": "ubuntu_24_04",
-              "www_authenticate_challenges": {},
-              "scheme": "https",
-              "registry": "index.docker.io",
-              "repository": "library/ubuntu",
-              "identifier": "24.04",
-              "platforms": {
-                "@@platforms//cpu:x86_64": "@ubuntu_24_04_linux_amd64",
-                "@@platforms//cpu:arm64": "@ubuntu_24_04_linux_arm64_v8"
-              },
-              "bzlmod_repository": "ubuntu_24_04",
-              "reproducible": true
-            }
-          },
-          "alpine_linux_linux_amd64": {
-            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
-            "ruleClassName": "oci_pull",
-            "attributes": {
-              "www_authenticate_challenges": {},
-              "scheme": "https",
-              "registry": "index.docker.io",
-              "repository": "library/alpine",
-              "identifier": "3.21",
-              "platform": "linux/amd64",
-              "target_name": "alpine_linux_linux_amd64",
-              "bazel_tags": []
-            }
-          },
-          "alpine_linux": {
-            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
-            "ruleClassName": "oci_alias",
-            "attributes": {
-              "target_name": "alpine_linux",
-              "www_authenticate_challenges": {},
-              "scheme": "https",
-              "registry": "index.docker.io",
-              "repository": "library/alpine",
-              "identifier": "3.21",
-              "platforms": {
-                "@@platforms//cpu:x86_64": "@alpine_linux_linux_amd64"
-              },
-              "bzlmod_repository": "alpine_linux",
-              "reproducible": true
-            }
-          },
-          "oci_crane_darwin_amd64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "darwin_amd64",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_darwin_arm64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "darwin_arm64",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_linux_arm64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "linux_arm64",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_linux_armv6": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "linux_armv6",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_linux_i386": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "linux_i386",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_linux_s390x": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "linux_s390x",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_linux_amd64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "linux_amd64",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_windows_armv6": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "windows_armv6",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_windows_amd64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "crane_repositories",
-            "attributes": {
-              "platform": "windows_amd64",
-              "crane_version": "v0.18.0"
-            }
-          },
-          "oci_crane_toolchains": {
-            "bzlFile": "@@rules_oci~//oci/private:toolchains_repo.bzl",
-            "ruleClassName": "toolchains_repo",
-            "attributes": {
-              "toolchain_type": "@rules_oci//oci:crane_toolchain_type",
-              "toolchain": "@oci_crane_{platform}//:crane_toolchain"
-            }
-          },
-          "oci_regctl_darwin_amd64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "regctl_repositories",
-            "attributes": {
-              "platform": "darwin_amd64"
-            }
-          },
-          "oci_regctl_darwin_arm64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "regctl_repositories",
-            "attributes": {
-              "platform": "darwin_arm64"
-            }
-          },
-          "oci_regctl_linux_arm64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "regctl_repositories",
-            "attributes": {
-              "platform": "linux_arm64"
-            }
-          },
-          "oci_regctl_linux_s390x": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "regctl_repositories",
-            "attributes": {
-              "platform": "linux_s390x"
-            }
-          },
-          "oci_regctl_linux_amd64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "regctl_repositories",
-            "attributes": {
-              "platform": "linux_amd64"
-            }
-          },
-          "oci_regctl_windows_amd64": {
-            "bzlFile": "@@rules_oci~//oci:repositories.bzl",
-            "ruleClassName": "regctl_repositories",
-            "attributes": {
-              "platform": "windows_amd64"
-            }
-          },
-          "oci_regctl_toolchains": {
-            "bzlFile": "@@rules_oci~//oci/private:toolchains_repo.bzl",
-            "ruleClassName": "toolchains_repo",
-            "attributes": {
-              "toolchain_type": "@rules_oci//oci:regctl_toolchain_type",
-              "toolchain": "@oci_regctl_{platform}//:regctl_toolchain"
-            }
-          }
-        },
-        "moduleExtensionMetadata": {
-          "explicitRootModuleDirectDeps": [
-            "eclipse_temurin_17",
-            "eclipse_temurin_17_linux_amd64",
-            "ubuntu_24_04",
-            "ubuntu_24_04_linux_amd64",
-            "ubuntu_24_04_linux_arm64_v8",
-            "alpine_linux",
-            "alpine_linux_linux_amd64"
-          ],
-          "explicitRootModuleDirectDevDeps": [],
-          "useAllRepos": "NO",
-          "reproducible": false
-        },
-        "recordedRepoMappingEntries": [
-          [
-            "aspect_bazel_lib~",
-            "bazel_tools",
-            "bazel_tools"
-          ],
-          [
-            "bazel_features~",
-            "bazel_tools",
-            "bazel_tools"
-          ],
-          [
-            "rules_oci~",
-            "aspect_bazel_lib",
-            "aspect_bazel_lib~"
-          ],
-          [
-            "rules_oci~",
-            "bazel_features",
-            "bazel_features~"
-          ],
-          [
-            "rules_oci~",
-            "bazel_skylib",
-            "bazel_skylib~"
-          ]
-        ]
-      }
-    },
     "@@rules_scala~//scala/extensions:config.bzl%scala_config": {
       "general": {
         "bzlTransitiveDigest": "TdBxhkZTM7VU6teIFS+KoonKU7wmb5BL7leCWWx7yX8=",
@@ -1608,7 +1293,7 @@
     },
     "@@rules_scala~//scala/extensions:deps.bzl%scala_deps": {
       "general": {
-        "bzlTransitiveDigest": "5SDZrXQHW6tI/VEw+La2OPOK4ZWm0LGTxnChXOXBCag=",
+        "bzlTransitiveDigest": "F2PMm61fmZ/IE+VSw1rigJ71hBDD7k3vqyYR1/GgXeA=",
         "usagesDigest": "kwo8oolISmSSITnit4b4S0vBiUtHlHK0WLDUwScxmOg=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
@@ -5219,6 +4904,85 @@
           ]
         ]
       }
+    },
+    "@@toolchains_llvm~//toolchain/extensions:llvm.bzl%llvm": {
+      "general": {
+        "bzlTransitiveDigest": "afRF0aFOIUrkYl3o040WQ606ep1qciEXzjnAxT3Kek8=",
+        "usagesDigest": "sYVuhiCAQehFTnGTv0bNtTBR4WorebpWBNxF0mRusyw=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "llvm_toolchain_llvm": {
+            "bzlFile": "@@toolchains_llvm~//toolchain:rules.bzl",
+            "ruleClassName": "llvm",
+            "attributes": {
+              "alternative_llvm_sources": [],
+              "auth_patterns": {},
+              "distribution": "auto",
+              "exec_arch": "",
+              "exec_os": "",
+              "libclang_rt": {},
+              "llvm_mirror": "",
+              "llvm_version": "20.1.2",
+              "llvm_versions": {},
+              "netrc": "",
+              "sha256": {},
+              "strip_prefix": {},
+              "urls": {}
+            }
+          },
+          "llvm_toolchain": {
+            "bzlFile": "@@toolchains_llvm~//toolchain:rules.bzl",
+            "ruleClassName": "toolchain",
+            "attributes": {
+              "absolute_paths": false,
+              "archive_flags": {},
+              "compile_flags": {},
+              "conly_flags": {},
+              "coverage_compile_flags": {},
+              "coverage_link_flags": {},
+              "cxx_builtin_include_directories": {},
+              "cxx_flags": {},
+              "cxx_standard": {},
+              "dbg_compile_flags": {},
+              "exec_arch": "",
+              "exec_os": "",
+              "extra_exec_compatible_with": {},
+              "extra_target_compatible_with": {},
+              "link_flags": {},
+              "link_libs": {},
+              "llvm_versions": {
+                "": "20.1.2"
+              },
+              "opt_compile_flags": {},
+              "opt_link_flags": {},
+              "stdlib": {},
+              "target_settings": {},
+              "unfiltered_compile_flags": {},
+              "toolchain_roots": {},
+              "sysroot": {}
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "toolchains_llvm~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "toolchains_llvm~",
+            "bazel_tools",
+            "bazel_tools"
+          ],
+          [
+            "toolchains_llvm~",
+            "toolchains_llvm",
+            "toolchains_llvm~"
+          ]
+        ]
+      }
     }
   }
 }

ci/BUILD.bazel

@@ -1,347 +0,0 @@
-load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load", "oci_push")
-load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-
-#
-# Shared utilities layer (busybox for nc, wget, etc.)
-#
-
-pkg_tar(
-    name = "busybox_layer",
-    srcs = ["@busybox_x86_64//file"],
-    package_dir = "/usr/local/bin",
-    remap_paths = {
-        "file/busybox": "busybox",
-    },
-    symlinks = {
-        "/usr/local/bin/nc": "busybox",
-    },
-)
-
-pkg_tar(
-    name = "busybox_layer_arm64",
-    srcs = ["@busybox_aarch64//file"],
-    package_dir = "/usr/local/bin",
-    remap_paths = {
-        "file/busybox": "busybox",
-    },
-    symlinks = {
-        "/usr/local/bin/nc": "busybox",
-    },
-)
-
-#
-# Eagle Server Docker Image
-#
-# Build: bazel build //ci:eagle_server_image
-# Load:  bazel run //ci:eagle_server_load
-# Push:  bazel run //ci:eagle_server_push
-#
-
-# Package the deploy JAR
-pkg_tar(
-    name = "eagle_server_jar_layer",
-    srcs = ["//src/main/scala/net/eagle0/eagle:eagle_server_deploy.jar"],
-    package_dir = "/app",
-)
-
-# Package the game resources needed at runtime
-pkg_tar(
-    name = "eagle_resources_layer",
-    srcs = [
-        "//src/main/resources/net/eagle0/eagle:beasts",
-        "//src/main/resources/net/eagle0/eagle:game_parameters",
-        "//src/main/resources/net/eagle0/eagle:headshots",
-        "//src/main/resources/net/eagle0/eagle:heroes",
-        "//src/main/resources/net/eagle0/eagle:province_map",
-        "//src/main/resources/net/eagle0/eagle:settings",
-    ],
-    package_dir = "/app/resources",
-)
-
-oci_image(
-    name = "eagle_server_image",
-    base = "@eclipse_temurin_17_linux_amd64",
-    entrypoint = [
-        "java",
-        "-Xmx2g",
-        "-XX:+UseG1GC",
-        # JFR profiling support
-        "-XX:+UnlockDiagnosticVMOptions",
-        "-XX:+DebugNonSafepoints",  # Required for JFR to see through inlined methods
-        "-XX:FlightRecorderOptions=stackdepth=256",
-        "-jar",
-        "/app/eagle_server_deploy.jar",
-    ],
-    env = {
-        "JAVA_OPTS": "-Xmx2g -XX:+UseG1GC",
-    },
-    exposed_ports = ["40032/tcp"],
-    tars = [
-        ":busybox_layer",
-        ":eagle_server_jar_layer",
-        ":eagle_resources_layer",
-    ],
-    workdir = "/app",
-)
-
-# Load into Docker locally: bazel run //ci:eagle_server_load
-oci_load(
-    name = "eagle_server_load",
-    image = ":eagle_server_image",
-    repo_tags = ["eagle0/eagle-server:latest"],
-)
-
-# Push to DigitalOcean Container Registry
-# Note: No remote_tags here - DigitalOcean converts OCI to Docker format,
-# changing the digest and breaking oci_push's tag-by-digest logic.
-# Tagging is handled in the CI workflow using crane copy/tag.
-oci_push(
-    name = "eagle_server_push",
-    image = ":eagle_server_image",
-    repository = "registry.digitalocean.com/eagle0/eagle-server",
-)
-
-#
-# Shardok Server Docker Image
-#
-# Build: bazel build //ci:shardok_server_image
-# Load:  bazel run //ci:shardok_server_load
-# Push:  bazel run //ci:shardok_server_push
-#
-
-# Package the Shardok binary
-pkg_tar(
-    name = "shardok_binary_layer",
-    srcs = ["//src/main/cpp/net/eagle0/shardok:shardok-server"],
-    package_dir = "/app",
-)
-
-# Package the Shardok resources (battalion types, settings)
-pkg_tar(
-    name = "shardok_resources_layer",
-    srcs = [
-        "//src/main/resources/net/eagle0/shardok:battalion_types",
-        "//src/main/resources/net/eagle0/shardok:settings",
-    ],
-    package_dir = "/app/resources",
-)
-
-# Package the converted maps
-pkg_tar(
-    name = "shardok_maps_layer",
-    srcs = ["//src/main/resources/net/eagle0/shardok/maps"],
-    package_dir = "/app/resources/maps",
-)
-
-oci_image(
-    name = "shardok_server_image",
-    base = "@ubuntu_24_04_linux_amd64",
-    entrypoint = ["/app/shardok-server"],
-    exposed_ports = [
-        "40042/tcp",
-        "40052/tcp",
-    ],
-    tars = [
-        ":busybox_layer",
-        ":shardok_binary_layer",
-        ":shardok_resources_layer",
-        ":shardok_maps_layer",
-    ],
-    workdir = "/app",
-)
-
-# Load into Docker locally: bazel run //ci:shardok_server_load
-oci_load(
-    name = "shardok_server_load",
-    image = ":shardok_server_image",
-    repo_tags = ["eagle0/shardok-server:latest"],
-)
-
-# Push to DigitalOcean Container Registry
-# Note: No remote_tags here - DigitalOcean converts OCI to Docker format,
-# changing the digest and breaking oci_push's tag-by-digest logic.
-# Tagging is handled in the CI workflow using crane copy/tag.
-oci_push(
-    name = "shardok_server_push",
-    image = ":shardok_server_image",
-    repository = "registry.digitalocean.com/eagle0/shardok-server",
-)
-
-#
-# Shardok Server ARM64 Docker Image (for Hetzner on-demand compute)
-#
-# Build: bazel build //ci:shardok_server_image_arm64 --platforms=//:linux_arm64 --extra_toolchains=@llvm_toolchain_linux_arm64//:all
-# Load:  bazel run //ci:shardok_server_load_arm64
-# Push:  bazel run //ci:shardok_server_push_arm64
-#
-
-# Package the Shardok binary (ARM64 version - must be built with --platforms=//:linux_arm64)
-pkg_tar(
-    name = "shardok_binary_layer_arm64",
-    srcs = ["//src/main/cpp/net/eagle0/shardok:shardok-server"],
-    package_dir = "/app",
-)
-
-oci_image(
-    name = "shardok_server_image_arm64",
-    base = "@ubuntu_24_04_linux_arm64_v8",
-    entrypoint = ["/app/shardok-server"],
-    exposed_ports = [
-        "40042/tcp",
-        "40052/tcp",
-    ],
-    tars = [
-        # Note: busybox_layer_arm64 omitted - busybox.net has SSL issues
-        # Health checks can use the shardok-server binary itself or be added later
-        ":shardok_binary_layer_arm64",
-        ":shardok_resources_layer",
-        ":shardok_maps_layer",
-    ],
-    workdir = "/app",
-)
-
-# Load into Docker locally (ARM64): bazel run //ci:shardok_server_load_arm64
-oci_load(
-    name = "shardok_server_load_arm64",
-    image = ":shardok_server_image_arm64",
-    repo_tags = ["eagle0/shardok-server:latest-arm64"],
-)
-
-# Push to DigitalOcean Container Registry (for Hetzner deployment)
-# Uses same repository as x86 but with arm64- tag prefix
-oci_push(
-    name = "shardok_server_push_arm64",
-    image = ":shardok_server_image_arm64",
-    repository = "registry.digitalocean.com/eagle0/shardok-server",
-)
-
-#
-# Admin Server Docker Image (Go)
-#
-# Build: bazel build //ci:admin_server_image
-# Load:  bazel run //ci:admin_server_load
-# Push:  bazel run //ci:admin_server_push
-#
-
-# Package the Go admin binary (explicit Linux x86_64 target)
-pkg_tar(
-    name = "admin_binary_layer",
-    srcs = ["//src/main/go/net/eagle0/admin_server:admin_server_linux_amd64"],
-    package_dir = "/app",
-)
-
-oci_image(
-    name = "admin_server_image",
-    base = "@alpine_linux_linux_amd64",
-    entrypoint = ["/app/admin_server_linux_amd64"],
-    exposed_ports = ["8080/tcp"],
-    tars = [
-        ":busybox_layer",
-        ":admin_binary_layer",
-    ],
-    workdir = "/app",
-)
-
-# Load into Docker locally: bazel run //ci:admin_server_load
-oci_load(
-    name = "admin_server_load",
-    image = ":admin_server_image",
-    repo_tags = ["eagle0/admin-server:latest"],
-)
-
-# Push to DigitalOcean Container Registry
-oci_push(
-    name = "admin_server_push",
-    image = ":admin_server_image",
-    repository = "registry.digitalocean.com/eagle0/admin-server",
-)
-
-#
-# JFR Sidecar Docker Image (Go + JDK for jcmd)
-#
-# This sidecar runs with shared PID namespace to access the Eagle JVM.
-# Build: bazel build //ci:jfr_sidecar_image
-# Load:  bazel run //ci:jfr_sidecar_load
-# Push:  bazel run //ci:jfr_sidecar_push
-#
-
-# Package the Go JFR server binary
-pkg_tar(
-    name = "jfr_sidecar_binary_layer",
-    srcs = ["//src/main/go/net/eagle0/jfr_server:jfr_server_linux_amd64"],
-    package_dir = "/app",
-)
-
-oci_image(
-    name = "jfr_sidecar_image",
-    # Use JDK base image - we need jcmd to dump JFR recordings
-    base = "@eclipse_temurin_17_linux_amd64",
-    entrypoint = ["/app/jfr_server_linux_amd64"],
-    exposed_ports = ["8081/tcp"],
-    tars = [
-        ":jfr_sidecar_binary_layer",
-    ],
-    workdir = "/app",
-)
-
-# Load into Docker locally: bazel run //ci:jfr_sidecar_load
-oci_load(
-    name = "jfr_sidecar_load",
-    image = ":jfr_sidecar_image",
-    repo_tags = ["eagle0/jfr-sidecar:latest"],
-)
-
-# Push to DigitalOcean Container Registry
-oci_push(
-    name = "jfr_sidecar_push",
-    image = ":jfr_sidecar_image",
-    repository = "registry.digitalocean.com/eagle0/jfr-sidecar",
-)
-
-#
-# Auth Server Docker Image (Go)
-#
-# This is the external OAuth service that handles OAuth flows and JWT creation.
-# Build: bazel build //ci:auth_server_image
-# Load:  bazel run //ci:auth_server_load
-# Push:  bazel run //ci:auth_server_push
-#
-
-# Package the Go auth binary (explicit Linux x86_64 target)
-pkg_tar(
-    name = "auth_binary_layer",
-    srcs = [
-        "//src/main/go/net/eagle0/authcli:authcli_linux_amd64",
-        "//src/main/go/net/eagle0/authservice:authservice_linux_amd64",
-    ],
-    package_dir = "/app",
-)
-
-oci_image(
-    name = "auth_server_image",
-    base = "@alpine_linux_linux_amd64",
-    entrypoint = ["/app/authservice_linux_amd64"],
-    exposed_ports = [
-        "40033/tcp",  # gRPC
-        "8080/tcp",  # HTTP OAuth callback
-    ],
-    tars = [
-        ":busybox_layer",
-        ":auth_binary_layer",
-    ],
-    workdir = "/app",
-)
-
-# Load into Docker locally: bazel run //ci:auth_server_load
-oci_load(
-    name = "auth_server_load",
-    image = ":auth_server_image",
-    repo_tags = ["eagle0/auth-server:latest"],
-)
-
-# Push to DigitalOcean Container Registry
-oci_push(
-    name = "auth_server_push",
-    image = ":auth_server_image",
-    repository = "registry.digitalocean.com/eagle0/auth-server",
-)

ci/unity_version.sh

@@ -1 +1,2 @@
-UNITY_VERSION='6000.3.0f1'
+
+UNITY_VERSION='6000.2.7f2'

docker-compose.prod.yml

@@ -1,281 +0,0 @@
-# Docker Compose for production deployment
-#
-# Local testing:
-#   Build images: bazel run //ci:eagle_server_load && bazel run //ci:shardok_server_load && bazel run //ci:auth_server_load
-#   Run: docker compose -f docker-compose.prod.yml up
-#
-# Production deployment:
-#   Run: docker compose -f docker-compose.prod.yml up -d
-
-services:
-  # Blue-green deployment: eagle-blue is the primary (production) instance
-  # eagle-green is the staging instance for zero-downtime deployments
-  # See scripts/deploy-blue-green.sh for deployment workflow
-
-  eagle-blue:
-    image: ${EAGLE_IMAGE:-registry.digitalocean.com/eagle0/eagle-server:latest}
-    container_name: eagle-blue
-    command:
-      - "--gpt-model-name"
-      - "${GPT_MODEL_NAME:-gpt-5.1}"
-      - "--shardok-interface-remote-address"
-      - "${SHARDOK_ADDRESS:-shardok:40042}"
-      - "--auth-service-url"
-      - "auth:40033"
-    ports:
-      - "40032:40032"
-    environment:
-      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
-      EAGLE_ENABLE_S3: "${EAGLE_ENABLE_S3:-false}"
-      DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
-      DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
-      DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
-      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
-      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
-      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
-      # Auth token for remote Shardok on Hetzner (only used when shardok address contains .eagle0.net)
-      SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
-      # Use persistent volume for save data (users, games, etc.)
-      EAGLE_SAVE_DIR: "/app/saves"
-      EAGLE_ARCHIVE_DIR: "/app/archived"
-      SENTRY_DSN: "${SENTRY_DSN:-}"
-      SENTRY_ENVIRONMENT: "production"
-    volumes:
-      - ./saves:/app/saves           # Game saves and user database
-      - ./archived:/app/archived     # Archived completed games
-      - ./jfr:/app/jfr  # JFR recordings - dump with: docker exec eagle-blue jcmd 1 JFR.dump filename=/app/jfr/profile.jfr
-      - jvm-tmp:/tmp  # Shared with jfr-sidecar for JVM attach socket files
-      - jwt-keys:/etc/eagle0/keys  # Shared JWT keys with auth service
-    depends_on:
-      - shardok
-      - auth
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "100m"
-        max-file: "5"
-    healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost 40032 || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-  eagle-green:
-    image: ${EAGLE_IMAGE_NEW:-registry.digitalocean.com/eagle0/eagle-server:latest}
-    container_name: eagle-green
-    profiles: ["blue-green"]  # Only started during blue-green deployment
-    command:
-      - "--gpt-model-name"
-      - "${GPT_MODEL_NAME:-gpt-5.1}"
-      - "--shardok-interface-remote-address"
-      - "${SHARDOK_ADDRESS:-shardok:40042}"
-      - "--auth-service-url"
-      - "auth:40033"
-    ports:
-      - "40034:40032"  # Different host port for staging
-    environment:
-      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
-      EAGLE_ENABLE_S3: "${EAGLE_ENABLE_S3:-false}"
-      DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
-      DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
-      DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
-      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
-      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
-      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
-      SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
-      EAGLE_SAVE_DIR: "/app/saves"
-      EAGLE_ARCHIVE_DIR: "/app/archived"
-      SENTRY_DSN: "${SENTRY_DSN:-}"
-      SENTRY_ENVIRONMENT: "production"
-    volumes:
-      - ./saves:/app/saves           # Same save directory as blue
-      - ./archived:/app/archived     # Same archive directory as blue
-      - jwt-keys:/etc/eagle0/keys    # Shared JWT keys with auth service
-    depends_on:
-      - shardok
-      - auth
-    restart: "no"  # Don't auto-restart during deployment
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "100m"
-        max-file: "5"
-    healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost 40032 || exit 1"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-      start_period: 60s
-
-  # Backward compatibility alias - for scripts that reference 'eagle' service
-  eagle:
-    extends:
-      service: eagle-blue
-
-  auth:
-    image: ${AUTH_IMAGE:-registry.digitalocean.com/eagle0/auth-server:latest}
-    container_name: auth-server
-    environment:
-      # gRPC port for Auth service
-      AUTH_GRPC_PORT: "40033"
-      # HTTP port for OAuth callbacks
-      AUTH_HTTP_PORT: "8080"
-      # User data persistence directory
-      AUTH_DATA_DIR: "/app/data"
-      # Legacy path for migrating users from Eagle (Phase 1 migration)
-      AUTH_LEGACY_DATA_DIR: "/app/saves/auth"
-      # OAuth provider credentials
-      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
-      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
-      GOOGLE_CLIENT_ID: "${GOOGLE_CLIENT_ID:-}"
-      GOOGLE_CLIENT_SECRET: "${GOOGLE_CLIENT_SECRET:-}"
-      # Server base URL for OAuth callbacks
-      SERVER_BASE_URL: "${SERVER_BASE_URL:-https://prod.eagle0.net}"
-      # JWT keys - PEM files in volume, bootstrapped from JWK on first run
-      JWT_KEYS_PATH: "/etc/eagle0/keys"
-      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
-      # Fastmail JMAP API for sending invitation emails
-      FASTMAIL_API_TOKEN: "${FASTMAIL_API_TOKEN:-}"
-      FASTMAIL_FROM_EMAIL: "${FASTMAIL_FROM_EMAIL:-}"
-      FASTMAIL_FROM_NAME: "${FASTMAIL_FROM_NAME:-}"
-    # Note: port 40033 is exposed via nginx, not directly
-    volumes:
-      - jwt-keys:/etc/eagle0/keys  # Shared JWT keys with Eagle
-      - ./auth-data:/app/data      # User database persistence
-      - ./saves:/app/saves:ro      # Read-only access to Eagle's saves for migration
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "50m"
-        max-file: "3"
-    healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost 40033 || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
-
-  shardok:
-    image: ${SHARDOK_IMAGE:-registry.digitalocean.com/eagle0/shardok-server:latest}
-    container_name: shardok-server
-    mem_limit: 1g
-    memswap_limit: 1g  # Prevent swap, OOM-kill cleanly instead
-    ports:
-      - "40042:40042"
-      - "40052:40052"
-    environment:
-      SHARDOK_RESOURCES_PATH: "/app/resources"
-      SHARDOK_MAPS_PATH: "/app/resources/maps"
-      SHARDOK_EAGLE_INTERFACE_ADDRESS: "0.0.0.0:40042"
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "100m"
-        max-file: "5"
-    healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost 40042 || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
-
-  nginx:
-    image: nginx:alpine
-    container_name: nginx
-    ports:
-      - "443:443"
-      - "80:80"
-      - "40033:40033"  # Go Auth service gRPC (Phase 2 direct client connections)
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./certbot/conf:/etc/letsencrypt:ro
-      - ./certbot/www:/var/www/certbot:ro
-      - ./auth:/etc/nginx/auth:ro
-    depends_on:
-      - eagle-blue
-      - admin
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "50m"
-        max-file: "3"
-
-  admin:
-    image: ${ADMIN_IMAGE:-registry.digitalocean.com/eagle0/admin-server:latest}
-    container_name: admin-server
-    command:
-      - "--eagle-addr"
-      - "${EAGLE_ADDR:-eagle-blue:40032}"  # Can be switched for blue-green
-      - "--auth-addr"
-      - "auth:40033"
-      - "--jfr-sidecar-addr"
-      - "jfr-sidecar:8081"
-      - "--http-port"
-      - "8080"
-    # No external port - accessed via nginx at admin.eagle0.net
-    depends_on:
-      - eagle-blue
-      - auth
-      - jfr-sidecar
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "50m"
-        max-file: "3"
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/health || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
-
-  jfr-sidecar:
-    image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
-    container_name: jfr-sidecar
-    # Share PID namespace with Eagle to access its JVM via jcmd
-    pid: "service:eagle-blue"
-    volumes:
-      - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
-    depends_on:
-      - eagle-blue
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "10m"
-        max-file: "2"
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q --spider http://localhost:8081/health || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
-
-  certbot:
-    image: certbot/certbot
-    container_name: certbot
-    volumes:
-      - ./certbot/conf:/etc/letsencrypt
-      - ./certbot/www:/var/www/certbot
-    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
-
-volumes:
-  jvm-tmp:
-    # Shared /tmp for JVM attach socket files between Eagle and jfr-sidecar
-  jwt-keys:
-    # Shared JWT RSA keys between Eagle and auth service
-
-networks:
-  default:
-    driver: bridge
-    enable_ipv6: true
-    ipam:
-      config:
-        - subnet: 172.28.0.0/16
-        - subnet: fd00:dead:beef::/48

docs/ADMIN_SERVER_ENHANCEMENTS.md

@@ -1,471 +0,0 @@
-# Admin Server Enhancement Plan
-
-## Overview
-
-This document outlines enhancements to the Go admin server (`src/main/go/net/eagle0/admin_server/`) to provide a proper web UI for game administration.
-
-### Current State
-
-The admin server provides a full web UI with htmx interactivity:
-- `GET /` - Redirect to games list
-- `GET /games` - Game list page (HTML)
-- `GET /games/{id}` - Game detail with action history
-- `GET /games/{id}/history` - History rows (htmx partial, infinite scroll)
-- `GET /games/{id}/action/{index}` - Action detail (htmx partial)
-- `POST /games/{id}/rewind` - Rewind game to target action
-- `GET /settings` - Settings list with live search
-- `POST /settings/update` - Update setting value
-- `GET /health` - Health check (JSON)
-- `GET /api/games` - JSON API for programmatic access
-- `GET /api/games/{id}/history` - JSON API for history
-
-### Goals
-
-1. **Web UI**: Replace raw JSON with an interactive HTML interface
-2. **Settings Management**: View and modify the 275+ game settings at runtime
-3. **Game Rewind**: Restore a game to a previous action count
-
----
-
-## Architecture
-
-### Technology Choice: Go Templates + htmx
-
-**Rationale:**
-- Single binary deployment (no separate frontend build)
-- htmx provides interactivity without JavaScript framework complexity
-- Familiar HTML/CSS, minimal learning curve
-- Excellent for admin tools where SEO and bundle size don't matter
-
-**Alternatives Considered:**
-- React/Vue SPA: Adds build complexity, separate deployment artifact
-- Server-side only: Less interactive, full page reloads
-
-### Directory Structure
-
-```
-src/main/go/net/eagle0/admin_server/
-├── admin_server.go         # Main entry point, HTTP routes
-├── handlers/
-│   ├── games.go            # Game list and detail handlers
-│   ├── settings.go         # Settings list and update handlers
-│   └── rewind.go           # Game rewind handlers
-├── templates/
-│   ├── layout.html         # Base layout with nav, htmx includes
-│   ├── games/
-│   │   ├── list.html       # Game list page
-│   │   ├── detail.html     # Single game view with history
-│   │   └── history.html    # Partial for history table (htmx)
-│   ├── settings/
-│   │   ├── list.html       # Settings list with search/filter
-│   │   └── edit.html       # Inline edit partial (htmx)
-│   └── rewind/
-│       └── confirm.html    # Rewind confirmation modal
-├── static/
-│   ├── style.css           # Minimal CSS (Pico CSS or similar)
-│   └── htmx.min.js         # htmx library
-└── BUILD.bazel
-```
-
----
-
-## Feature 1: Web UI
-
-### Routes
-
-| Route | Method | Description |
-|-------|--------|-------------|
-| `/` | GET | Redirect to `/games` |
-| `/games` | GET | Game list page (HTML) |
-| `/games/{id}` | GET | Game detail page with history |
-| `/games/{id}/history` | GET | History partial (htmx, for infinite scroll) |
-| `/api/games` | GET | JSON API (existing, keep for programmatic access) |
-| `/api/games/{id}/history` | GET | JSON API (existing) |
-
-### Game List Page
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│  Eagle Admin                          [Settings] [Health]   │
-├─────────────────────────────────────────────────────────────┤
-│                                                             │
-│  Running Games (3)                                          │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ Game abc123f                          Round 45       │   │
-│  │ Players: Liu Bei (Human), Cao Cao (AI), Sun Quan    │   │
-│  │ Actions: 1,234                        [View] [Rewind]│   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ Game def456a                          Round 12       │   │
-│  │ Players: Test Player (Human)                         │   │
-│  │ Actions: 456                          [View] [Rewind]│   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-└─────────────────────────────────────────────────────────────┘
-```
-
-### Game Detail Page
-
-Shows game info and scrollable action history:
-- **Reverse chronological order**: Most recent actions displayed first
-- Each action shows: index, type, round ID
-- **Clickable actions**: Clicking an action row expands to show JSON representation of the full action data
-- "Rewind to here" button on each action row
-- Infinite scroll loads more history via htmx (loading older actions as user scrolls down)
-
-### Implementation Notes
-
-1. **Embed static files**: Use `//go:embed` to bundle templates and static files
-2. **Template functions**: Add helpers for formatting (hex IDs, timestamps, action summaries)
-3. **CSS framework**: Use Pico CSS (~10KB) for clean defaults without classes
-
----
-
-## Feature 2: Settings Management
-
-### New gRPC Endpoints (Eagle Server)
-
-Add to `eagle.proto`:
-
-```protobuf
-message Setting {
-  string name = 1;
-  string type = 2;           // "Int" or "Double"
-  string value = 3;          // Current value as string
-  string default_value = 4;  // Default from BUILD.bazel
-  string description = 5;    // Optional, for UI hints
-}
-
-message GetSettingsRequest {
-  string filter = 1;         // Optional name filter (substring match)
-}
-
-message GetSettingsResponse {
-  repeated Setting settings = 1;
-}
-
-message UpdateSettingRequest {
-  string name = 1;
-  string value = 2;
-}
-
-message UpdateSettingResponse {
-  Setting setting = 1;       // Updated setting
-  string error = 2;          // Empty on success
-}
-
-service Eagle {
-  // ... existing methods ...
-  rpc GetSettings(GetSettingsRequest) returns (GetSettingsResponse);
-  rpc UpdateSetting(UpdateSettingRequest) returns (UpdateSettingResponse);
-}
-```
-
-### Eagle Server Implementation
-
-Create a settings registry that:
-1. Discovers all `IntSetting` and `DoubleSetting` instances via reflection or explicit registration
-2. Provides get/set by name
-3. Validates types on update
-
-```scala
-// src/main/scala/net/eagle0/eagle/library/settings/SettingsRegistry.scala
-object SettingsRegistry {
-  private val settings: Map[String, Either[IntSetting, DoubleSetting]] = Map(
-    "ActionVigorCost" -> Left(ActionVigorCost),
-    "BaseFoodBuyPrice" -> Right(BaseFoodBuyPrice),
-    // ... register all 275 settings
-  )
-
-  def getAll(filter: Option[String]): Seq[Setting] = ...
-  def get(name: String): Option[Setting] = ...
-  def update(name: String, value: String): Either[String, Setting] = ...
-}
-```
-
-**Alternative: Code generation**
-
-Rather than manually registering 275 settings, modify `setting_rule.bzl` to generate a registry file during build.
-
-### Admin Server Routes
-
-| Route | Method | Description |
-|-------|--------|-------------|
-| `/settings` | GET | Settings list page with search |
-| `/settings/{name}` | GET | Single setting detail (htmx partial) |
-| `/settings/{name}` | PUT | Update setting value |
-| `/api/settings` | GET | JSON API |
-| `/api/settings/{name}` | PUT | JSON API |
-
-### Settings UI
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│  Eagle Admin                          [Games] [Health]       │
-├─────────────────────────────────────────────────────────────┤
-│                                                             │
-│  Settings                    [Search: __________ ]          │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ ActionVigorCost (Int)                                │   │
-│  │ Current: [15    ] Default: 15              [Save]    │   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-│  ┌─────────────────────────────────────────────────────┐   │
-│  │ BaseFoodBuyPrice (Double)                            │   │
-│  │ Current: [0.5   ] Default: 0.5             [Save]    │   │
-│  └─────────────────────────────────────────────────────┘   │
-│                                                             │
-│  ... (275 settings, virtualized/paginated) ...              │
-│                                                             │
-└─────────────────────────────────────────────────────────────┘
-```
-
-### Considerations
-
-1. **Persistence**: Settings changes are in-memory only. Document that restarts reset to defaults.
-2. **Validation**: Validate numeric ranges where applicable (e.g., percentages 0-100)
-3. **Categories**: Consider grouping settings by prefix (AI*, Combat*, Economy*, etc.)
-4. **Audit log**: Log setting changes with timestamp for debugging
-
----
-
-## Feature 3: Game Rewind
-
-### Concept
-
-Restore a game to a previous point in its action history. This is useful for:
-- Debugging issues that occurred at a specific point
-- Testing "what if" scenarios
-- Recovering from bugs that corrupted state
-
-### New gRPC Endpoint
-
-Add to `eagle.proto`:
-
-```protobuf
-message RewindGameRequest {
-  int64 game_id = 1;
-  int32 target_action_count = 2;  // Rewind to state after this many actions
-}
-
-message RewindGameResponse {
-  bool success = 1;
-  string error = 2;
-  int32 new_action_count = 3;
-  int32 disconnected_clients = 4;  // Number of clients that were disconnected
-}
-
-service Eagle {
-  // ... existing methods ...
-  rpc RewindGame(RewindGameRequest) returns (RewindGameResponse);
-}
-```
-
-### Eagle Server Implementation
-
-The `GameHistory` already stores `ActionWithResultingState` for each action, which includes the `GameState` after that action. Rewinding means:
-
-1. **Validate**: Check that `target_action_count` is within valid range (0 to current count)
-2. **Get target state**: Retrieve `GameState` at target action count from history
-3. **Disconnect clients**: Close all human player connections (they'll need to reconnect)
-4. **Replace engine**: Create new `EngineImpl` with target state and truncated history
-5. **Reset AI state**: Clear any cached AI state that depends on current game state
-
-```scala
-// GameController.scala (pseudocode)
-def rewindTo(targetActionCount: Int): Either[String, RewindResult] = {
-  if (targetActionCount < 0 || targetActionCount > engine.history.count)
-    return Left(s"Invalid action count: $targetActionCount")
-
-  // Get state at target point
-  val targetState = engine.history.stateAt(targetActionCount)
-  val truncatedHistory = engine.history.truncateTo(targetActionCount)
-
-  // Disconnect all human clients
-  val disconnectedCount = humanClients.length
-  humanClients.foreach(_.disconnect("Game rewound by admin"))
-
-  // Create new engine at target state
-  val newEngine = EngineImpl(
-    gameId = engine.gameId,
-    currentState = targetState,
-    history = truncatedHistory,
-    // ... other fields
-  )
-
-  // Replace controller's engine
-  this.engine = newEngine
-
-  Right(RewindResult(targetActionCount, disconnectedCount))
-}
-```
-
-### GameHistory Enhancement
-
-Add method to get state at a specific action count:
-
-```scala
-trait GameHistory {
-  // ... existing methods ...
-
-  def stateAt(actionCount: Int): GameState = {
-    if (actionCount == 0) initialState
-    else all(actionCount - 1).resultingState
-  }
-
-  def truncateTo(actionCount: Int): GameHistory = {
-    GameHistoryImpl(
-      initialState = initialState,
-      actions = all.take(actionCount)
-    )
-  }
-}
-```
-
-### Admin Server Route
-
-| Route | Method | Description |
-|-------|--------|-------------|
-| `/games/{id}/rewind` | POST | Rewind game (form: `target_action_count`) |
-| `/games/{id}/rewind/confirm` | GET | Confirmation modal (htmx partial) |
-
-### Rewind UI Flow
-
-1. User views game history
-2. User clicks "Rewind to here" on an action row
-3. Confirmation modal appears via htmx:
-   ```
-   ┌─────────────────────────────────────────┐
-   │  Rewind Game abc123f?                   │
-   │                                         │
-   │  This will:                             │
-   │  • Restore to action 456 (Round 23)     │
-   │  • Discard 778 subsequent actions       │
-   │  • Disconnect 2 connected players       │
-   │                                         │
-   │  This cannot be undone.                 │
-   │                                         │
-   │            [Cancel]  [Rewind]           │
-   └─────────────────────────────────────────┘
-   ```
-4. On confirm, POST to `/games/{id}/rewind`
-5. Success: redirect to game detail showing new state
-6. Error: show error message
-
-### Safety Considerations
-
-1. **No undo**: Rewinding discards history. Consider optional backup before rewind.
-2. **Client disconnect**: All connected clients are forcibly disconnected.
-3. **AI state**: Ensure AI clients restart cleanly after rewind.
-4. **Concurrent access**: Lock game during rewind to prevent race conditions.
-5. **Authorization**: In production, require admin authentication.
-
----
-
-## Implementation Phases
-
-### Phase 1: Web UI Foundation
-
-**Status: Complete**
-
-1. ✅ Set up Go templates with `embed`
-2. ✅ Add Pico CSS and htmx
-3. ✅ Create base layout with navigation
-4. ✅ Convert `/games` to HTML with styling
-5. ✅ Add game detail page with history table
-6. ✅ Implement htmx infinite scroll for history
-7. ✅ Reverse history order (most recent first)
-8. ✅ Clickable action rows that expand to show JSON representation
-9. ✅ Add `/games/{id}/action/{index}` endpoint for fetching action details
-
-**Deliverable**: Browsable game list and history in HTML with clickable action details
-
-### Phase 2: Settings Management
-
-**Status: Complete**
-
-1. ✅ Add `GetSettings` to `eagle.proto` (uses existing `AddSettings` for updates)
-2. ✅ Add `getAllSettings` method to auto-generated `SettingsLoader`
-3. ✅ Implement `getSettings` in `EagleServiceImpl`
-4. ✅ Create settings list page with live search
-5. ✅ Add inline editing with htmx
-6. ✅ Modified settings are highlighted
-
-**Deliverable**: View and edit settings via admin UI
-
-### Phase 3: Game Rewind
-
-**Status: Complete**
-
-1. ✅ Add `RewindGame` to `eagle.proto`
-2. ✅ Implement `stateAt` and `truncateTo` in `GameHistory`
-3. ✅ Implement rewind logic in `Engine` and `GameController`
-4. ✅ Add rewind confirmation (htmx `hx-confirm` dialog)
-5. ✅ Handle client disconnection gracefully
-6. ✅ Add rewind button to history rows
-7. ✅ Implement `rewindGame` in `GamesManager` and `EagleServiceImpl`
-8. ✅ Add admin server `/games/{id}/rewind` POST handler
-9. ✅ Add success/error feedback UI
-
-**Deliverable**: Rewind games to any previous action
-
-### Phase 4: Polish
-
-**Status: Not Started**
-
-#### High Priority
-1. **Add tests for rewind functionality**
-   - `PersistedHistory.truncateTo` (handles complex persisted vs recent logic)
-   - `InMemoryHistory.truncateTo`
-   - `EngineImpl.rewindTo`
-   - `GameController.rewindTo`
-   - `GamesManager.rewindGame`
-
-2. **Improve action history display**
-   - Human-readable action type names (e.g., "New Round" instead of "NewRoundAction")
-   - Show acting faction/province when available
-   - Action summaries from the `summary` field in `GameHistoryEntry`
-
-#### Medium Priority
-3. **Settings improvements**
-   - Group settings by category prefix (AI*, Combat*, Economy*, etc.)
-   - Show setting descriptions where available
-   - Pagination for large settings lists
-
-4. **Error handling improvements**
-   - Better error messages on failed operations
-   - Retry logic for transient gRPC failures
-
-#### Low Priority (Nice to Have)
-5. **Basic auth** - HTTP Basic Auth or OAuth for production use
-6. **Audit logging** - Log admin actions with timestamps
-7. **Documentation** - Usage guide, deployment notes
-
-#### Future Considerations
-- Game creation from admin UI
-- Player management (view connected players, force disconnect)
-- Export game history to file
-- Metrics/stats dashboard
-
----
-
-## Security Notes
-
-The admin server is intended for local/trusted network use only. For production:
-
-1. **Do not expose to public internet** without authentication
-2. Consider adding HTTP Basic Auth or OAuth
-3. Run on internal network or behind VPN
-4. Log all admin actions for audit trail
-
----
-
-## Open Questions
-
-1. **Settings persistence**: Should we add optional persistence to disk/database?
-2. **Game snapshots**: Should rewind create a backup first?
-3. **Multi-admin**: Need locking if multiple admins access simultaneously?
-4. **Shardok settings**: Are there Shardok (C++) settings to expose too?

docs/ASSET_AUDIT.md

@@ -1,240 +0,0 @@
-# Eagle0 Media Asset Audit
-
-This document catalogs all media assets in the Unity project for licensing review.
-
-**Total Assets:** ~12,500 files | **Size:** 1.4 GB
-
----
-
-## Summary by Category
-
-| Category | Count | Notes |
-|----------|-------|-------|
-| Images | 10,637 | Mostly PNG icons and UI sprites |
-| Audio | 1,778 | 26 music tracks + 1,752 sound effects |
-| 3D Models | 52 | Bridge pack only |
-| Fonts | 16 | TTF files |
-
----
-
-## 1. Purchased Asset Store Packages
-
-These are commercial Unity Asset Store purchases tied to your account:
-
-### 4000_Fantasy_Icons
-- **Location:** `Assets/4000_Fantasy_Icons/`
-- **Size:** 495 MB (5,621 PNG files)
-- **Contents:** Icons for armor, weapons, skills, resources
-- **License:** Unity Asset Store (check invoice/account)
-
-### GUI Pro Kit Fantasy RPG
-- **Location:** `Assets/GUI Pro Kit Fantasy RPG/`
-- **Size:** 117 MB (3,755 PNG files)
-- **Contents:** UI sprites, animations, prefabs
-- **Includes fonts:** Alata-Regular.ttf, JosefinSans-Bold.ttf
-- **License:** Unity Asset Store
-
-### Modern UI Pack v4.2.0
-- **Location:** `Assets/Modern UI Pack/`
-- **Size:** 40 MB (191 PNG files)
-- **Author:** Michsky (support@michsky.com)
-- **Website:** https://www.michsky.com
-- **Includes fonts:** Open Sans family (12 variants)
-- **License:** Unity Asset Store
-
-### Pixel Fonts Megapack
-- **Location:** `Assets/Pixel Fonts Megapack/`
-- **Publisher ID:** 17384
-- **Author:** @pixelmush_ on Twitter
-- **Asset Store Link:** http://u3d.as/w4v
-- **License:** Unity Asset Store
-
-### TileableBridgePack
-- **Location:** `Assets/TileableBridgePack/`
-- **Size:** 3.1 MB (52 FBX models)
-- **Contents:** Bridge construction pieces
-- **License:** Unity Asset Store
-
-### Fantasy Interface Sounds
-- **Location:** `Assets/Fantasy Interface Sounds/`
-- **Count:** 320 WAV files
-- **Contents:** UI sounds (bag, book, coins, dice, etc.)
-- **License:** Unity Asset Store (verify)
-
-### Medieval Combat Sounds
-- **Location:** `Assets/Medieval Combat Sounds/`
-- **Count:** 1,072 WAV files
-- **Contents:** Footsteps, swings, shields, weapons, magic
-- **License:** Unity Asset Store (verify)
-
-### Magic Spells Sound Effects LITE
-- **Location:** `Assets/Magic Spells Sound Effects LITE/`
-- **Count:** 254 WAV files
-- **Contents:** Spell casting, element effects
-- **Note:** "LITE" version - check if restrictions apply
-- **License:** Unity Asset Store (verify)
-
----
-
-## 2. Creative Commons Music (Properly Licensed)
-
-**Location:** `Assets/Resources/Music/`
-**Documentation:** `Music Credits.txt` (attribution file exists)
-
-All 26 tracks have CC licenses with proper attribution:
-
-| Track | Artist | License |
-|-------|--------|---------|
-| A Robust Crew | Darren Curtis | CC BY 3.0 |
-| Asian Graveyard | Darren Curtis | CC BY 3.0 |
-| Fall From Grace | Darren Curtis | CC BY 3.0 |
-| Samurai Sake Showdown | Darren Curtis | CC BY 3.0 |
-| Deflector | Ghostrifter Official | CC BY-SA 3.0 |
-| Chase | Alexander Nakarada | CC BY 4.0 |
-| Wintersong | Alexander Nakarada | CC BY 4.0 |
-| One Bard Band | Alexander Nakarada | CC BY 4.0 |
-| Now We Ride | Alexander Nakarada | CC BY 4.0 |
-| The Northern Path | Alexander Nakarada | CC BY 4.0 |
-| Victory | MaxKoMusic | CC BY-SA 3.0 |
-| Sakuya2 | PeriTune | CC BY 3.0 |
-| Under The Sun | Keys of Moon | CC BY 4.0 |
-| One Piece of Summer | Keys of Moon | CC BY 4.0 |
-| Fluffing a Duck | Kevin MacLeod | CC BY 3.0 |
-| Space Jazz | Kevin MacLeod | CC BY 3.0 |
-| The Ice Giants | Kevin MacLeod | CC BY 4.0 |
-| Epic Cinematic Trailer ELITE | Alex-Productions | CC BY 3.0 |
-| Push | Alex-Productions | CC BY 3.0 |
-| Virus | Alex-Productions | CC BY 3.0 |
-| Duel | Makai Symphony | CC BY-SA 3.0 |
-| Dragon Castle | Makai Symphony | CC BY-SA 3.0 |
-| Durandal | Makai Symphony | CC BY-SA 3.0 |
-
-**Tracks without specific license (verify):**
-- Market Day
-- Shopping List
-- Medieval: Victory Theme
-- Tracks by Dima Koltsov (AUDIUS): No Time for Greatness, Warriors of Demacia, Forest Queen Tale, Valor, Clouds
-
----
-
-## 3. CC0 / Public Domain Assets
-
-### SimpleFileBrowser Icons
-- **Location:** `Assets/Plugins/SimpleFileBrowser/Sprites/FileIcons/`
-- **License:** CC0 (documented in LICENSE.txt)
-- **Source:** pngrepo.com
-- **Items:** Archive, Audio, Default, Drive, Folder, Image, PDF, Text, Video icons
-
----
-
-## 4. Potentially Problematic Assets (Review Needed)
-
-### Stock Images (Possible License Issues)
-These appear to be stock images that may have been used as placeholders:
-
-| File | Concern |
-|------|---------|
-| ~~`Assets/Eagle/79066358-stock-illustration-raster-illustration-medieval-purse-bag...jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Images/kisspng-hammer-hand-saws-tool-clip-art...jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Images/lee-ermy-cropped.jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Eagle/images.jpeg`~~ | **DELETED** (2025-01-04) |
-
-### Clip Art (Unknown License)
-| File | Concern |
-|------|---------|
-| `Assets/Shardok/commandImages/bridge.png` | Clip art style wooden bridge, unknown source - **needs replacement** |
-| `Assets/Images/startFire.png` | Icon, unknown source - **needs verification or replacement** |
-
-### Shardok Sound Effects
-- **Location:** `Assets/Shardok/soundEffects/`
-- **Count:** 56 MP3 files
-- **Contents:** Spell effects, movement, combat sounds
-- **Status:** Unknown origin - may be custom or need verification
-
-### Free Icons
-- **Location:** `Assets/free_icons/`
-- **Count:** 8 PNG weather icons
-- **Status:** Verify "free" means commercially usable
-
-### Terrain Hexes
-- **Location:** `Assets/Terrain Hexes/`
-- **Count:** 85 PNG files
-- **Status:** Unknown source - verify licensing
-
-### StrategyGameIcons
-- **Location:** `Assets/StrategyGameIcons/`
-- **Count:** 138 PNG files
-- **Status:** Unknown source - verify licensing
-
----
-
-## 5. Fonts
-
-| Font | Location | License |
-|------|----------|---------|
-| Open Sans (12 variants) | Modern UI Pack | Apache 2.0 (Google Font) |
-| Alata-Regular | GUI Pro Kit | SIL OFL (Google Font) |
-| JosefinSans-Bold | GUI Pro Kit | SIL OFL (Google Font) |
-| LiberationSans | TextMesh Pro | SIL OFL |
-| NotoColorEmoji | Assets root | SIL OFL (Google) |
-| Stoke-Light, Stoke-Regular | Assets root | SIL OFL (Google Font) |
-
-All fonts appear to be open-source Google Fonts or Liberation fonts - should be fine.
-
----
-
-## 6. Third-Party Code Packages
-
-NuGet packages in `Assets/Packages/` all include LICENSE.TXT files:
-- Microsoft.Extensions.* - MIT License
-- System.* - MIT License
-- Grpc.* - Apache 2.0
-
----
-
-## Action Items
-
-### Must Verify Before Opening Public Access:
-
-1. ~~**Stock images** - The JPG files with stock image filenames need review.~~ **DONE** - Deleted lee-ermy, kisspng, stock-illustration, Yosemite Sam, and images.jpeg (2025-01-04)
-
-2. **Clip art images** - Unknown license, need replacement with properly licensed alternatives:
-   - `Assets/Shardok/commandImages/bridge.png` - wooden bridge icon
-   - `Assets/Images/startFire.png` - fire icon
-
-3. **Shardok sound effects** - 56 MP3 files of unknown origin. Either:
-   - Document their source
-   - Replace with known-licensed alternatives
-   - Confirm they were custom-created
-
-4. **Terrain Hexes** - 85 hex tiles of unknown source
-   - **TODO:** Confirm if this is a Unity Asset Store purchase (owner believes it is)
-
-5. **StrategyGameIcons** - 138 icons of unknown source
-   - **TODO:** Investigate origin - check Unity Asset Store purchase history
-
-6. **AUDIUS music tracks** - Verify Dima Koltsov tracks are licensed for commercial use
-
-7. **Discord logo** (`Eagle/Discord-Logo-Blurple.png`) - Likely fine for "Login with Discord" button per Discord brand guidelines, but verify usage complies with their terms
-
-### Already Safe:
-
-- All Asset Store purchases (license tied to your account)
-- CC-licensed music (attribution in Music Credits.txt)
-- CC0 SimpleFileBrowser icons
-- Google Fonts / Liberation fonts
-- NuGet packages
-
----
-
-## Recommendation
-
-Before removing HTTP basic auth:
-
-1. ~~Delete or replace the 4 suspicious JPG/JPEG files in `Assets/Eagle/` and `Assets/Images/`~~ **DONE** (2025-01-04)
-2. Replace clip art images (`bridge.png`, `startFire.png`) with properly licensed alternatives (e.g., from [game-icons.net](https://game-icons.net) CC BY 3.0)
-3. Verify source of `Assets/Shardok/soundEffects/` MP3s
-4. Verify source of `Assets/Terrain Hexes/` and `Assets/StrategyGameIcons/`
-5. If any are from early development with unclear licensing, replace them
-
-The bulk of your assets (95%+) are properly licensed Asset Store purchases or CC content.

docs/DEPROTO_PLAN.md

@@ -1,388 +0,0 @@
-# Deproto Migration Plan
-
-## Vision
-
-**Protocol buffers should only be used at the edges** — for network serialization (gRPC) and disk persistence. Inside the Eagle game engine, all logic should operate on native Scala models.
-
-```
-┌─────────────────────────────────────────────────────────────────────┐
-│                         GRPC BOUNDARY                               │
-│  EagleServiceImpl.scala  ←→  Proto Messages  ←→  Unity Client       │
-└─────────────────────────────────────────────────────────────────────┘
-                                   ↓
-                          GameStateConverter
-                                   ↓
-┌─────────────────────────────────────────────────────────────────────┐
-│                         SCALA ENGINE                                │
-│                                                                     │
-│   GameStateC ───→ Actions ───→ ActionResultT ───→ New GameStateC   │
-│       ↑                                                   │        │
-│       │               (Pure Scala models)                 │        │
-│       └───────────────────────────────────────────────────┘        │
-│                                                                     │
-│   HeroC, FactionC, ProvinceC, BattalionC, ArmyC, etc.              │
-└─────────────────────────────────────────────────────────────────────┘
-                                   ↓
-                          GameStateConverter
-                                   ↓
-┌─────────────────────────────────────────────────────────────────────┐
-│                      PERSISTENCE BOUNDARY                           │
-│  GameHistory.scala  ←→  Proto Messages  ←→  File/Database          │
-└─────────────────────────────────────────────────────────────────────┘
-```
-
----
-
-## Current State
-
-### Completed Phases
-
-| Phase | Status | Summary |
-|-------|--------|---------|
-| Phase 1: GameStateC | **Complete** | Scala `GameState` model with 22 fields |
-| Phase 2: EngineImpl | **Complete** | Holds Scala `GameState` internally |
-| Phase 3: GameHistory | **Complete** | `stateAfter` returns Scala GameState |
-| Phase 4: ActionResultT | **Complete** | All 59 actions return `ActionResultT` |
-| Phase 5: Action Base Classes | **Complete** | All `RandomSequentialResultsAction` and `DeterministicSingleResultAction` converted to T-type base classes |
-| Phase 5b: Base Class Cleanup | **Complete** | `RandomSequentialResultsAction` and `DeterministicSingleResultAction` deleted |
-| Phase 5c: RoundPhaseAdvancer Actions | **Complete** | All actions called by RoundPhaseAdvancer accept Scala GameState |
-| Phase 5d: RoundPhaseAdvancer Itself | **Complete** | RoundPhaseAdvancer.checkForPhaseAdvancement takes Scala GameState |
-
-### Phase 5c/5d Progress (Complete)
-
-`RoundPhaseAdvancer.checkForPhaseAdvancement` now accepts Scala `GameState` and `ActionResultApplier` directly (PR #4677).
-
-| Action | PR | Status |
-|--------|-----|--------|
-| `PrisonerExchangeAction` | #4670 | ✅ Merged |
-| `PerformForcedTurnBackAction` | #4671 | ✅ Merged |
-| `PerformHeroDeparturesAction` | #4672 | ✅ Merged |
-| `RequestFreeForAllBattlesAction` | #4673 | ✅ Merged |
-| `EndPlayerCommandsPhaseAction` | #4674 | ✅ Merged |
-| `EndDiplomacyResolutionPhaseAction` | #4675 | ✅ Merged |
-| `RoundPhaseAdvancer` itself | #4677 | ✅ Merged |
-
-### EngineImpl Progress
-
-| Change | PR | Status |
-|--------|-----|--------|
-| `recursiveTransform` deleted | #4677 | ✅ Merged |
-| `recursiveTransformT` uses `RandomStateTSequencer` | #4677 | ✅ Merged |
-
-### Current Architecture
-
-**ActionResultT Production (100% Complete):**
-- All actions produce `ActionResultT`
-- Conversion to `ActionResultProto` happens via `ActionResultProtoConverter.toProto()`
-- No direct `ActionResultProto` construction outside the converter
-
-**ActionResultProto Consumption (Next Target):**
-- `ActionResultProtoApplierImpl` - applies proto results to proto GameState
-- `RoundPhaseAdvancer` - calls converter, passes protos to applier
-- `InMemoryHistory` / `PersistedHistory` - stores proto results
-- Service layer (`GameController`, `GamesManager`, etc.) - uses proto for client communication
-
----
-
-## Phase 6: Migrate to ActionResultT Consumers
-
-### Objective
-
-Eliminate internal consumption of `ActionResultProto`. Everything inside the engine should work with `ActionResultT`.
-
-### Current Flow (Proto-Heavy)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultProtoConverter.toProto()
-    → ActionResultProto
-    → ActionResultProtoApplierImpl.applyActionResults()
-    → GameStateProto
-    → GameStateConverter.fromProto()
-    → GameStateC
-```
-
-### Target Flow (T-Types Throughout)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultApplier.applyActionResults()
-    → GameStateC
-
-    (Proto conversion only at boundaries)
-```
-
-### Key Files to Convert
-
-**Tier 1 - Core Applier:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/actions/applier/ActionResultApplierImpl.scala
-```
-`ActionResultApplier` applies `ActionResultT` directly to Scala `GameState`. The legacy `ActionResultTApplierImpl` wraps it and converts to/from proto for callers that still need proto types.
-
-**Tier 2 - RoundPhaseAdvancer:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/RoundPhaseAdvancer.scala
-```
-Now accepts Scala `GameState` and `ActionResultApplier`. Only converts to proto lazily for `AvailableCommandsFactory` calls.
-
-**Tier 3 - Sequencers:**
-```
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateTSequencer.scala
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateProtoSequencer.scala
-```
-Modify `RandomStateTSequencer` to thread Scala `GameState` throughout (currently converts to proto internally). Then evaluate whether `RandomStateProtoSequencer` is still needed at all.
-
-**Current State**: `RandomStateTSequencer` accepts Scala `GameState` via its `apply()` method but internally converts to proto. All callback methods (`withRandomActionResult`, `withActionResults`, etc.) pass `GameStateProto` to callers, forcing actions that use the sequencer to work with proto types internally.
-
-**Target State**: Create a fully protoless sequencer where:
-1. `lastState` returns Scala `GameState` (not `lastStateProto`)
-2. All callback methods pass Scala `GameState` to callers
-3. Actions using the sequencer can be fully protoless
-
-**Migration Path**:
-1. Add `lastState: GameState` method alongside `lastStateProto` (non-breaking)
-2. Add parallel callback methods that pass Scala GameState (e.g., `withScalaActionResult`)
-3. Migrate actions one by one to use the new Scala-based callbacks
-4. Once all actions migrated, deprecate/remove proto-based callbacks
-5. Remove `lastStateProto` once no longer used
-
-**RandomStateSequencer Migration Progress** (PR #4679 introduced protoless `RandomStateSequencer`):
-
-| Action | Status |
-|--------|--------|
-| `TruceTurnBackPhaseAction` | ✅ Migrated (PR #4680) |
-| `EndHandleRiotsPhaseAction` | ✅ Migrated (PR #4684) |
-| `PerformVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformVassalDefenseDecisionsAction` | ✅ Migrated |
-| `EndVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformReconResolutionAction` | ✅ Migrated |
-| `NewRoundAction` | ✅ Migrated (PR #4698) |
-| `EndBattleAftermathPhaseAction` | ✅ Migrated (PR #4699) |
-| `EndDiplomacyResolutionPhaseAction` | ✅ Migrated |
-| `PerformUnaffiliatedHeroesAction` | ✅ Migrated |
-| `EngineImpl.recursiveTransformT` | ✅ Migrated (PR #4704) |
-| `ProtolessSequentialResultsActionWrapper` | ✅ Migrated (PR #4705) |
-| `LegacyRandomStateTSequencer` | ✅ **Deleted** (PR #4705) |
-
-**TCommandFactory Extraction** (PR #4684):
-
-To enable lightweight mocking of command creation in tests, `TCommandFactory` trait was extracted from `CommandFactory`. This allows tests to mock just the `makeTCommand` method without pulling in all 40+ command dependencies that `CommandFactory` requires.
-
-- `TCommandFactory` - lightweight trait with just `makeTCommand`
-- `CommandFactory extends TCommandFactory` - maintains backward compatibility
-- Actions accepting command factories now use `TCommandFactory` type for better testability
-
-**Tier 4 - History APIs:**
-```
-src/main/scala/net/eagle0/eagle/service/InMemoryHistory.scala
-src/main/scala/net/eagle0/eagle/service/PersistedHistory.scala
-```
-Change APIs to vend Scala `GameState` and `ActionResultT` instead of proto versions. `PersistedHistory` converts to proto internally for disk persistence; `InMemoryHistory` doesn't need proto at all.
-
-### ActionResultProto Consumer Inventory
-
-| File | Usage | Status |
-|------|-------|--------|
-| `ActionResultApplierImpl.scala` | Applies ActionResultT to Scala GameState | ✅ **Complete** |
-| `ActionResultTApplierImpl.scala` | Legacy wrapper - converts to/from proto | Keep until all callers migrated |
-| `RoundPhaseAdvancer.scala` | Uses Scala GameState | ✅ **Complete** |
-| `RandomStateSequencer.scala` | Threads Scala GameState | ✅ **Complete** |
-| `VigorXPApplier.scala` | Has both proto and Scala methods | Scala method exists, delete proto method when unused |
-| `PerformForcedTurnBackAction.scala` | Fully protoless | ✅ **Complete** |
-| `ResolveBattleAction.scala` | ✅ Fully protoless | Complete (PR #5048) |
-| `InMemoryHistory.scala` | Stores proto results | Pending - vend Scala types |
-| `PersistedHistory.scala` | Stores proto results | Pending - vend Scala types, convert for disk |
-| `GameController.scala` | Uses proto for client communication | Keep proto (gRPC boundary) |
-
-### Remaining Proto Usage in Actions
-
-**Progress: 52 of 52 action files (100%) are fully protoless.** ✅
-
-All action files have been migrated to use Scala types:
-
-| Action | Status | Notes |
-|--------|--------|-------|
-| `ResolveBattleAction` | ✅ Complete | PR #5048 - uses Scala GameState and ActionResultApplier |
-| `PerformVassalCommandsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `EndHandleRiotsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `PerformVassalDefenseDecisionsAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `EndVassalCommandsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-
-**Note:** `NewRoundAction` is now fully protoless after converting `ChronicleEventGenerator` to return Scala `ChronicleEvent` types directly.
-
-**Deleted Dead Code:**
-- `UnaffiliatedHeroMovedAction` - Was never called; `PerformUnaffiliatedHeroesAction.heroMovedResult` constructs `ActionResultC` directly
-- `HeroBackstoryUpdateActionGenerator.fromGameState` - Dead method that converted proto to Scala; only `apply(GameState)` is used
-
-**Note**: `PerformReconResolutionAction` and `EndBattleAftermathPhaseAction` are now fully protoless after:
-1. Migrating `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` to use Scala `ProvinceView`
-2. Adding Scala overload of `ProvinceViewFilter.withdrawnFromProvinceView`
-
-### Estimated Effort (Remaining)
-
-| Component | Lines | Complexity | Blocks |
-|-----------|-------|------------|--------|
-| History API updates | ~100 | Low | - |
-| **Total Remaining** | **~100** | | |
-
-**Completed:**
-- ✅ `ChronicleEventGenerator` converted to return Scala `ChronicleEvent` types directly
-- ✅ `CommandChoiceHelpers` migrated to Scala types
-- ✅ `ResolveBattleAction` refactored to use Scala GameState and ActionResultApplier (PR #5048)
-
-### Enum Type Migrations
-
-Proto enums are being converted to Scala sealed traits with converters at boundaries:
-
-| Enum | Scala Type | Status | Notes |
-|------|------------|--------|-------|
-| `DiplomacyOfferStatus` | `Status` sealed trait | ✅ **Complete** | PR #5093 - `EligibleDiplomacyStatuses` uses Scala types internally |
-| `RoundPhase` | `RoundPhase` sealed trait | Partial | Some usages converted |
-| `BattalionType` | `BattalionType` sealed trait | Partial | Some usages converted |
-
-**DiplomacyOfferStatus Migration (PR #5093):**
-- `EligibleDiplomacyStatuses.scala` now returns `Vector[Status]` instead of `Vector[DiplomacyOfferStatus]`
-- Call sites in `AvailableResolve*CommandFactory` files convert to proto via `StatusConverter.toProto` at the boundary
-- This pattern should be applied to other proto enums
-
-### CommandChoiceHelpers Migration Status
-
-Several command selectors have already been converted to use Scala types:
-
-| File | Status | Notes |
-|------|--------|-------|
-| `AttackCommandChooser.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
-| `AlmsCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
-| `FoodConsumptionUtils.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `RoundPhase` |
-| `MarchSuppliesHelpers.scala` | ✅ **Protoless** | Uses `BattalionT` |
-| `CombatUnitSelector.scala` | ✅ **Protoless** | Uses `HeroT`, `BattalionT`, `BattalionType` |
-| `ExpandCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `FactionT` |
-| `ImproveCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `HeroT` |
-| `OrganizeCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `BattalionT`, `BattalionType` |
-| `RansomOfferHelpers.scala` | ✅ **Protoless** | Uses Scala `GameState`, `FactionT` |
-| `CommandChoiceHelpers.scala` | ✅ **Protoless** | Uses Scala `GameState` throughout |
-| `ProvinceGoldSurplusCalculator.scala` | ✅ **Protoless** | Uses Scala types |
-
-**All CommandChoiceHelpers selectors have been migrated to Scala types.** ✅
-
-### Progress Summary
-
-| Metric | Value |
-|--------|-------|
-| Action files fully protoless | 52 / 52 (100%) ✅ |
-| Proto usages in remaining actions | 0 |
-| Next target | See "Next Candidates" section below |
-
-### Next Candidates
-
-Priority candidates for further deproto work:
-
-1. **More Enum Migrations** - Apply the `DiplomacyOfferStatus` pattern to other proto enums:
-   - Files importing `net.eagle0.eagle.common.round_phase.RoundPhase` (proto) could use Scala `RoundPhase`
-   - Files importing `net.eagle0.eagle.common.battalion_type.BattalionType` (proto) could use Scala `BattalionType`
-
-2. **AvailableCommandsFactory Files** - Many still use proto `GameState` internally:
-   - These files build proto `AvailableCommand` messages but could use Scala types for internal logic
-   - Convert to accept Scala `GameState`, only convert fields to proto when building the response
-
-3. **History APIs** - `InMemoryHistory` and `PersistedHistory`:
-   - Change to vend Scala `GameState` and `ActionResultT` instead of proto versions
-   - `PersistedHistory` converts to proto internally for disk persistence
-
-### Validation
-- [x] `ActionResultApplier` created and tested
-- [x] `RandomStateSequencer` threads Scala GameState throughout
-- [x] `RoundPhaseAdvancer` uses T-types internally
-- [x] `ProvinceViewFilter` has Scala overload for server-side use (PR #4752)
-- [x] `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` use Scala `ProvinceView`
-- [x] `ProvinceViewFilter.withdrawnFromProvinceView` has Scala overload
-- [x] `CommandChoiceHelpers` uses Scala types ✅
-- [x] All action files (52/52) are fully protoless ✅
-- [ ] `ProvinceViewFilter` faction-filtered views use Scala types
-- [ ] History APIs vend Scala types
-- [ ] No `ActionResultProtoConverter.toProto()` calls except at persistence/gRPC boundaries
-- [ ] All tests pass
-
----
-
-## Phase 7: Clean Up Legacy Utilities
-
-### Objective
-Remove remaining direct proto imports from utility classes.
-
-### Files to Modify
-
-| File | Status |
-|------|--------|
-| `CommandChoiceHelpers.scala` | Accepts proto `GameState`; blocks full deproto of `PerformVassalCommandsPhaseAction` and `PerformVassalDefenseDecisionsAction` |
-| `LegacyProvinceUtils.scala` | Replace with `ProvinceUtils.scala` - `hasImminentRiot` added (PR #4683) |
-| `LegacyFactionUtils.scala` | Replace proto imports with `FactionT` |
-| `LegacyUnaffiliatedHeroUtils.scala` | Replace proto imports with Scala models |
-| `BattalionTypeLoader.scala` | Keep proto for file loading, convert immediately after |
-| `BeastUtils.scala` | **Complete** - now uses Scala `BeastInfo` only |
-
-### View Filters (Partially Complete)
-
-The view filter utilities now have Scala overloads for server-side use:
-
-| File | Status | Notes |
-|------|--------|-------|
-| `ProvinceViewFilter.scala` | **Partial** | `filteredProvinceView(ProvinceT, ScalaGameState)` added (PR #4752) |
-| `ArmyFilter.scala` | **Partial** | `filterArmy(ScalaArmy, Map[BattalionId, BattalionT], Option[FactionId])` added |
-| `BattalionViewFilter.scala` | **Complete** | Uses Scala `BattalionT` throughout |
-| `GameStateViewFilter.scala` | Pending | Uses proto types throughout |
-| `GameStateViewDiffer.scala` | Pending | Works with view protos |
-
-**Unblocked Actions** (PR #4752):
-- `EndBattleAftermathPhaseAction` - can now use `filteredProvinceView(province, scalaGameState)`
-- `PerformReconResolutionAction` - can now use Scala overload
-- `GameStateFactionExtensions` - can now use `updatedReconnedProvinces` with Scala types
-
-**Remaining Work**:
-- Faction-filtered `filteredProvinceView(Province, GameState, FactionId)` still uses proto types
-- `withdrawnFromProvinceView` still uses proto types
-- These are needed for client-facing views with visibility restrictions
-
----
-
-## Phase 8: Verify Boundaries
-
-### Objective
-Confirm protos are used correctly at boundaries — and ONLY there.
-
-### Expected Proto Usage (Keep)
-- `EagleServiceImpl.scala` - gRPC boundary
-- `InMemoryHistory.scala` / `PersistedHistory.scala` - Persistence boundary
-- `*Converter.scala` - Explicit conversion utilities
-- `*Loader.scala` - File loading utilities
-
-### Expected No Proto Usage (Verify)
-- `/library/actions/impl/` - Pure Scala models
-- `/library/util/` - Pure Scala models (except loaders)
-- `/model/state/` - Pure Scala models
-
----
-
-## Open Questions
-
-1. **Persistence Format**: Currently game state is persisted as proto. Should we keep proto for persistence (good for schema evolution) or switch to a different format?
-
-2. **Shardok Integration**: `ResolveBattleAction` communicates with Shardok. Should the Shardok interface use protos (external service) or Scala models?
-
-3. **View Generation**: `GameStateViewDiffer` works with view protos for client updates. Views need Scala models (`ProvinceViewT`, etc.) to allow actions like `EndBattleAftermathPhaseAction` to be fully protoless. The Scala views would be converted to proto only at the gRPC boundary when sending updates to clients.
-
----
-
-## Success Criteria
-
-### Code Quality
-- [ ] Zero proto imports in `/library/actions/` (except boundaries)
-- [ ] Zero proto imports in `/library/` utilities (except loaders)
-- [ ] `GameStateT` used throughout engine internals
-- [ ] Proto usage limited to: `EagleServiceImpl`, loaders, converters, persistence
-
-### Architecture
-- [ ] Clear separation: Scala models (internal) vs Proto (boundaries)
-- [ ] Converters as the only bridge between domains
-- [ ] No "proto creep" into business logic

docs/HETZNER_SETUP.md

@@ -1,159 +0,0 @@
-# Hetzner Setup Guide
-
-This guide walks through setting up Hetzner Cloud infrastructure for running Shardok on-demand compute.
-
-## Prerequisites
-
-- All code PRs merged (#4990, #4996, #4998, #5001, #5009)
-- Access to DigitalOcean Container Registry (for pulling Shardok ARM64 image)
-
----
-
-## Step 1: Create Hetzner Cloud Account
-
-1. Go to https://console.hetzner.cloud/
-2. Sign up and add payment method
-3. Create a new project (e.g., "eagle0")
-
----
-
-## Step 2: Generate Hetzner API Token
-
-1. In Hetzner Console → Security → API Tokens
-2. Click "Generate API Token"
-3. Give it **Read & Write** permissions
-4. Copy the token (you'll only see it once)
-
----
-
-## Step 3: Generate Shardok Auth Token
-
-Generate a 256-bit random token for Eagle-Shardok authentication:
-
-```bash
-openssl rand -hex 32
-```
-
-Save this output - it's the shared secret between Eagle and Shardok.
-
----
-
-## Step 4: Store Secrets in GitHub Actions
-
-Add these secrets in GitHub → Settings → Secrets and variables → Actions:
-
-| Secret Name | Description |
-|-------------|-------------|
-| `HETZNER_API_TOKEN` | From Step 2 - for Hetzner API calls |
-| `SHARDOK_AUTH_TOKEN` | From Step 3 - shared secret for gRPC auth |
-
-Note: `DO_REGISTRY_TOKEN` already exists and will be used for Hetzner to pull container images.
-
-These secrets will be passed to Eagle at runtime via `docker_build.yml`, similar to how `OPENAI_API_KEY` and other secrets are handled.
-
----
-
-## Step 5: DNS Setup (for Let's Encrypt)
-
-You need a domain pointing to the Shardok instance for TLS certificates.
-
-### Option A: Floating IP (Recommended)
-
-1. In Hetzner Console → Networking → Floating IPs
-2. Create a **Floating IPv6** in **Hillsboro, Oregon (hil)** region
-   - IPv6 costs €1/month vs €3/month for IPv4
-   - Hillsboro has better latency to DigitalOcean SFO than Ashburn
-   - Server-to-server communication works fine with IPv6-only
-3. Point `shardok.prod.eagle0.net` to this IP via AAAA record
-4. The ShardokInstanceManager will attach this IP to instances on spin-up
-
-**Location choice**: Hillsboro, OR (`hil`) is recommended for US West Coast. Same pricing as Ashburn (`ash`).
-
-### Option B: Dynamic DNS
-
-Update DNS programmatically when instance spins up. More complex but avoids floating IP cost.
-
----
-
-## Step 6: Upload SSH Key to Hetzner
-
-For debugging access to instances:
-
-1. In Hetzner Console → Security → SSH Keys
-2. Click "Add SSH Key"
-3. Paste your public key (e.g., `~/.ssh/id_rsa.pub`)
-4. Give it a name (e.g., "eagle-deploy")
-
----
-
-## Step 7: Wire Security Config into Eagle
-
-Update Eagle's startup code to use the security config when connecting to remote Shardok:
-
-```scala
-val securityConfig = ShardokSecurityConfig(
-  useTls = true,
-  authToken = Some(sys.env("SHARDOK_AUTH_TOKEN"))
-)
-
-val channel = ServerSetupHelpers.newChannel(
-  "shardok.prod.eagle0.net",
-  50051,
-  securityConfig
-)
-```
-
----
-
-## Testing
-
-### Manual Instance Spin-up
-
-Test the Hetzner integration by triggering instance creation:
-
-```scala
-val manager = new ShardokInstanceManager(
-  hetznerApiToken = sys.env("HETZNER_API_TOKEN"),
-  // ... other config
-)
-
-manager.ensureInstanceRunning()
-```
-
-### Verify TLS and Auth
-
-1. Instance spins up and gets Let's Encrypt certificate
-2. Eagle connects via TLS
-3. Auth token is validated on each request
-
----
-
-## Cost Estimate
-
-| Component | Cost |
-|-----------|------|
-| CAX41 (16 ARM cores) | ~$0.04/hour |
-| Floating IP | ~$4/month |
-| Typical usage (20 hrs/week) | ~$3.50/month compute |
-
-**Total: ~$7-8/month** for typical usage.
-
----
-
-## Troubleshooting
-
-### Instance won't start
-- Check Hetzner API token has Read & Write permissions
-- Verify you're using the correct region (`hil` for Hillsboro OR, or `ash` for Ashburn VA)
-
-### TLS certificate fails
-- Ensure DNS points to the instance IP before certbot runs
-- Check port 80 is open for Let's Encrypt HTTP-01 challenge
-
-### Auth failures
-- Verify `SHARDOK_AUTH_TOKEN` matches on both Eagle and Shardok
-- Check the token file is readable by Shardok container
-
-### Can't pull container image
-- Ensure `DO_REGISTRY_TOKEN` is passed to cloud-init
-- Verify the ARM64 image exists: `registry.digitalocean.com/eagle0/shardok-server:arm64-latest`

docs/OAUTH_GO_SERVICE_PLAN.md

@@ -1,383 +0,0 @@
-# Plan: Extract OAuth to Go Service
-
-## Goal
-Move OAuth authentication handling from the Eagle Scala server into a separate Go service. This simplifies Eagle (gRPC-only, no HTTP), reduces complexity, and sets up for potentially moving JWT validation outside Eagle too.
-
-## Architecture Decision: Sidecar Service (Not DO Functions)
-
-**Recommendation: Go sidecar service on the same droplet, in a separate container**
-
-**Why not DO Functions:**
-- OAuth requires **stateful sessions** (pendingOAuth/completedOAuth maps with 10-min TTL)
-- Client polling pattern (every 2 seconds) would incur high function invocation costs
-- Cold start latency problematic for auth flows
-- State would require external store (Redis), adding complexity
-
-**Why sidecar (separate container):**
-- Simple process on same droplet, minimal network latency
-- In-memory state management (like current Scala impl)
-- Easy to monitor/debug alongside Eagle
-- Can share filesystem for key files (RSA keys) via volume mounts
-- **Independent deployment**: Deploying Eagle doesn't restart auth service (and vice versa)
-- **Independent scaling**: Could move to separate droplet later if needed
-
-## Current Architecture (What Exists)
-
-```
-Unity Client
-    ├── GetOAuthUrl RPC → Eagle AuthServiceImpl → OAuthService.getAuthUrl()
-    ├── [User browser auth] → HTTP callback → OAuthHttpHandler → OAuthService.handleCallback()
-    ├── CheckOAuthStatus RPC (polling) → AuthServiceImpl → OAuthService.checkStatus()
-    └── All other RPCs include JWT → AuthorizationInterceptor validates
-```
-
-**Key files:**
-- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth flow, state management
-- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - JWT creation/validation
-- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD (persisted)
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC Auth service
-- `src/main/scala/net/eagle0/eagle/service/OAuthHttpHandler.scala` - HTTP callback handler
-
-## Target Architecture (Phase 1)
-
-```
-Unity Client
-    ├── GetOAuthUrl RPC ──────────────┐
-    ├── CheckOAuthStatus RPC (polling)├──→ Eagle (port 40032) ──proxy──→ Go Auth Container (port 40033)
-    ├── RefreshToken RPC ─────────────┘                                        │
-    ├── [User browser] → HTTP callback ────────────────────────────────────────┤
-    │                                                                          ↓
-    │                                            (Internal gRPC: GetOrCreateUser, GetUser)
-    │                                                                          ↓
-    └── Game RPCs with JWT ─────────────────────→ Eagle (port 40032) ← JWT validation stays here
-
-[Same Droplet]
-┌─────────────────────────────────────────────────────────────────────────────┐
-│                                                                             │
-│  ┌──────────────────────┐          ┌────────────────────────────────────┐  │
-│  │  Go Auth Container   │◄────────►│       Eagle Container              │  │
-│  │  (eagle0-auth)       │ internal │       (eagle0-server)              │  │
-│  │                      │  gRPC    │                                    │  │
-│  │  - OAuth flow        │          │  - JWT validation                  │  │
-│  │  - JWT creation      │          │  - UserService (persistence)       │  │
-│  │  - HTTP callback     │          │  - Game logic                      │  │
-│  └──────────────────────┘          └────────────────────────────────────┘  │
-│           │                                        │                        │
-│           └────────────────┬───────────────────────┘                        │
-│                            ▼                                                │
-│                    /etc/eagle0/keys/ (shared volume)                        │
-│                    - private.pem                                            │
-│                    - public.pem                                             │
-└─────────────────────────────────────────────────────────────────────────────┘
-```
-
-## Component Responsibilities
-
-### Go Auth Service (NEW - separate container)
-- **OAuth flow**: getAuthUrl, handleCallback (HTTP), checkStatus
-- **State management**: pendingOAuth, completedOAuth maps with TTL
-- **JWT creation**: Issue access/refresh tokens (shares RSA private key with Eagle)
-- **Token refresh**: Validate refresh token, issue new access token
-- Calls Eagle's internal UserService gRPC to find/create users
-
-### Eagle Server (SIMPLIFIED)
-- **JWT validation**: AuthorizationInterceptor stays (validates tokens on game RPCs)
-- **UserService**: Stays in Eagle (user persistence, display name logic)
-- **New internal gRPC**: Expose GetOrCreateUser, GetUser for Go service to call
-- **Proxy (Phase 1)**: Forward OAuth RPCs to Go service
-- **Remove (Phase 2)**: OAuthService, OAuthHttpHandler, HTTP server setup
-
-### Unity Client (NO CHANGES in Phase 1)
-- Eagle proxies Auth RPCs to Go service
-- Client still connects to Eagle on port 40032
-
-## Implementation Phases
-
-### Phase 1: Go Auth Service with Eagle Proxy (Zero Client Changes)
-
-1. **Create Go service structure**
-   ```
-   src/main/go/net/eagle0/authservice/
-   ├── main.go           # Entry point, starts gRPC + HTTP servers
-   ├── oauth.go          # OAuth state management, provider configs
-   ├── jwt.go            # JWT creation (copy logic from Scala)
-   ├── handlers.go       # gRPC handlers for Auth service
-   ├── http_callback.go  # HTTP handler for OAuth callback
-   └── BUILD.bazel
-   ```
-
-2. **Internal gRPC proto for Eagle UserService**
-   ```protobuf
-   // src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto
-
-   service InternalUserService {
-     rpc GetOrCreateUser(GetOrCreateUserRequest) returns (GetOrCreateUserResponse);
-     rpc GetUser(GetUserRequest) returns (GetUserResponse);
-   }
-
-   message GetOrCreateUserRequest {
-     string provider = 1;        // "discord" or "google"
-     string provider_user_id = 2;
-     string email = 3;
-     string avatar_url = 4;
-   }
-
-   message GetOrCreateUserResponse {
-     string user_id = 1;
-     string display_name = 2;
-     string avatar_url = 3;
-     bool is_admin = 4;
-     bool is_new_user = 5;
-   }
-   ```
-
-3. **Eagle: Expose InternalUserService**
-   - New `InternalUserServiceImpl.scala` wrapping UserService
-   - Bind to same port, different service name (internal only)
-
-4. **Eagle: Proxy Auth RPCs to Go**
-   - AuthServiceImpl delegates GetOAuthUrl, CheckOAuthStatus, RefreshToken to Go service
-   - SetDisplayName, GetCurrentUser, Logout stay in Eagle
-
-5. **Share RSA keys via volume mount**
-   - Go service reads same key files as Eagle
-   - Both can create valid JWTs
-   - Eagle continues to validate JWTs
-
-6. **Docker/Container setup**
-   - New Dockerfile for Go auth service
-   - docker-compose or Kubernetes config for both containers
-   - Shared volume for /etc/eagle0/keys/
-   - Internal network for container-to-container gRPC
-
-### Phase 2: Client Direct to Go Service (Future)
-
-1. **Update Unity client**
-   - Connect to Go Auth service directly for OAuth RPCs
-   - Keep connecting to Eagle for game RPCs
-
-2. **Remove Eagle proxy code**
-   - Delete AuthServiceImpl OAuth delegation
-   - AuthServiceImpl only handles SetDisplayName, GetCurrentUser, Logout
-
-### Phase 3: Move JWT Validation to Go (Optional Future)
-
-1. **Go service validates JWTs**
-   - Add ValidateToken RPC or use shared middleware pattern
-
-2. **Eagle calls Go for validation**
-   - AuthorizationInterceptor calls Go to validate tokens
-   - OR: Use stateless validation (both share public key)
-
-## Files to Create
-
-### Go Service
-- `src/main/go/net/eagle0/authservice/main.go`
-- `src/main/go/net/eagle0/authservice/oauth.go`
-- `src/main/go/net/eagle0/authservice/jwt.go`
-- `src/main/go/net/eagle0/authservice/handlers.go`
-- `src/main/go/net/eagle0/authservice/http_callback.go`
-- `src/main/go/net/eagle0/authservice/BUILD.bazel`
-
-### Protos
-- `src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto`
-
-### Scala
-- `src/main/scala/net/eagle0/eagle/service/InternalUserServiceImpl.scala`
-
-### Docker/Deployment
-- `ci/auth_service.Dockerfile`
-- Update `docker-compose.yml` (or equivalent)
-
-## Files to Modify
-
-### Scala (Phase 1)
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - Proxy OAuth RPCs to Go
-- `src/main/scala/net/eagle0/eagle/Main.scala` - Start internal user service, add auth-service-url flag
-
-### Scala (Phase 2 - Removal)
-- Delete `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala`
-- Delete `src/main/scala/net/eagle0/eagle/service/OAuthHttpHandler.scala`
-- Simplify `src/main/scala/net/eagle0/eagle/Main.scala` - Remove HTTP server
-
-### Unity (Phase 2)
-- `Assets/Auth/OAuthManager.cs` - Point OAuth RPCs to Go service port
-- `Assets/EagleConnection.cs` - Add second channel for auth service
-
-## Key Implementation Details
-
-### State Management in Go
-```go
-type OAuthState struct {
-    Provider  string
-    CreatedAt time.Time
-}
-
-type OAuthResult struct {
-    Success  bool
-    UserInfo *ProviderUserInfo
-    Provider string
-    Error    string
-}
-
-var pendingOAuth   = sync.Map{} // state -> OAuthState
-var completedOAuth = sync.Map{} // state -> OAuthResult
-
-const stateExpiration = 10 * time.Minute
-
-// Background goroutine cleans expired states every minute
-func cleanupExpiredStates() {
-    ticker := time.NewTicker(1 * time.Minute)
-    for range ticker.C {
-        cutoff := time.Now().Add(-stateExpiration)
-        pendingOAuth.Range(func(key, value any) bool {
-            if value.(OAuthState).CreatedAt.Before(cutoff) {
-                pendingOAuth.Delete(key)
-            }
-            return true
-        })
-        // Similar for completedOAuth
-    }
-}
-```
-
-### JWT Creation in Go
-```go
-import "github.com/golang-jwt/jwt/v5"
-
-type EagleClaims struct {
-    jwt.RegisteredClaims
-    UserId      string `json:"userId"`
-    DisplayName string `json:"displayName"`
-    IsAdmin     bool   `json:"isAdmin"`
-}
-
-func CreateAccessToken(userId, displayName string, isAdmin bool) (string, error) {
-    claims := EagleClaims{
-        RegisteredClaims: jwt.RegisteredClaims{
-            ExpiresAt: jwt.NewNumericDate(time.Now().Add(7 * 24 * time.Hour)),
-            IssuedAt:  jwt.NewNumericDate(time.Now()),
-        },
-        UserId:      userId,
-        DisplayName: displayName,
-        IsAdmin:     isAdmin,
-    }
-
-    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
-    return token.SignedString(privateKey)
-}
-```
-
-### OAuth Provider Configs
-- Read from environment variables (same as current OAuthConfig.scala)
-- DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET
-- GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
-- OAUTH_CALLBACK_URL (e.g., https://eagle0.shardok.games/oauth/callback)
-
-### Container Networking
-```yaml
-# docker-compose.yml example
-services:
-  eagle0-auth:
-    build:
-      context: .
-      dockerfile: ci/auth_service.Dockerfile
-    ports:
-      - "40033:40033"  # gRPC
-      - "8080:8080"    # HTTP callback
-    volumes:
-      - ./keys:/etc/eagle0/keys:ro
-    environment:
-      - DISCORD_CLIENT_ID
-      - DISCORD_CLIENT_SECRET
-      - GOOGLE_CLIENT_ID
-      - GOOGLE_CLIENT_SECRET
-      - EAGLE_INTERNAL_URL=eagle0-server:40034
-
-  eagle0-server:
-    build:
-      context: .
-      dockerfile: ci/eagle_run.Dockerfile
-    ports:
-      - "40032:40032"  # Public gRPC
-    expose:
-      - "40034"        # Internal gRPC (container-to-container only)
-    volumes:
-      - ./keys:/etc/eagle0/keys:ro
-      - ./data:/var/lib/eagle0
-    environment:
-      - AUTH_SERVICE_URL=eagle0-auth:40033
-```
-
-## Deployment
-
-### Development
-```bash
-# Terminal 1: Go Auth Service
-bazel run //src/main/go/net/eagle0/authservice:authservice -- \
-  --grpc-port=40033 \
-  --http-port=8080 \
-  --eagle-internal-url=localhost:40034
-
-# Terminal 2: Eagle Server
-bazel run //src/main/scala/net/eagle0/eagle:eagle_server -- \
-  --eagle-grpc-port=40032 \
-  --internal-grpc-port=40034 \
-  --auth-service-url=localhost:40033
-```
-
-### Production
-- Both containers on same droplet via docker-compose
-- Shared volume for RSA keys at /etc/eagle0/keys/
-- Internal Docker network for container-to-container communication
-- External access: 40032 (Eagle gRPC), 8080 (OAuth HTTP callback)
-
-## Testing Strategy
-
-1. **Unit tests for Go service**
-   - OAuth state management (expiration, cleanup)
-   - JWT creation matches Scala output (test with same keys)
-   - HTTP callback parsing
-
-2. **Integration tests**
-   - Go service ↔ Eagle internal gRPC
-   - Full OAuth flow with mock provider
-
-3. **Existing tests continue to pass**
-   - All Scala tests (JWT validation, user service)
-
-4. **End-to-end test**
-   - Spin up both containers
-   - Run OAuth flow through proxy
-
-## Risks and Mitigations
-
-| Risk | Mitigation |
-|------|------------|
-| Key file permissions | Shared volume with read-only mount |
-| State loss on Go restart | Document this (same as current Scala behavior); consider Redis later |
-| Clock skew affecting JWT | Both on same machine |
-| OAuth callback race | HTTP callback completes before gRPC poll |
-| Container networking | Use docker-compose for reliable internal DNS |
-| Proxy adds latency | Minimal (same machine), remove in Phase 2 |
-
-## Estimated Scope
-
-- **Phase 1**: ~500-700 lines Go, ~100 lines Scala changes, ~50 lines Docker config
-- **Phase 2**: ~50 lines Unity, deletion of ~300 lines Scala
-- **Phase 3**: Optional, separate decision
-
-## Alternative Considered: Move Everything to Go
-
-Could move UserService to Go as well, but:
-- UserService is tightly integrated with game persistence
-- Would require duplicating persistence layer
-- Not worth the complexity for now
-
-Keep UserService in Eagle, expose via internal gRPC.
-
-## Open Questions
-
-1. **HTTP callback routing**: Does the OAuth callback URL need to change, or can we route traffic from the existing URL to the new Go service?
-2. **Health checks**: Should we add health check endpoints for container orchestration?
-3. **Logging**: Should Go service log to same format/destination as Eagle?

docs/OAUTH_IMPLEMENTATION_PLAN.md

@@ -1,189 +0,0 @@
-# Discord + Google OAuth Implementation Plan
-
-## Overview
-
-Replace HTTP Basic Auth with OAuth 2.0 (Discord + Google) for Eagle0. Users authenticate via system browser, receive JWT tokens, and choose their own display names.
-
-## Architecture
-
-```
-Unity Client                                          Eagle Server
-     |                                                      |
-     |  1. Click "Login with Discord/Google"                |
-     |  ------------------------------------------------->  |
-     |     GetOAuthUrl(provider) -> auth_url + state        |
-     |                                                      |
-     |  2. Open system browser -> OAuth consent             |
-     |  3. User authenticates with provider                 |
-     |  4. Redirect to eagle0://auth/callback?code=xxx      |
-     |                                                      |
-     |  5. ExchangeCode(code, state)                        |
-     |  ------------------------------------------------->  |
-     |     Exchange code with provider                      |
-     |     Fetch user info (id, email, avatar)              |
-     |     Create/update user record                        |
-     |     Issue JWT + refresh token                        |
-     |  <-------------------------------------------------  |
-     |     (jwt, refresh_token, user_info, is_new_user)     |
-     |                                                      |
-     |  6. [If new user] SetDisplayName(name)               |
-     |  ------------------------------------------------->  |
-     |                                                      |
-     |  7. Subsequent gRPC calls                            |
-     |     Authorization: Bearer <jwt>                      |
-     |  ------------------------------------------------->  |
-```
-
-## Key Design Decisions
-
-| Decision | Choice | Rationale |
-|----------|--------|-----------|
-| OAuth flow | System browser + deep link | Secure, supports password managers |
-| Code exchange | Eagle server directly | No separate auth service needed |
-| JWT signing | RS256 (asymmetric) | Future flexibility for token verification |
-| User storage | Protobuf file via Persister | Consistent with existing patterns |
-| Token expiry | 7-day access, 30-day refresh | Balance security and gaming UX |
-
-## Implementation Phases
-
-### Phase 1: Proto Definitions & Infrastructure
-
-**New files:**
-- `src/main/protobuf/net/eagle0/eagle/api/auth.proto` - Auth API messages
-- `src/main/protobuf/net/eagle0/eagle/internal/user.proto` - User storage schema
-
-**Key proto messages:**
-```protobuf
-// API
-GetOAuthUrlRequest/Response     // Get OAuth URL to open in browser
-ExchangeCodeRequest/Response    // Exchange auth code for JWT
-SetDisplayNameRequest/Response  // Set user's display name
-RefreshTokenRequest/Response    // Refresh expired access token
-
-// Internal storage
-User                           // user_id, display_name, oauth_identities
-UserDatabase                   // All users + indexes for lookup
-```
-
-### Phase 2: Eagle Server Auth Services
-
-**New Scala files:**
-- `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` - Discord/Google config from env vars
-- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - JWT creation/validation (RS256)
-- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD, display name validation
-- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth code exchange
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC service implementation
-
-**Modify:**
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationInterceptor.scala`
-  - Replace Basic Auth parsing with JWT validation
-  - Skip auth for public endpoints (GetOAuthUrl, ExchangeCode, RefreshToken)
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationUtils.scala`
-  - Change context keys from `userName` to `userId` + `displayName`
-- `src/main/scala/net/eagle0/eagle/service/Main.scala`
-  - Wire up new auth services and JWT key loading
-
-### Phase 3: Unity Client OAuth Flow
-
-**New C# files:**
-- `Assets/Auth/OAuthManager.cs` - OAuth flow + deep link handling
-- `Assets/Auth/TokenStorage.cs` - Secure token persistence
-- `Assets/Auth/AuthClient.cs` - gRPC client for auth service
-
-**Modify:**
-- `Assets/EagleConnection.cs`
-  - Replace `AuthInterceptor` (Basic Auth) with `JwtAuthInterceptor` (Bearer token)
-- `Assets/ConnectionHandler/ConnectionHandler.cs`
-  - Replace username/password UI with Discord/Google login buttons
-  - Add display name setup flow for new users
-
-### Phase 4: Platform Configuration
-
-**Deep link registration:**
-- iOS: Add `eagle0://` to CFBundleURLSchemes in Info.plist
-- Android: Add intent-filter for `eagle0://auth` in AndroidManifest.xml
-- Desktop: Register URL scheme (Windows registry / macOS plist)
-
-**OAuth provider setup:**
-1. Discord Developer Portal: Create app, add redirect URI `eagle0://auth/callback`
-2. Google Cloud Console: Create OAuth client, add redirect URI
-
-**Environment variables (server):**
-```
-DISCORD_CLIENT_ID
-DISCORD_CLIENT_SECRET
-GOOGLE_CLIENT_ID
-GOOGLE_CLIENT_SECRET
-JWT_PRIVATE_KEY_PATH
-JWT_PUBLIC_KEY_PATH
-```
-
-### Phase 5: Testing
-
-**Unit tests:**
-- `JwtServiceSpec.scala` - Token creation/validation
-- `UserServiceSpec.scala` - Display name validation, uniqueness
-- `OAuthServiceSpec.scala` - OAuth flow with mocked providers
-
-**Integration tests:**
-- Full OAuth flow with mock provider
-- JWT validation in AuthorizationInterceptor
-- gRPC calls with valid/invalid tokens
-
-**Manual testing:**
-- [ ] Discord login (Windows, macOS)
-- [ ] Google login (Windows, macOS)
-- [ ] Deep link callback works
-- [ ] Display name validation
-- [ ] Session persistence across restarts
-- [ ] Token refresh
-
-## Files Summary
-
-### Create
-| File | Purpose |
-|------|---------|
-| `src/main/protobuf/net/eagle0/eagle/api/auth.proto` | Auth API definitions |
-| `src/main/protobuf/net/eagle0/eagle/internal/user.proto` | User storage schema |
-| `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` | Provider config |
-| `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` | JWT handling |
-| `src/main/scala/net/eagle0/eagle/auth/UserService.scala` | User management |
-| `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` | OAuth flow |
-| `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` | gRPC service |
-| `Assets/Auth/OAuthManager.cs` | Unity OAuth manager |
-| `Assets/Auth/TokenStorage.cs` | Token storage |
-| `Assets/Auth/AuthClient.cs` | Auth gRPC client |
-
-### Modify
-| File | Changes |
-|------|---------|
-| `AuthorizationInterceptor.scala` | Basic Auth -> JWT validation |
-| `AuthorizationUtils.scala` | userName -> userId + displayName |
-| `Main.scala` | Wire auth services |
-| `EagleConnection.cs` | AuthInterceptor -> JwtAuthInterceptor |
-| `ConnectionHandler.cs` | Login UI -> OAuth buttons + display name |
-
-### Delete
-- nginx htpasswd configuration (no longer needed)
-
-## Security Considerations
-
-1. **State parameter** - CSRF protection in OAuth flow
-2. **PKCE** - Consider adding for mobile (enhancement)
-3. **Secure storage** - Use Keychain (iOS) / Keystore (Android) for tokens
-4. **Token refresh** - 7-day access tokens with 30-day refresh
-5. **Rate limiting** - Limit login attempts per IP
-
-## Dependencies to Add
-
-**Scala (MODULE.bazel):**
-- JWT library (e.g., `jwt-scala` or `nimbus-jose-jwt`)
-- HTTP client (e.g., `sttp` for OAuth requests)
-
-**Unity:**
-- Deep linking is built-in (Unity 2021+)
-- No additional packages required
-
-## Rollback Plan
-
-Keep Basic Auth code in a feature branch. Both auth methods can coexist during transition via feature flag if needed.

docs/OAUTH_NEXT_STEPS.md

@@ -1,350 +0,0 @@
-# OAuth Implementation: Next Steps and Design
-
-## Executive Summary
-
-The OAuth implementation is functional but has several gaps that need addressing before it's production-ready. This document outlines the known issues, proposes a comprehensive user identity model, and provides a prioritized implementation plan.
-
-## Current State (Updated January 2026)
-
-### What Works ✅
-- Discord OAuth flow (server-mediated polling)
-- Google OAuth flow
-- JWT token generation and validation
-- User creation and display name setting
-- Auto-login with stored tokens
-- Basic game creation and play with OAuth users
-- Headshot fetching via public CDN (no auth required)
-- Logout button in lobby (preserves tokens for quick reconnect)
-- Environment (prod/qa) and user display in lobby
-- Game identity with userName = displayName (PR #4964 merged)
-
-### Known Issues
-
-#### 1. Game Identity Model Fragility (Deferred)
-**Status**: Accepted for now. PR #4964 merged with `userName = displayName`.
-
-**Current behavior**:
-- Games store `userNameToFactionId: Map[String, Int]`
-- For JWT users, this maps displayName → factionId
-- displayName is technically mutable (users could change it)
-- No migration path when displayName changes
-
-**Why this is acceptable**:
-1. We don't currently have a "change display name" feature
-2. The alternative (using userId) requires more extensive changes
-3. Can migrate to userId-based identity later if needed
-
-#### 2. In-Game Headshot Fetching ✅ FIXED
-**Solution**: Made the `eagle0-headshots` S3 bucket public and enabled CDN.
-- Client now fetches directly from `https://eagle0-headshots.sfo3.cdn.digitaloceanspaces.com/`
-- No authentication required
-- Works for both OAuth and Basic Auth users
-- Simpler architecture, no dependency on home Mac server
-
-#### 3. Logout from Lobby ✅ FIXED
-**Solution**: Added logout button to lobby UI (PR #4967).
-- Button disconnects from server and returns to connection screen
-- Intentionally does NOT clear OAuth tokens
-- Allows quick reconnect with same account without full OAuth flow
-
-#### 4. Display Name Uniqueness Not Enforced (Medium) - OPEN
-**Problem**: User was able to set displayName "nolen" when that name was already taken.
-
-**Root cause**: Unknown - needs investigation. Either:
-- The uniqueness check is buggy
-- The displayNameIndex wasn't populated correctly during user creation
-- Race condition during concurrent registrations
-
-#### 5. Admin Server Crashes ✅ FIXED
-**Solution**: PR #4964 sets `userName = displayName` for JWT users.
-
-#### 6. Intermittent "Expired" Errors During Login (Medium) - INVESTIGATING
-**Problem**: Users occasionally get "OAuth session expired" errors even when server logs show the callback succeeded.
-
-**Status**: Added diagnostic logging in PR #4974 to trace:
-- State creation in `getAuthUrl`
-- State lookup in `handleCallback`
-- Result lookup in `checkStatus`
-
-**Possible causes**:
-- State mismatch between client and server
-- Race condition in polling
-- Cleanup running at wrong time
-
-#### 7. Token Expiry Field Bug ✅ FIXED
-**Problem**: `CheckOAuthStatusResponse.expiresAt` was returning refresh token expiry (30 days) instead of access token expiry (7 days).
-
-**Solution**: Fixed in PR #4974 to calculate correct access token expiry.
-
----
-
-## Proposed User Identity Model
-
-### Design Principles
-
-1. **Stable Internal Identity**: `userId` (UUID) is the only key used for persistent associations
-2. **Display Name is Cosmetic**: Can change without breaking game associations
-3. **Backwards Compatibility**: Basic Auth continues to work for local development
-4. **Multi-Provider Support**: Users can link Discord, Google, and future providers
-5. **Avatar Flexibility**: Use OAuth avatar by default, support custom uploads later
-
-### Data Model
-
-```
-User {
-  userId: String (UUID)           // Primary key, immutable, used for all internal references
-  displayName: String             // Unique, user-visible, mutable with migration
-  displayNameLower: String        // Case-insensitive uniqueness
-  email: String                   // Primary email for account recovery/linking
-  avatarUrl: String               // Current avatar URL
-  avatarData: bytes               // Cached avatar for offline/fast access (future)
-  oauthIdentities: [OAuthIdentity]
-  createdAt: Timestamp
-  lastLoginAt: Timestamp
-  isAdmin: Boolean
-}
-
-OAuthIdentity {
-  provider: String                // "discord", "google", etc.
-  providerUserId: String          // Provider's user ID
-  providerEmail: String           // Email from this provider
-  avatarUrl: String               // Avatar from this provider
-  linkedAt: Timestamp
-}
-```
-
-### Identity Resolution Strategy
-
-The key question: **What should `AuthorizationUtils.userName` return?**
-
-#### Option A: userName = displayName (Current PR #4964)
-- **Pro**: Human-readable in logs, game saves, debugging
-- **Con**: Breaks if displayName changes
-- **Migration**: None needed now, complex later
-
-#### Option B: userName = userId (Recommended)
-- **Pro**: Stable identity, displayName changes are safe
-- **Con**: UUIDs in logs are ugly, need display name lookup for UI
-- **Migration**: Cleaner long-term, but breaking change for any existing OAuth games
-
-#### Option C: Hybrid with Migration Support
-- **userName** = userId for new games
-- **Legacy lookup** for old games by displayName
-- **Display layer** resolves userId → displayName for UI
-
-**Recommendation**: Option B with a display name resolution layer. The ugliness in logs is acceptable for the stability it provides. Implement a `UserService.resolveDisplayName(identifier: String): String` that returns displayName for UUIDs or the identifier itself for legacy usernames.
-
-### Account Linking Strategy
-
-#### Automatic Linking (Future)
-When a user logs in with a new OAuth provider:
-1. Check if the provider email matches an existing user's email
-2. If match found, prompt: "An account exists with this email. Link accounts?"
-3. If confirmed, add new OAuthIdentity to existing user
-4. If declined, create separate account (different email required)
-
-#### Manual Linking (MVP)
-1. User logs in with primary account
-2. User goes to Settings → Linked Accounts
-3. User clicks "Link Discord" or "Link Google"
-4. OAuth flow adds new identity to current user
-
-### Avatar/Headshot Strategy
-
-#### Phase 1: OAuth Avatars (MVP)
-- Store `avatarUrl` from OAuth provider during login
-- Server proxies avatar requests to avoid CORS issues
-- Cache avatars locally with TTL
-
-#### Phase 2: Avatar Caching
-- Download avatar to local storage on login
-- Serve from local storage for reliability
-- Refresh periodically or on login
-
-#### Phase 3: Custom Avatars (Future)
-- Allow users to upload custom avatar
-- Store in S3/DO Spaces
-- Custom avatar overrides OAuth avatar
-
----
-
-## Implementation Plan
-
-### Phase 1: Stabilization ✅ COMPLETE
-
-#### 1.1 Fix Display Name Uniqueness Bug - OPEN
-- [ ] Investigate why "nolen" was allowed when it existed
-- [ ] Add logging to `setDisplayName` to trace the issue
-- [ ] Ensure `displayNameIndex` is correctly maintained
-- [ ] Add unit tests for uniqueness enforcement
-
-#### 1.2 Add Logout Button to Lobby ✅ DONE
-- [x] Add "Logout" button to lobby UI
-- [x] Disconnect from server
-- [x] Navigate to connection screen
-- [x] Preserve OAuth tokens for quick reconnect (intentional change from original plan)
-
-#### 1.3 Merge PR #4964 (userName = displayName) ✅ DONE
-- [x] Merged - games work with OAuth users
-- [x] Documented limitation (games break if displayName changes)
-
-#### 1.4 Fix Headshot Fetching ✅ DONE
-- [x] Made eagle0-headshots bucket public
-- [x] Client fetches directly from CDN
-- [x] No authentication required
-
-#### 1.5 Add Lobby Status Display ✅ DONE
-- [x] Show environment (prod/qa) in lobby
-- [x] Show current user in lobby (OAuth displayName or classic username)
-
-### Phase 2: Remaining Work (Priority Order)
-
-#### 2.1 Diagnose Intermittent "Expired" Errors - IN PROGRESS
-- [x] Add diagnostic logging (PR #4974)
-- [ ] Deploy and reproduce the issue
-- [ ] Analyze logs to identify root cause
-- [ ] Implement fix based on findings
-
-#### 2.2 Fix Display Name Uniqueness
-- [ ] Investigate UserService.setDisplayName logic
-- [ ] Check displayNameIndex population
-- [ ] Add logging to trace the issue
-- [ ] Fix the bug and add tests
-
-#### 2.3 Wire Up Lobby UI in Unity
-- [ ] Connect `lobbyEnvironmentText` to TextMeshProUGUI in scene
-- [ ] Connect `lobbyUserText` to TextMeshProUGUI in scene
-
-#### 2.4 Implement Token Refresh During Gameplay
-- [ ] Implement `RefreshToken` RPC on server (currently throws UNIMPLEMENTED)
-- [ ] Store refresh tokens server-side for validation
-- [ ] Add proactive refresh in client before token expires
-- [ ] Handle refresh during reconnection attempts
-
-### Phase 3: Nice-to-Haves (Future)
-
-#### 3.1 Proactive Token Refresh
-- [ ] Monitor token expiry in client
-- [ ] Refresh automatically when < 5 minutes remaining
-- [ ] Update TokenStorage with new access token
-
-#### 3.2 Better Error Messages
-- [ ] Distinguish between network errors and auth errors
-- [ ] Show user-friendly messages for OAuth failures
-- [ ] Add retry suggestions
-
-#### 3.3 Session Persistence Across Server Restarts
-- [ ] Move pendingOAuth from in-memory TrieMap to Redis/database
-- [ ] Move completedOAuth to Redis with TTL
-- [ ] Server can restart without breaking in-flight OAuth flows
-
-#### 3.4 Migrate to userId-based Game Identity (Deferred)
-- [ ] Change `AuthorizationUtils.userName` to return `userId` for JWT users
-- [ ] Add `UserService.resolveDisplayName(id: String): String` for UI display
-- [ ] Update game UI to resolve userIds to displayNames
-- [ ] Existing Basic Auth games continue to work (userName is literal)
-
-#### 3.5 Display Name Change Support (Requires 3.4)
-- [ ] Add `ChangeDisplayName` RPC
-- [ ] Validate new name is unique
-- [ ] Update user record
-- [ ] No game migration needed (games use userId)
-
-### Phase 3: Multi-Provider Support (Future)
-
-#### 3.1 Account Linking UI
-- [ ] Add Settings page with "Linked Accounts" section
-- [ ] Show currently linked providers
-- [ ] "Link Another Account" button triggers OAuth flow
-- [ ] `LinkOAuthProvider` RPC adds identity to current user
-
-#### 3.2 Login Provider Selection
-- [ ] If user has multiple providers, any can be used to login
-- [ ] All resolve to same userId
-- [ ] Session shows which provider was used
-
-#### 3.3 Account Merging (Complex)
-- [ ] Handle case where user created separate accounts
-- [ ] Merge game history, stats, etc.
-- [ ] Delete duplicate user record
-- [ ] This is complex - may defer or not implement
-
-### Phase 4: Enhanced Avatars (Future)
-
-#### 4.1 Avatar Caching
-- [ ] Download avatars to S3/DO Spaces on login
-- [ ] Serve from our CDN
-- [ ] Refresh on login if changed
-
-#### 4.2 Custom Avatar Upload
-- [ ] Upload endpoint with size/format validation
-- [ ] Store in S3/DO Spaces
-- [ ] Custom avatar overrides OAuth avatar
-
----
-
-## Technical Debt to Address
-
-1. **Context Propagation in Futures**: PR #4960 fixed `setDisplayName` and `getCurrentUser`, but audit all `Future` blocks that access `AuthorizationUtils`
-
-2. **Dual Auth Support**: The system supports both Basic Auth and JWT. Consider:
-   - Should Basic Auth be deprecated for production?
-   - Should it remain for local development only?
-   - How do Basic Auth users interact with OAuth users in the same game?
-
-3. **Token Refresh**: `RefreshToken` RPC throws UNIMPLEMENTED. Need to:
-   - Implement refresh token storage and validation
-   - Handle token refresh in client
-   - Consider refresh token rotation for security
-
-4. **Session Management**: No server-side session tracking. Consider:
-   - Track active sessions per user
-   - Allow "logout all devices"
-   - Detect concurrent logins
-
----
-
-## Open Questions
-
-1. **What happens when a Basic Auth user and OAuth user have the same name?**
-   - Currently possible - Basic Auth doesn't check UserService
-   - Could cause confusion in games
-   - Solution: Require OAuth for multiplayer? Or namespace Basic Auth names?
-
-2. **Should displayName changes be allowed?**
-   - With userId-based identity, it's safe
-   - But could cause confusion ("who is this new player?")
-   - Consider: rate limit changes, show "formerly known as" temporarily
-
-3. **How to handle OAuth provider account deletion?**
-   - User deletes their Discord account
-   - Their Eagle0 account still exists
-   - They can't login unless they linked another provider
-   - Solution: Encourage linking multiple providers, or add email/password fallback
-
-4. **Admin impersonation with OAuth**
-   - Currently works via X-Impersonate-User header
-   - Should this use userId or displayName?
-   - Probably userId for stability
-
----
-
-## Appendix: File Locations
-
-### Server (Scala)
-- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD
-- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - Token generation/validation
-- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth flow
-- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC Auth service
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationInterceptor.scala` - Auth middleware
-- `src/main/scala/net/eagle0/eagle/service/AuthorizationUtils.scala` - Context accessors
-
-### Client (C#)
-- `Assets/Auth/AuthClient.cs` - gRPC client for Auth service
-- `Assets/Auth/OAuthManager.cs` - OAuth flow orchestration
-- `Assets/Auth/TokenStorage.cs` - Persistent token storage
-- `Assets/Auth/JwtAuthInterceptor.cs` - Attaches JWT to requests
-
-### Protos
-- `src/main/protobuf/net/eagle0/eagle/api/auth.proto` - Auth service definition
-- `src/main/protobuf/net/eagle0/eagle/internal/user/user.proto` - User data model

docs/SHARDOK_LATENCY_HIDING.md

@@ -1,216 +0,0 @@
-# Shardok Latency Hiding Strategies
-
-## Problem Statement
-
-With Shardok running on Hetzner (Helsinki) and Eagle on DigitalOcean (US), the round-trip latency for human commands is ~200-400ms:
-
-```
-Human posts command:
-Unity → Eagle (DO) → Shardok (Hetzner) → Eagle (DO) → Unity
-         ~10ms         ~100ms              ~100ms        ~10ms
-                    Total: ~220ms round-trip
-```
-
-This latency is acceptable for AI turns (users watch animations anyway), but creates noticeable lag when humans post commands.
-
----
-
-## Strategy 1: Client-Side Animation Masking
-
-### Concept
-
-Start animations immediately when the user clicks, before server confirmation arrives. The animation duration masks the network latency.
-
-### Implementation by Command Type
-
-**Movement Commands** (deterministic):
-- Client knows the destination hex and movement path
-- Start movement animation immediately on click
-- Server confirms the move (should always match)
-- If server rejects (invalid state), snap unit back to origin
-
-**Attack Commands** (RNG-dependent):
-- Show attack animation immediately (unit swings sword, fires arrow)
-- Wait for server to return dice roll result
-- Show damage numbers / hit effects when server responds
-- Animation typically takes 300-500ms, masking most of the latency
-
-**End Turn**:
-- Latency not noticeable (user expects transition delay)
-
-### Unity Implementation Sketch
-
-```csharp
-// In CommandHandler.cs
-public void OnCommandSelected(Command command) {
-    // Start animation immediately
-    if (command.Type == CommandType.Move) {
-        unitController.StartMoveAnimation(command.TargetHex);
-    } else if (command.Type == CommandType.Attack) {
-        unitController.StartAttackAnimation(command.TargetUnit);
-    }
-
-    // Send to server in parallel
-    connection.SendCommand(command, (response) => {
-        if (response.Success) {
-            // Animation continues, apply result
-            ApplyCommandResult(response);
-        } else {
-            // Rollback animation
-            unitController.CancelAnimation();
-            ShowError(response.ErrorMessage);
-        }
-    });
-}
-```
-
-### Pros
-- Simple implementation
-- No server-side changes
-- Works with existing architecture
-
-### Cons
-- Doesn't eliminate latency for attacks with RNG (must wait for dice roll)
-- Rollback needed if server rejects command (rare but possible)
-
-### Estimated Improvement
-- Movement: ~200ms latency hidden (feels instant)
-- Attacks: ~100-200ms hidden by animation, ~100ms visible wait for dice result
-
----
-
-## Strategy 2: Split Shardok Architecture
-
-### Concept
-
-Run two Shardok instances:
-- **Shardok-Primary (DigitalOcean)**: Handles command processing, source of truth
-- **Shardok-AI (Hetzner)**: AI computation only
-
-Human commands go to the nearby Primary for low latency. AI computation uses the powerful Hetzner instance.
-
-### Architecture
-
-```
-                    Human commands (low latency ~20ms)
-Unity ←→ Eagle ←→ Shardok-Primary (DigitalOcean)
-                         ↓ state sync (when AI turn starts)
-                    Shardok-AI (Hetzner)
-                         ↑ AI command response
-```
-
-### How It Works
-
-**Human Turn:**
-1. Human posts command → Eagle → Shardok-Primary (DO)
-2. Primary processes command immediately (~10ms local)
-3. Primary streams result to client via Eagle (~10ms)
-4. **Total latency: ~20ms** (vs ~220ms current)
-
-**AI Turn:**
-1. When AI's turn starts, Primary sends game state snapshot to Hetzner
-2. Shardok-AI computes best command using full CPU power
-3. Shardok-AI returns command index to Primary
-4. Primary executes command locally and streams to client
-5. Repeat until AI turn ends
-
-### Protocol Changes
-
-```protobuf
-// New service for AI-only computation
-service ShardokAIService {
-    // Send game state, receive AI's chosen command
-    rpc GetAICommand(AICommandRequest) returns (AICommandResponse);
-}
-
-message AICommandRequest {
-    bytes game_state = 1;           // Serialized game state
-    int32 player_id = 2;            // Which AI player
-    repeated bytes available_commands = 3;  // Available command descriptors
-}
-
-message AICommandResponse {
-    int32 command_index = 1;        // Index into available_commands
-    int32 search_depth = 2;         // For debugging
-    double best_score = 3;          // For debugging
-}
-```
-
-### Shardok-Primary Requirements
-
-Shardok-Primary on DigitalOcean needs to:
-- Process all commands (human and AI)
-- Maintain authoritative game state
-- Serialize/deserialize game state for AI requests
-- Run on minimal CPU (command processing is fast)
-
-This is essentially the current Shardok, but without running the AI search.
-
-### Shardok-AI Requirements
-
-Shardok-AI on Hetzner needs to:
-- Receive game state snapshots
-- Run AI evaluation (IterativeDeepeningAI or MCTS)
-- Return best command index
-- No persistent state (stateless worker)
-
-### AI Turn Latency
-
-Each AI command has ~200ms network latency. This is acceptable because:
-1. User is watching animations anyway
-2. Natural pacing lets user observe AI decisions
-3. AI computation is fast on Hetzner's 16 cores
-
-For a typical AI turn with 5 commands: 5 × 200ms = 1 second network overhead, plus AI thinking time. With animations, this feels natural.
-
-### Implementation Phases
-
-**Phase 1: Add Shardok-Primary (minimal)**
-- Deploy existing Shardok container to DigitalOcean
-- Configure Eagle to use local Shardok for all commands
-- Human latency immediately improves
-
-**Phase 2: Add AI offload**
-- Implement `ShardokAIService` RPC
-- Shardok-Primary calls Hetzner for AI commands
-- Shardok-AI processes requests statelessly
-
-**Phase 3: Optimize**
-- Batch multiple AI actions if possible
-- Pre-warm Shardok-AI connection
-- Add fallback if Hetzner unavailable
-
-### Pros
-- Human command latency drops from ~220ms to ~20ms
-- AI still gets Hetzner's CPU power
-- Clear separation of concerns
-- Shardok-Primary can fall back to local AI if Hetzner unavailable
-
-### Cons
-- Two Shardok instances to maintain
-- State serialization overhead for AI requests
-- Each AI action has network round-trip (acceptable with animations)
-
----
-
-## Comparison
-
-| Approach | Human Latency | AI Throughput | Complexity | Changes Required |
-|----------|---------------|---------------|------------|------------------|
-| Current | ~220ms | High | - | - |
-| Animation masking | ~220ms (perceived ~50ms) | High | Low | Unity only |
-| Split architecture | ~20ms | High | Medium | New RPC, two deployments |
-
----
-
-## Recommendation
-
-**Phase 1 (now)**: Implement animation masking in Unity client
-- Quick win, no server changes
-- Improves perceived latency significantly for movement
-- Attacks still show dice animation while waiting
-
-**Phase 2 (future)**: Split architecture if animation masking insufficient
-- Only needed if users complain about attack latency
-- More complex but provides true low latency
-- Natural evolution of current architecture

go.mod

@@ -9,9 +9,6 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.28.10
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.51
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.72.2
-	github.com/golang-jwt/jwt/v5 v5.2.1
-	github.com/google/uuid v1.6.0
-	google.golang.org/grpc v1.68.0
 	google.golang.org/protobuf v1.36.3
 )
 

go.sum

@@ -34,18 +34,12 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.33.6 h1:VwhTrsTuVn52an4mXx29PqRzs2Dv
 github.com/aws/aws-sdk-go-v2/service/sts v1.33.6/go.mod h1:+8h7PZb3yY5ftmVLD7ocEoE98hdc8PoKS0H3wfx1dlc=
 github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
 github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
 golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/grpc v1.68.0 h1:aHQeeJbo8zAkAa3pRzrVjZlbz6uSfeOXlJNQM0RAbz0=
-google.golang.org/grpc v1.68.0/go.mod h1:fmSPC5AsjSBCK54MyHRx48kpOti1/jRfOlwEWywNjWA=
 google.golang.org/protobuf v1.26.0-rc.1 h1:7QnIQpGRHE5RnLKnESfDoxm2dTapTZua5a0kS0A+VXQ=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.36.3 h1:82DV7MYdb8anAVi3qge1wSnMDrnKK7ebr+I0hHRN1BU=

maven_install.json

@@ -1,10 +1,9 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": -2049857450,
-  "__RESOLVED_ARTIFACTS_HASH": -1728186926,
+  "__INPUT_ARTIFACTS_HASH": 571423113,
+  "__RESOLVED_ARTIFACTS_HASH": 438039003,
   "conflict_resolution": {
     "com.google.guava:failureaccess:1.0.1": "com.google.guava:failureaccess:1.0.2",
-    "com.squareup.okio:okio:2.10.0": "com.squareup.okio:okio:3.6.0",
     "io.netty:netty-buffer:4.1.110.Final": "io.netty:netty-buffer:4.1.112.Final",
     "io.netty:netty-codec-http2:4.1.110.Final": "io.netty:netty-codec-http2:4.1.112.Final",
     "io.netty:netty-codec-http:4.1.110.Final": "io.netty:netty-codec-http:4.1.112.Final",
@@ -48,12 +47,6 @@
       },
       "version": "2.12.7"
     },
-    "com.github.stephenc.jcip:jcip-annotations": {
-      "shasums": {
-        "jar": "4fccff8382aafc589962c4edb262f6aa595e34f1e11e61057d1c6a96e8fc7323"
-      },
-      "version": "1.0-1"
-    },
     "com.google.android:annotations": {
       "shasums": {
         "jar": "ba734e1e84c09d615af6a09d33034b4f0442f8772dec120efb376d86a565ae15"
@@ -162,24 +155,6 @@
       },
       "version": "1.4.2"
     },
-    "com.nimbusds:nimbus-jose-jwt": {
-      "shasums": {
-        "jar": "12ae4a3a260095d7aeba2adea7ae396e8b9570db8b7b409e09a824c219cc0444"
-      },
-      "version": "9.37.3"
-    },
-    "com.squareup.okhttp3:okhttp": {
-      "shasums": {
-        "jar": "b1050081b14bb7a3a7e55a4d3ef01b5dcfabc453b4573a4fc019767191d5f4e0"
-      },
-      "version": "4.12.0"
-    },
-    "com.squareup.okhttp3:okhttp-sse": {
-      "shasums": {
-        "jar": "bff4fbcaef7aac2d910d4ff46dafaa4e6d15da127df6bac97216da46943a7d4c"
-      },
-      "version": "4.12.0"
-    },
     "com.squareup.okhttp:okhttp": {
       "shasums": {
         "jar": "88ac9fd1bb51f82bcc664cc1eb9c225c90dc4389d660231b4cc737bebfe7d0aa"
@@ -188,15 +163,9 @@
     },
     "com.squareup.okio:okio": {
       "shasums": {
-        "jar": "8e63292e5c53bb93c4a6b0c213e79f15990fed250c1340f1c343880e1c9c39b5"
+        "jar": "a27f091d34aa452e37227e2cfa85809f29012a8ef2501a9b5a125a978e4fcbc1"
       },
-      "version": "3.6.0"
-    },
-    "com.squareup.okio:okio-jvm": {
-      "shasums": {
-        "jar": "67543f0736fc422ae927ed0e504b98bc5e269fda0d3500579337cb713da28412"
-      },
-      "version": "3.6.0"
+      "version": "2.10.0"
     },
     "com.thesamet.scalapb:compilerplugin_3": {
       "shasums": {
@@ -413,12 +382,6 @@
       },
       "version": "0.27.0"
     },
-    "io.sentry:sentry": {
-      "shasums": {
-        "jar": "740a118182fc089d307830f4e508372e01ad94639b00b4e1b1d83762298a5f35"
-      },
-      "version": "7.19.0"
-    },
     "javax.activation:javax.activation-api": {
       "shasums": {
         "jar": "43fdef0b5b6ceb31b0424b208b930c74ab58fac2ceeb7b3f6fd3aeb8b5ca4393"
@@ -481,27 +444,15 @@
     },
     "org.jetbrains.kotlin:kotlin-stdlib": {
       "shasums": {
-        "jar": "55e989c512b80907799f854309f3bc7782c5b3d13932442d0379d5c472711504"
+        "jar": "b8ab1da5cdc89cb084d41e1f28f20a42bd431538642a5741c52bbfae3fa3e656"
       },
-      "version": "1.9.10"
+      "version": "1.4.20"
     },
     "org.jetbrains.kotlin:kotlin-stdlib-common": {
       "shasums": {
-        "jar": "cde3341ba18a2ba262b0b7cf6c55b20c90e8d434e42c9a13e6a3f770db965a88"
+        "jar": "a7112c9b3cefee418286c9c9372f7af992bd1e6e030691d52f60cb36dbec8320"
       },
-      "version": "1.9.10"
-    },
-    "org.jetbrains.kotlin:kotlin-stdlib-jdk7": {
-      "shasums": {
-        "jar": "ac6361bf9ad1ed382c2103d9712c47cdec166232b4903ed596e8876b0681c9b7"
-      },
-      "version": "1.9.10"
-    },
-    "org.jetbrains.kotlin:kotlin-stdlib-jdk8": {
-      "shasums": {
-        "jar": "a4c74d94d64ce1abe53760fe0389dd941f6fc558d0dab35e47c085a11ec80f28"
-      },
-      "version": "1.9.10"
+      "version": "1.4.20"
     },
     "org.jetbrains:annotations": {
       "shasums": {
@@ -828,26 +779,12 @@
       "org.checkerframework:checker-qual",
       "org.ow2.asm:asm"
     ],
-    "com.nimbusds:nimbus-jose-jwt": [
-      "com.github.stephenc.jcip:jcip-annotations"
-    ],
-    "com.squareup.okhttp3:okhttp": [
-      "com.squareup.okio:okio",
-      "org.jetbrains.kotlin:kotlin-stdlib-jdk8"
-    ],
-    "com.squareup.okhttp3:okhttp-sse": [
-      "com.squareup.okhttp3:okhttp",
-      "org.jetbrains.kotlin:kotlin-stdlib-jdk8"
-    ],
     "com.squareup.okhttp:okhttp": [
       "com.squareup.okio:okio"
     ],
     "com.squareup.okio:okio": [
-      "com.squareup.okio:okio-jvm"
-    ],
-    "com.squareup.okio:okio-jvm": [
-      "org.jetbrains.kotlin:kotlin-stdlib-common",
-      "org.jetbrains.kotlin:kotlin-stdlib-jdk8"
+      "org.jetbrains.kotlin:kotlin-stdlib",
+      "org.jetbrains.kotlin:kotlin-stdlib-common"
     ],
     "com.thesamet.scalapb:compilerplugin_3": [
       "com.google.protobuf:protobuf-java",
@@ -1055,13 +992,6 @@
       "org.jetbrains.kotlin:kotlin-stdlib-common",
       "org.jetbrains:annotations"
     ],
-    "org.jetbrains.kotlin:kotlin-stdlib-jdk7": [
-      "org.jetbrains.kotlin:kotlin-stdlib"
-    ],
-    "org.jetbrains.kotlin:kotlin-stdlib-jdk8": [
-      "org.jetbrains.kotlin:kotlin-stdlib",
-      "org.jetbrains.kotlin:kotlin-stdlib-jdk7"
-    ],
     "org.json4s:json4s-ast_3": [
       "org.scala-lang:scala3-library_3"
     ],
@@ -1376,9 +1306,6 @@
       "com.fasterxml.jackson.databind.type",
       "com.fasterxml.jackson.databind.util"
     ],
-    "com.github.stephenc.jcip:jcip-annotations": [
-      "net.jcip.annotations"
-    ],
     "com.google.android:annotations": [
       "android.annotation"
     ],
@@ -1524,61 +1451,6 @@
     "com.google.truth:truth": [
       "com.google.common.truth"
     ],
-    "com.nimbusds:nimbus-jose-jwt": [
-      "com.nimbusds.jose",
-      "com.nimbusds.jose.crypto",
-      "com.nimbusds.jose.crypto.bc",
-      "com.nimbusds.jose.crypto.factories",
-      "com.nimbusds.jose.crypto.impl",
-      "com.nimbusds.jose.crypto.opts",
-      "com.nimbusds.jose.crypto.utils",
-      "com.nimbusds.jose.jca",
-      "com.nimbusds.jose.jwk",
-      "com.nimbusds.jose.jwk.gen",
-      "com.nimbusds.jose.jwk.source",
-      "com.nimbusds.jose.mint",
-      "com.nimbusds.jose.proc",
-      "com.nimbusds.jose.produce",
-      "com.nimbusds.jose.shaded.gson",
-      "com.nimbusds.jose.shaded.gson.annotations",
-      "com.nimbusds.jose.shaded.gson.internal",
-      "com.nimbusds.jose.shaded.gson.internal.bind",
-      "com.nimbusds.jose.shaded.gson.internal.bind.util",
-      "com.nimbusds.jose.shaded.gson.internal.reflect",
-      "com.nimbusds.jose.shaded.gson.internal.sql",
-      "com.nimbusds.jose.shaded.gson.reflect",
-      "com.nimbusds.jose.shaded.gson.stream",
-      "com.nimbusds.jose.util",
-      "com.nimbusds.jose.util.cache",
-      "com.nimbusds.jose.util.events",
-      "com.nimbusds.jose.util.health",
-      "com.nimbusds.jwt",
-      "com.nimbusds.jwt.proc",
-      "com.nimbusds.jwt.util"
-    ],
-    "com.squareup.okhttp3:okhttp": [
-      "okhttp3",
-      "okhttp3.internal",
-      "okhttp3.internal.authenticator",
-      "okhttp3.internal.cache",
-      "okhttp3.internal.cache2",
-      "okhttp3.internal.concurrent",
-      "okhttp3.internal.connection",
-      "okhttp3.internal.http",
-      "okhttp3.internal.http1",
-      "okhttp3.internal.http2",
-      "okhttp3.internal.io",
-      "okhttp3.internal.platform",
-      "okhttp3.internal.platform.android",
-      "okhttp3.internal.proxy",
-      "okhttp3.internal.publicsuffix",
-      "okhttp3.internal.tls",
-      "okhttp3.internal.ws"
-    ],
-    "com.squareup.okhttp3:okhttp-sse": [
-      "okhttp3.internal.sse",
-      "okhttp3.sse"
-    ],
     "com.squareup.okhttp:okhttp": [
       "com.squareup.okhttp",
       "com.squareup.okhttp.internal",
@@ -1587,7 +1459,7 @@
       "com.squareup.okhttp.internal.io",
       "com.squareup.okhttp.internal.tls"
     ],
-    "com.squareup.okio:okio-jvm": [
+    "com.squareup.okio:okio": [
       "okio",
       "okio.internal"
     ],
@@ -1791,30 +1663,6 @@
     "io.perfmark:perfmark-api": [
       "io.perfmark"
     ],
-    "io.sentry:sentry": [
-      "io.sentry",
-      "io.sentry.backpressure",
-      "io.sentry.cache",
-      "io.sentry.clientreport",
-      "io.sentry.config",
-      "io.sentry.exception",
-      "io.sentry.hints",
-      "io.sentry.instrumentation.file",
-      "io.sentry.internal.debugmeta",
-      "io.sentry.internal.gestures",
-      "io.sentry.internal.modules",
-      "io.sentry.internal.viewhierarchy",
-      "io.sentry.metrics",
-      "io.sentry.profilemeasurements",
-      "io.sentry.protocol",
-      "io.sentry.rrweb",
-      "io.sentry.transport",
-      "io.sentry.util",
-      "io.sentry.util.thread",
-      "io.sentry.vendor",
-      "io.sentry.vendor.gson.internal.bind.util",
-      "io.sentry.vendor.gson.stream"
-    ],
     "javax.activation:javax.activation-api": [
       "javax.activation"
     ],
@@ -1966,7 +1814,6 @@
       "kotlin.annotation",
       "kotlin.collections",
       "kotlin.collections.builders",
-      "kotlin.collections.jdk8",
       "kotlin.collections.unsigned",
       "kotlin.comparisons",
       "kotlin.concurrent",
@@ -1975,36 +1822,24 @@
       "kotlin.coroutines.cancellation",
       "kotlin.coroutines.intrinsics",
       "kotlin.coroutines.jvm.internal",
-      "kotlin.enums",
       "kotlin.experimental",
       "kotlin.internal",
-      "kotlin.internal.jdk7",
-      "kotlin.internal.jdk8",
       "kotlin.io",
-      "kotlin.io.encoding",
-      "kotlin.io.path",
-      "kotlin.jdk7",
       "kotlin.js",
       "kotlin.jvm",
       "kotlin.jvm.functions",
       "kotlin.jvm.internal",
       "kotlin.jvm.internal.markers",
       "kotlin.jvm.internal.unsafe",
-      "kotlin.jvm.jdk8",
-      "kotlin.jvm.optionals",
       "kotlin.math",
       "kotlin.properties",
       "kotlin.random",
-      "kotlin.random.jdk8",
       "kotlin.ranges",
       "kotlin.reflect",
       "kotlin.sequences",
-      "kotlin.streams.jdk8",
       "kotlin.system",
       "kotlin.text",
-      "kotlin.text.jdk8",
-      "kotlin.time",
-      "kotlin.time.jdk8"
+      "kotlin.time"
     ],
     "org.jetbrains:annotations": [
       "org.intellij.lang.annotations",
@@ -2417,7 +2252,6 @@
       "com.fasterxml.jackson.core:jackson-annotations",
       "com.fasterxml.jackson.core:jackson-core",
       "com.fasterxml.jackson.core:jackson-databind",
-      "com.github.stephenc.jcip:jcip-annotations",
       "com.google.android:annotations",
       "com.google.api.grpc:proto-google-common-protos",
       "com.google.auth:google-auth-library-credentials",
@@ -2436,12 +2270,8 @@
       "com.google.protobuf:protobuf-java",
       "com.google.re2j:re2j",
       "com.google.truth:truth",
-      "com.nimbusds:nimbus-jose-jwt",
-      "com.squareup.okhttp3:okhttp",
-      "com.squareup.okhttp3:okhttp-sse",
       "com.squareup.okhttp:okhttp",
       "com.squareup.okio:okio",
-      "com.squareup.okio:okio-jvm",
       "com.thesamet.scalapb:compilerplugin_3",
       "com.thesamet.scalapb:lenses_3",
       "com.thesamet.scalapb:protoc-bridge_2.13",
@@ -2482,7 +2312,6 @@
       "io.opencensus:opencensus-contrib-grpc-metrics",
       "io.opencensus:opencensus-contrib-http-util",
       "io.perfmark:perfmark-api",
-      "io.sentry:sentry",
       "javax.activation:javax.activation-api",
       "javax.xml.bind:jaxb-api",
       "joda-time:joda-time",
@@ -2495,8 +2324,6 @@
       "org.hamcrest:hamcrest-core",
       "org.jetbrains.kotlin:kotlin-stdlib",
       "org.jetbrains.kotlin:kotlin-stdlib-common",
-      "org.jetbrains.kotlin:kotlin-stdlib-jdk7",
-      "org.jetbrains.kotlin:kotlin-stdlib-jdk8",
       "org.jetbrains:annotations",
       "org.json4s:json4s-ast_3",
       "org.json4s:json4s-core_3",

nginx/nginx.conf

@@ -1,240 +0,0 @@
-events {
-    worker_connections 1024;
-}
-
-http {
-    # Logging
-    log_format grpc_json escape=json '{'
-        '"time":"$time_iso8601",'
-        '"client":"$remote_addr",'
-        '"uri":"$uri",'
-        '"status":$status,'
-        '"grpc_status":"$sent_http_grpc_status",'
-        '"request_time":$request_time,'
-        '"upstream_time":"$upstream_response_time"'
-    '}';
-
-    access_log /var/log/nginx/access.log grpc_json;
-    error_log /var/log/nginx/error.log warn;
-
-    # Rate limiting zone
-    limit_req_zone $binary_remote_addr zone=grpc_limit:10m rate=100r/s;
-
-    # Docker DNS resolver - re-resolve hostnames every 10s
-    # This prevents stale IP caching when containers restart
-    resolver 127.0.0.11 valid=10s ipv6=off;
-
-    # Upstream for Eagle gRPC server
-    # For blue-green deployments, this is switched between eagle-blue:40032 and eagle-green:40032
-    # by scripts/deploy-blue-green.sh, then nginx is reloaded with 'nginx -s reload'
-    upstream eagle_grpc {
-        server eagle-blue:40032;
-        keepalive 100;
-    }
-
-    # HTTP server for Let's Encrypt challenge and redirect
-    server {
-        listen 80;
-        listen [::]:80;
-        server_name prod.eagle0.net;
-
-        # Let's Encrypt challenge
-        location /.well-known/acme-challenge/ {
-            root /var/www/certbot;
-        }
-
-        # Redirect all other HTTP to HTTPS
-        location / {
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    # HTTPS server for gRPC
-    server {
-        listen 443 ssl;
-        listen [::]:443 ssl;
-        http2 on;
-        server_name prod.eagle0.net;
-
-        # SSL certificates (managed by certbot)
-        ssl_certificate /etc/letsencrypt/live/prod.eagle0.net/fullchain.pem;
-        ssl_certificate_key /etc/letsencrypt/live/prod.eagle0.net/privkey.pem;
-
-        # SSL configuration
-        ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
-        ssl_prefer_server_ciphers off;
-        ssl_session_timeout 1d;
-        ssl_session_cache shared:SSL:10m;
-        ssl_session_tickets off;
-
-        # gRPC proxy for Eagle service
-        location /net.eagle0.eagle.api.Eagle {
-            # Rate limiting
-            limit_req zone=grpc_limit burst=50 nodelay;
-
-            # gRPC proxy
-            grpc_pass grpc://eagle_grpc;
-
-            # Timeouts for long-running streams
-            grpc_read_timeout 1200s;
-            grpc_send_timeout 1200s;
-            grpc_socket_keepalive on;
-
-            # Error handling
-            error_page 502 = /error502grpc;
-        }
-
-        # gRPC proxy for Auth service
-        location /net.eagle0.eagle.api.auth.Auth {
-            # Rate limiting
-            limit_req zone=grpc_limit burst=50 nodelay;
-
-            # gRPC proxy
-            grpc_pass grpc://eagle_grpc;
-
-            # Timeouts
-            grpc_read_timeout 30s;
-            grpc_send_timeout 30s;
-
-            # Error handling
-            error_page 502 = /error502grpc;
-        }
-
-        # OAuth callback endpoint (proxied to Go auth service)
-        location /oauth/callback {
-            proxy_pass http://auth:8080;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-        }
-
-        # Health check endpoint
-        location /health {
-            access_log off;
-            return 200 "OK\n";
-            add_header Content-Type text/plain;
-        }
-
-        # gRPC error handling
-        location = /error502grpc {
-            internal;
-            default_type application/grpc;
-            add_header grpc-status 14;
-            add_header grpc-message "unavailable";
-            return 204;
-        }
-    }
-
-    # HTTPS server for Go Auth service (port 40033)
-    # Clients connect here directly for OAuth RPCs in Phase 2
-    server {
-        listen 40033 ssl;
-        listen [::]:40033 ssl;
-        http2 on;
-        server_name prod.eagle0.net;
-
-        # SSL certificates (same as main server)
-        ssl_certificate /etc/letsencrypt/live/prod.eagle0.net/fullchain.pem;
-        ssl_certificate_key /etc/letsencrypt/live/prod.eagle0.net/privkey.pem;
-
-        # SSL configuration
-        ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
-        ssl_prefer_server_ciphers off;
-        ssl_session_timeout 1d;
-        ssl_session_cache shared:SSL:10m;
-        ssl_session_tickets off;
-
-        # gRPC proxy for Auth service
-        # Uses variable-based resolution so nginx can start even if auth isn't ready yet
-        # DNS is cached by the resolver directive (valid=10s)
-        location /net.eagle0.eagle.api.auth.Auth {
-            # Rate limiting
-            limit_req zone=grpc_limit burst=50 nodelay;
-
-            # Dynamic upstream resolution (doesn't block nginx startup)
-            set $auth_backend "auth:40033";
-            grpc_pass grpc://$auth_backend;
-
-            # Timeouts
-            grpc_read_timeout 30s;
-            grpc_send_timeout 30s;
-
-            # Error handling
-            error_page 502 = /error502grpc;
-        }
-
-        # gRPC proxy for Admin service
-        location /net.eagle0.eagle.api.admin.Admin {
-            # Rate limiting
-            limit_req zone=grpc_limit burst=50 nodelay;
-
-            # Dynamic upstream resolution (doesn't block nginx startup)
-            set $auth_backend "auth:40033";
-            grpc_pass grpc://$auth_backend;
-
-            # Timeouts
-            grpc_read_timeout 30s;
-            grpc_send_timeout 30s;
-
-            # Error handling
-            error_page 502 = /error502grpc;
-        }
-
-        # Health check endpoint
-        location /health {
-            access_log off;
-            return 200 "OK\n";
-            add_header Content-Type text/plain;
-        }
-
-        # gRPC error handling
-        location = /error502grpc {
-            internal;
-            default_type application/grpc;
-            add_header grpc-status 14;
-            add_header grpc-message "unavailable";
-            return 204;
-        }
-    }
-
-    # HTTP server for Admin Console (Let's Encrypt + redirect)
-    server {
-        listen 80;
-        listen [::]:80;
-        server_name admin.prod.eagle0.net admin.eagle0.net;
-
-        location /.well-known/acme-challenge/ {
-            root /var/www/certbot;
-        }
-
-        location / {
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    # HTTPS server for Admin Console
-    server {
-        listen 443 ssl;
-        listen [::]:443 ssl;
-        server_name admin.prod.eagle0.net admin.eagle0.net;
-
-        ssl_certificate /etc/letsencrypt/live/admin.eagle0.net/fullchain.pem;
-        ssl_certificate_key /etc/letsencrypt/live/admin.eagle0.net/privkey.pem;
-
-        ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
-        ssl_prefer_server_ciphers off;
-        ssl_session_timeout 1d;
-        ssl_session_cache shared:SSL:10m;
-        ssl_session_tickets off;
-
-        location / {
-            proxy_pass http://admin:8080;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-    }
-}

scripts/deploy-blue-green.sh

@@ -1,207 +0,0 @@
-#!/bin/bash
-#
-# Blue-Green Deployment Script for Eagle Server
-#
-# This script performs a zero-downtime deployment by:
-# 1. Starting the new version on a staging port (green)
-# 2. Waiting for it to become healthy
-# 3. Running warmup traffic to pre-heat the JIT
-# 4. Stopping the old version (blue) - which flushes state to disk
-# 5. Telling green to reload games from disk
-# 6. Switching nginx to route traffic to green
-# 7. Cleaning up
-#
-# Usage: ./deploy-blue-green.sh [NEW_IMAGE_TAG]
-#
-# Example:
-#   ./deploy-blue-green.sh latest
-#   ./deploy-blue-green.sh sha-abc123
-#
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-APP_DIR="${APP_DIR:-/opt/eagle0}"
-NGINX_CONF="${APP_DIR}/nginx/nginx.conf"
-COMPOSE_FILE="${APP_DIR}/docker-compose.prod.yml"
-WARMUP_SCRIPT="${SCRIPT_DIR}/warmup-eagle.sh"
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
-log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
-log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
-
-# Determine which instance is currently active
-get_active_instance() {
-    if grep -q "eagle-blue:40032" "${NGINX_CONF}"; then
-        echo "blue"
-    elif grep -q "eagle-green:40032" "${NGINX_CONF}"; then
-        echo "green"
-    else
-        log_error "Cannot determine active instance from nginx config"
-        exit 1
-    fi
-}
-
-# Wait for a container to be healthy
-wait_for_healthy() {
-    local container=$1
-    local max_attempts=${2:-60}
-    local attempt=1
-
-    log_info "Waiting for ${container} to become healthy..."
-    while [ $attempt -le $max_attempts ]; do
-        health=$(docker inspect --format='{{.State.Health.Status}}' "${container}" 2>/dev/null || echo "unknown")
-        if [ "$health" = "healthy" ]; then
-            log_info "${container} is healthy"
-            return 0
-        fi
-        echo -n "."
-        sleep 2
-        attempt=$((attempt + 1))
-    done
-    echo ""
-    log_error "${container} did not become healthy after $((max_attempts * 2)) seconds"
-    return 1
-}
-
-# Main deployment logic
-main() {
-    local new_tag="${1:-latest}"
-    local registry="registry.digitalocean.com/eagle0/eagle-server"
-    local new_image="${registry}:${new_tag}"
-
-    log_info "Starting blue-green deployment"
-    log_info "New image: ${new_image}"
-
-    cd "${APP_DIR}"
-
-    # Determine current active instance
-    local active=$(get_active_instance)
-    local staging
-    if [ "$active" = "blue" ]; then
-        staging="green"
-    else
-        staging="blue"
-    fi
-
-    log_info "Active instance: eagle-${active}"
-    log_info "Staging instance: eagle-${staging}"
-
-    # Pull the new image
-    log_info "Pulling new image..."
-    docker pull "${new_image}"
-
-    # Start staging instance with new image
-    log_info "Starting eagle-${staging} with new image..."
-    if [ "$staging" = "green" ]; then
-        EAGLE_IMAGE_NEW="${new_image}" docker compose -f "${COMPOSE_FILE}" --profile blue-green up -d eagle-green
-    else
-        EAGLE_IMAGE="${new_image}" docker compose -f "${COMPOSE_FILE}" up -d eagle-blue
-    fi
-
-    # Wait for staging to be healthy
-    if ! wait_for_healthy "eagle-${staging}" 90; then
-        log_error "Staging instance failed health check, aborting deployment"
-        docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
-        docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${staging}"
-        exit 1
-    fi
-
-    # Run warmup/smoke test
-    local staging_port
-    if [ "$staging" = "green" ]; then
-        staging_port=40034
-    else
-        staging_port=40032
-    fi
-
-    log_info "Running warmup against eagle-${staging}..."
-    if [ -x "${WARMUP_SCRIPT}" ]; then
-        if ! "${WARMUP_SCRIPT}" "localhost:${staging_port}"; then
-            log_error "Warmup/smoke test failed, aborting deployment"
-            docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
-            docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${staging}"
-            exit 1
-        fi
-    else
-        log_warn "Warmup script not found at ${WARMUP_SCRIPT}, skipping warmup"
-        log_warn "JIT will be cold on first requests"
-    fi
-
-    # Stop the active instance (this flushes state to disk)
-    log_info "Stopping eagle-${active} (flushing state to disk)..."
-    docker compose -f "${COMPOSE_FILE}" stop "eagle-${active}"
-
-    # Tell staging to reload games from disk
-    log_info "Telling eagle-${staging} to reload games from disk..."
-    if command -v grpcurl &> /dev/null; then
-        grpcurl -plaintext -d '{}' "localhost:${staging_port}" net.eagle0.eagle.api.Eagle/ReloadGames || true
-    else
-        log_warn "grpcurl not installed, skipping game reload"
-        log_warn "New instance will use games loaded at startup"
-    fi
-
-    # Switch nginx upstream
-    log_info "Switching nginx upstream to eagle-${staging}..."
-    if [ "$staging" = "green" ]; then
-        sed -i.bak 's/eagle-blue:40032/eagle-green:40032/g' "${NGINX_CONF}"
-    else
-        sed -i.bak 's/eagle-green:40032/eagle-blue:40032/g' "${NGINX_CONF}"
-    fi
-
-    # Reload nginx
-    log_info "Reloading nginx..."
-    docker compose -f "${COMPOSE_FILE}" exec nginx nginx -s reload
-
-    # Clean up old instance
-    log_info "Removing old eagle-${active} container..."
-    docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${active}"
-
-    # Update the staging instance's restart policy and image var
-    # For blue, we need to update EAGLE_IMAGE; for green, update EAGLE_IMAGE_NEW
-    if [ "$staging" = "blue" ]; then
-        log_info "Updating EAGLE_IMAGE to ${new_image} for future restarts"
-        # User should update their .env file
-    else
-        log_info "Green is now active. Consider switching to blue on next deployment."
-    fi
-
-    log_info "Deployment complete!"
-    log_info "Active instance: eagle-${staging}"
-    log_info ""
-    log_info "Note: Update your .env file with EAGLE_IMAGE=${new_image}"
-    log_info "      if you want future 'docker compose up' to use this version."
-}
-
-# Check for required tools
-check_requirements() {
-    if ! command -v docker &> /dev/null; then
-        log_error "docker is required but not installed"
-        exit 1
-    fi
-
-    if ! command -v sed &> /dev/null; then
-        log_error "sed is required but not installed"
-        exit 1
-    fi
-
-    if [ ! -f "${NGINX_CONF}" ]; then
-        log_error "nginx config not found at ${NGINX_CONF}"
-        exit 1
-    fi
-
-    if [ ! -f "${COMPOSE_FILE}" ]; then
-        log_error "docker-compose file not found at ${COMPOSE_FILE}"
-        exit 1
-    fi
-}
-
-# Run
-check_requirements
-main "$@"

scripts/dlSettings.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
-curl -L "https://docs.google.com/spreadsheets/d/1pv-WMXReccddPwev_YG9IXEGznuGHrYjNNEZ0Rb-ZhM/export?gid=0&format=tsv" | tr -d '\r' > src/main/resources/net/eagle0/shardok/settings.tsv
-curl -L "https://docs.google.com/spreadsheets/d/1p6I5nUMcoAPHIcqikVgbBCFVnqN9dpOEVClbS_wOI7M/export?gid=0&format=tsv" | tr -d '\r' > src/main/resources/net/eagle0/eagle/settings.tsv
+curl -L "https://docs.google.com/spreadsheets/d/1pv-WMXReccddPwev_YG9IXEGznuGHrYjNNEZ0Rb-ZhM/export?gid=0&format=tsv" > src/main/resources/net/eagle0/shardok/settings.tsv
+curl -L "https://docs.google.com/spreadsheets/d/1p6I5nUMcoAPHIcqikVgbBCFVnqN9dpOEVClbS_wOI7M/export?gid=0&format=tsv" > src/main/resources/net/eagle0/eagle/settings.tsv
 
 bazel run //src/main/go/net/eagle0/build/settings_generator:settings_generator -- \
     ${PWD}/src/main/resources/net/eagle0/eagle/settings.tsv \

scripts/downloadTsvs.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 
-curl -L "https://docs.google.com/spreadsheets/d/1DHEsiv4cY4gE6AX3sVH82K__mpBD1aznIYCQwQxA_F0/export?gid=0&format=tsv" | tr -d '\r' > /tmp/names.tsv
+curl -L "https://docs.google.com/spreadsheets/d/1DHEsiv4cY4gE6AX3sVH82K__mpBD1aznIYCQwQxA_F0/export?gid=0&format=tsv" > /tmp/names.tsv
 bazel run //src/main/scala/net/eagle0/util:name_list_checker -- /tmp/names.tsv > src/main/resources/net/eagle0/names.tsv
 bazel run //src/main/scala/net/eagle0/util:name_list_json_maker -- /tmp/names.tsv > src/main/resources/net/eagle0/names.json
-curl -L "https://docs.google.com/spreadsheets/d/1NhvG73HKyVE36yGpkV2oJiSIXoNqQOYTr5ArLnucYL0/export?gid=0&format=tsv" | tr -d '\r' > src/main/resources/net/eagle0/shardok/battalionTypes.tsv
-curl -L "https://docs.google.com/spreadsheets/d/1pNWiyxIks2wJ1v7jRLFD24zrKHG2AfhC-nkWmQKQGN4/export?gid=0&format=tsv" | tr -d '\r' > src/main/resources/net/eagle0/eagle/heroes.tsv
-curl -L "https://docs.google.com/spreadsheets/d/1RUguq5eAQprsZwOOqiCc-1dg4Urc_6iJ6awZsFU4MeI/export?gid=0&format=tsv" | tr -d '\r' > src/main/resources/net/eagle0/eagle/beasts.tsv
+curl -L "https://docs.google.com/spreadsheets/d/1NhvG73HKyVE36yGpkV2oJiSIXoNqQOYTr5ArLnucYL0/export?gid=0&format=tsv" > src/main/resources/net/eagle0/shardok/battalionTypes.tsv
+curl -L "https://docs.google.com/spreadsheets/d/1pNWiyxIks2wJ1v7jRLFD24zrKHG2AfhC-nkWmQKQGN4/export?gid=0&format=tsv" > src/main/resources/net/eagle0/eagle/heroes.tsv
+curl -L "https://docs.google.com/spreadsheets/d/1RUguq5eAQprsZwOOqiCc-1dg4Urc_6iJ6awZsFU4MeI/export?gid=0&format=tsv" > src/main/resources/net/eagle0/eagle/beasts.tsv
 #curl -L "https://docs.google.com/spreadsheets/d/1Z-60cJ_N1IasvqpVb5awKEkIYznEeR2IZSdli47oW88/export?gid=0&format=tsv" > src/main/resources/net/eagle0/eagle/province_map.tsv
 
 ${PWD}/scripts/dlSettings.sh

scripts/generate_changelog.sh

@@ -1,473 +0,0 @@
-#!/bin/bash
-#
-# generate_changelog.sh
-#
-# Generates a weekly changelog from merged PRs, uses Claude to create a synopsis,
-# and sends an HTML email via Fastmail JMAP API.
-#
-# Usage: ./scripts/generate_changelog.sh [--dry-run]
-#
-# Configuration files (in ~/.config/eagle0/):
-#   fastmail_token      - API token (required)
-#   changelog_recipient - Email addresses, one per line (optional, defaults to sender)
-#
-# To set up:
-#   mkdir -p ~/.config/eagle0
-#   echo 'your-token' > ~/.config/eagle0/fastmail_token
-#   chmod 600 ~/.config/eagle0/fastmail_token
-#
-#   # Optional: configure recipients (one per line, # for comments)
-#   cat > ~/.config/eagle0/changelog_recipient << EOF
-#   alice@example.com
-#   bob@example.com
-#   EOF
-#
-# The script tracks its last run using a git tag 'changelog-last-run'.
-# On first run (no tag), it defaults to the previous Friday at 4pm.
-
-set -euo pipefail
-
-# Ensure homebrew binaries are in PATH
-export PATH="/opt/homebrew/bin:$PATH"
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-TAG_NAME="changelog-last-run"
-DRY_RUN=false
-FASTMAIL_API="https://api.fastmail.com/jmap/api/"
-CONFIG_DIR="$HOME/.config/eagle0"
-TOKEN_FILE="$CONFIG_DIR/fastmail_token"
-RECIPIENT_FILE="$CONFIG_DIR/changelog_recipient"
-
-# Load API token from file or environment
-load_api_token() {
-    # Environment variable takes precedence
-    if [[ -n "${FASTMAIL_API_TOKEN:-}" ]]; then
-        return 0
-    fi
-
-    # Try loading from config file
-    if [[ -f "$TOKEN_FILE" ]]; then
-        FASTMAIL_API_TOKEN=$(cat "$TOKEN_FILE" | tr -d '[:space:]')
-        if [[ -n "$FASTMAIL_API_TOKEN" ]]; then
-            echo "Loaded API token from $TOKEN_FILE"
-            export FASTMAIL_API_TOKEN
-            return 0
-        fi
-    fi
-
-    return 1
-}
-
-# Load recipient emails from config file (one per line)
-# Returns JSON array fragment like: {"email": "a@b.com"}, {"email": "c@d.com"}
-load_recipients_json() {
-    local recipients=""
-    if [[ -f "$RECIPIENT_FILE" ]]; then
-        while IFS= read -r line || [[ -n "$line" ]]; do
-            # Skip empty lines and comments
-            line=$(echo "$line" | tr -d '[:space:]')
-            [[ -z "$line" || "$line" == \#* ]] && continue
-
-            if [[ -n "$recipients" ]]; then
-                recipients="$recipients, "
-            fi
-            recipients="$recipients{\"email\": \"$line\"}"
-        done < "$RECIPIENT_FILE"
-    fi
-    echo "$recipients"
-}
-
-# Get human-readable list of recipients
-load_recipients_display() {
-    if [[ -f "$RECIPIENT_FILE" ]]; then
-        grep -v '^#' "$RECIPIENT_FILE" | grep -v '^[[:space:]]*$' | tr '\n' ', ' | sed 's/, $//'
-    fi
-}
-
-# Parse arguments
-while [[ $# -gt 0 ]]; do
-    case $1 in
-        --dry-run)
-            DRY_RUN=true
-            shift
-            ;;
-        *)
-            echo "Unknown option: $1"
-            echo "Usage: $0 [--dry-run]"
-            exit 1
-            ;;
-    esac
-done
-
-cd "$REPO_ROOT"
-
-# Get the cutoff date - either from tag or previous Friday 4pm
-get_cutoff_date() {
-    # Try to get the date from the tag
-    if git rev-parse "$TAG_NAME" >/dev/null 2>&1; then
-        # Get the commit date of the tagged commit
-        git log -1 --format="%aI" "$TAG_NAME"
-    else
-        # Calculate previous Friday at 4pm
-        # Get current day of week (1=Monday, 7=Sunday)
-        local dow=$(date +%u)
-        local days_since_friday
-
-        if [[ $dow -ge 5 ]]; then
-            # Friday (5), Saturday (6), or Sunday (7)
-            days_since_friday=$((dow - 5))
-        else
-            # Monday (1) through Thursday (4)
-            days_since_friday=$((dow + 2))
-        fi
-
-        # Get previous Friday at 4pm in ISO format
-        if [[ "$(uname)" == "Darwin" ]]; then
-            date -v-"${days_since_friday}d" -v16H -v0M -v0S +"%Y-%m-%dT%H:%M:%S%z"
-        else
-            date -d "$days_since_friday days ago 16:00:00" --iso-8601=seconds
-        fi
-    fi
-}
-
-# Fetch merged PRs since the cutoff date
-fetch_merged_prs() {
-    local since_date="$1"
-    local output_file="$2"
-
-    echo "Fetching PRs merged since: $since_date"
-
-    # Use gh to search for merged PRs
-    gh pr list \
-        --state merged \
-        --base main \
-        --json number,title,body,mergedAt,author \
-        --jq ".[] | select(.mergedAt >= \"$since_date\")" \
-        > "$output_file.json"
-
-    # Format the output nicely
-    echo "# Merged PRs since $since_date" > "$output_file"
-    echo "" >> "$output_file"
-
-    # Process each PR
-    jq -r '
-        "## PR #\(.number): \(.title)\n" +
-        "Author: \(.author.login)\n" +
-        "Merged: \(.mergedAt)\n\n" +
-        "### Description\n" +
-        (.body // "(No description)") +
-        "\n\n---\n"
-    ' "$output_file.json" >> "$output_file"
-
-    # Count PRs
-    local pr_count=$(jq -s 'length' "$output_file.json")
-    echo "Found $pr_count merged PRs"
-
-    rm -f "$output_file.json"
-
-    if [[ $pr_count -eq 0 ]]; then
-        echo "No PRs found since $since_date"
-        return 1
-    fi
-
-    return 0
-}
-
-# Generate synopsis using Claude
-generate_synopsis() {
-    local input_file="$1"
-    local output_file="$2"
-
-    echo "Generating synopsis with Claude..."
-
-    # Create a prompt file to avoid shell escaping issues
-    local prompt_file="/tmp/eagle0_prompt_$$.txt"
-    # Get repo URL for PR links
-    local repo_url=$(gh repo view --json url -q '.url')
-
-    cat > "$prompt_file" <<PROMPT_HEADER
-You are summarizing changes for a weekly engineering update email.
-
-Read the following list of merged PRs and create a concise synopsis grouped by theme/feature/area of the codebase.
-
-Structure:
-1. <h1> title (e.g., "Eagle0 Weekly Update")
-2. <h2>BLUF</h2> (Bottom Line Up Front) - A short prose paragraph (2-4 sentences) highlighting the 1-3 most important changes this week and what to look for when testing. This should be conversational and help readers quickly understand what matters most.
-3. Synopsis sections (<h2> headings with bullet point summaries)
-4. <hr> divider
-5. <h2>PR Details</h2> with the same groupings, but smaller (<h3> headings) and listing PR links
-   - Format each PR as: <a href="${repo_url}/pull/NUMBER">#NUMBER</a>: Title
-
-Guidelines for the SYNOPSIS sections:
-- Group related changes together under clear headings (use <h2> tags)
-- Use bullet points (<ul><li>) for individual changes
-- Highlight any significant new features, breaking changes, or important fixes
-- Keep the tone professional but accessible
-- Don't include PR numbers in the synopsis - focus on what changed and why it matters
-
-IMPORTANT: Output valid HTML that can be used directly in an email body. Do NOT wrap in \`\`\`html code blocks - just output the raw HTML.
-
-Here are the merged PRs:
-
-PROMPT_HEADER
-
-    cat "$input_file" >> "$prompt_file"
-    echo "" >> "$prompt_file"
-    echo "Generate the synopsis now:" >> "$prompt_file"
-
-    # Use Claude CLI to generate the synopsis, wrapped in proper HTML with charset
-    local raw_output="/tmp/eagle0_raw_$$.html"
-    cat "$prompt_file" | claude --print > "$raw_output"
-
-    # Wrap in HTML document with UTF-8 charset
-    cat > "$output_file" <<'HTML_HEAD'
-<!DOCTYPE html>
-<html>
-<head>
-<meta charset="utf-8">
-</head>
-<body>
-HTML_HEAD
-    cat "$raw_output" >> "$output_file"
-    echo "</body></html>" >> "$output_file"
-
-    rm -f "$prompt_file" "$raw_output"
-    echo "Synopsis generated at: $output_file"
-}
-
-# Get Fastmail session info (account ID, identity ID, drafts mailbox ID)
-get_fastmail_session() {
-    echo "Fetching Fastmail session info..." >&2
-
-    # Get session
-    local session=$(curl -s \
-        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
-        "https://api.fastmail.com/jmap/session")
-
-    # Extract account ID (first account)
-    FASTMAIL_ACCOUNT_ID=$(echo "$session" | jq -r '.primaryAccounts["urn:ietf:params:jmap:mail"]')
-
-    if [[ -z "$FASTMAIL_ACCOUNT_ID" || "$FASTMAIL_ACCOUNT_ID" == "null" ]]; then
-        echo "Error: Could not get Fastmail account ID. Check your API token." >&2
-        return 1
-    fi
-    echo "Account ID: $FASTMAIL_ACCOUNT_ID" >&2
-
-    # Get identity ID
-    local identity_response=$(curl -s \
-        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
-        -H "Content-Type: application/json" \
-        -X POST \
-        -d "{
-            \"using\": [\"urn:ietf:params:jmap:core\", \"urn:ietf:params:jmap:mail\", \"urn:ietf:params:jmap:submission\"],
-            \"methodCalls\": [
-                [\"Identity/get\", {\"accountId\": \"$FASTMAIL_ACCOUNT_ID\"}, \"0\"]
-            ]
-        }" \
-        "$FASTMAIL_API")
-
-    FASTMAIL_IDENTITY_ID=$(echo "$identity_response" | jq -r '.methodResponses[0][1].list[0].id')
-    FASTMAIL_FROM_EMAIL=$(echo "$identity_response" | jq -r '.methodResponses[0][1].list[0].email')
-
-    if [[ -z "$FASTMAIL_IDENTITY_ID" || "$FASTMAIL_IDENTITY_ID" == "null" ]]; then
-        echo "Error: Could not get Fastmail identity ID." >&2
-        return 1
-    fi
-    echo "Identity ID: $FASTMAIL_IDENTITY_ID (${FASTMAIL_FROM_EMAIL})" >&2
-
-    # Get drafts mailbox ID
-    local mailbox_response=$(curl -s \
-        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
-        -H "Content-Type: application/json" \
-        -X POST \
-        -d "{
-            \"using\": [\"urn:ietf:params:jmap:core\", \"urn:ietf:params:jmap:mail\"],
-            \"methodCalls\": [
-                [\"Mailbox/query\", {\"accountId\": \"$FASTMAIL_ACCOUNT_ID\", \"filter\": {\"role\": \"drafts\"}}, \"0\"]
-            ]
-        }" \
-        "$FASTMAIL_API")
-
-    FASTMAIL_DRAFTS_ID=$(echo "$mailbox_response" | jq -r '.methodResponses[0][1].ids[0]')
-
-    if [[ -z "$FASTMAIL_DRAFTS_ID" || "$FASTMAIL_DRAFTS_ID" == "null" ]]; then
-        echo "Error: Could not get Fastmail drafts mailbox ID." >&2
-        return 1
-    fi
-    echo "Drafts mailbox ID: $FASTMAIL_DRAFTS_ID" >&2
-
-    return 0
-}
-
-# Send email via Fastmail JMAP API
-send_email_fastmail() {
-    local synopsis_file="$1"
-    local recipients_json="$2"  # JSON array fragment: {"email": "a@b.com"}, {"email": "c@d.com"}
-
-    local subject="Eagle0 Weekly Changelog - $(date +%Y-%m-%d)"
-    local html_body=$(cat "$synopsis_file" | jq -Rs .)
-
-    echo "Sending email via Fastmail JMAP API..."
-
-    # Create the email and send it in one request
-    local response=$(curl -s \
-        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
-        -H "Content-Type: application/json" \
-        -X POST \
-        -d "{
-            \"using\": [
-                \"urn:ietf:params:jmap:core\",
-                \"urn:ietf:params:jmap:mail\",
-                \"urn:ietf:params:jmap:submission\"
-            ],
-            \"methodCalls\": [
-                [\"Email/set\", {
-                    \"accountId\": \"$FASTMAIL_ACCOUNT_ID\",
-                    \"create\": {
-                        \"draft\": {
-                            \"from\": [{\"email\": \"$FASTMAIL_FROM_EMAIL\"}],
-                            \"to\": [$recipients_json],
-                            \"subject\": \"$subject\",
-                            \"mailboxIds\": {\"$FASTMAIL_DRAFTS_ID\": true},
-                            \"keywords\": {\"\$draft\": true},
-                            \"htmlBody\": [{\"partId\": \"body\", \"type\": \"text/html\"}],
-                            \"bodyValues\": {
-                                \"body\": {
-                                    \"charset\": \"utf-8\",
-                                    \"value\": $html_body
-                                }
-                            }
-                        }
-                    }
-                }, \"0\"],
-                [\"EmailSubmission/set\", {
-                    \"accountId\": \"$FASTMAIL_ACCOUNT_ID\",
-                    \"onSuccessDestroyEmail\": [\"#sendIt\"],
-                    \"create\": {
-                        \"sendIt\": {
-                            \"emailId\": \"#draft\",
-                            \"identityId\": \"$FASTMAIL_IDENTITY_ID\"
-                        }
-                    }
-                }, \"1\"]
-            ]
-        }" \
-        "$FASTMAIL_API")
-
-    # Check for errors
-    local error=$(echo "$response" | jq -r '.methodResponses[0][1].notCreated.draft.description // empty')
-    if [[ -n "$error" ]]; then
-        echo "Error creating email: $error" >&2
-        echo "Full response: $response" >&2
-        return 1
-    fi
-
-    local send_error=$(echo "$response" | jq -r '.methodResponses[1][1].notCreated.sendIt.description // empty')
-    if [[ -n "$send_error" ]]; then
-        echo "Error sending email: $send_error" >&2
-        echo "Full response: $response" >&2
-        return 1
-    fi
-
-    echo "Email sent successfully"
-}
-
-# Update the tag to mark this run
-update_tag() {
-    echo "Updating $TAG_NAME tag..."
-
-    # Delete existing tag if present
-    git tag -d "$TAG_NAME" 2>/dev/null || true
-    git push origin --delete "$TAG_NAME" 2>/dev/null || true
-
-    # Create new tag at HEAD
-    git tag "$TAG_NAME"
-    git push origin "$TAG_NAME"
-
-    echo "Tag updated to current HEAD"
-}
-
-# Main
-main() {
-    echo "=== Eagle0 Weekly Changelog Generator ==="
-    echo ""
-
-    # Load API token (only required for actual send)
-    if [[ "$DRY_RUN" != "true" ]]; then
-        if ! load_api_token; then
-            echo "Error: No Fastmail API token found."
-            echo ""
-            echo "To create a token:"
-            echo "1. Go to Fastmail Settings -> Password & Security -> API tokens"
-            echo "2. Create a new token with 'Email submission' scope"
-            echo "3. Save it using one of these methods:"
-            echo ""
-            echo "   Option A (recommended): Store in config file"
-            echo "     mkdir -p ~/.config/eagle0"
-            echo "     echo 'your-token' > ~/.config/eagle0/fastmail_token"
-            echo "     chmod 600 ~/.config/eagle0/fastmail_token"
-            echo ""
-            echo "   Option B: Set environment variable"
-            echo "     export FASTMAIL_API_TOKEN='your-token'"
-            exit 1
-        fi
-    fi
-
-    # Get cutoff date
-    local cutoff_date=$(get_cutoff_date)
-    echo "Cutoff date: $cutoff_date"
-
-    # Create temp files
-    local pr_file="/tmp/eagle0_prs_$(date +%s).md"
-    local synopsis_file="/tmp/eagle0_synopsis_$(date +%s).html"
-
-    # Fetch PRs
-    if ! fetch_merged_prs "$cutoff_date" "$pr_file"; then
-        echo "No changes to report. Exiting."
-        exit 0
-    fi
-
-    echo ""
-    echo "PR details saved to: $pr_file"
-
-    # Generate synopsis
-    generate_synopsis "$pr_file" "$synopsis_file"
-
-    if [[ "$DRY_RUN" == "true" ]]; then
-        echo ""
-        echo "=== DRY RUN - Synopsis content ==="
-        cat "$synopsis_file"
-        echo ""
-        echo "=== DRY RUN - Skipping email send and tag update ==="
-    else
-        # Get Fastmail session info
-        if ! get_fastmail_session; then
-            echo "Failed to get Fastmail session info. Exiting."
-            exit 1
-        fi
-
-        # Determine recipients (from config file, or default to sender)
-        local recipients_json=$(load_recipients_json)
-        if [[ -z "$recipients_json" ]]; then
-            recipients_json="{\"email\": \"$FASTMAIL_FROM_EMAIL\"}"
-            echo "No recipients configured, sending to self ($FASTMAIL_FROM_EMAIL)"
-        else
-            local recipients_display=$(load_recipients_display)
-            echo "Sending to: $recipients_display"
-        fi
-
-        # Send email
-        send_email_fastmail "$synopsis_file" "$recipients_json"
-
-        # Update tag for next run
-        update_tag
-    fi
-
-    echo ""
-    echo "Done!"
-    echo "PR details: $pr_file"
-    echo "Synopsis: $synopsis_file"
-}
-
-main

scripts/pre-commit-gazelle.sh

@@ -1,19 +0,0 @@
-#!/bin/bash
-# Pre-commit hook wrapper for gazelle that fails if files are modified.
-# This ensures BUILD files are in canonical format before committing.
-
-set -e
-
-# Run gazelle
-bazel run //:gazelle 2>/dev/null
-
-# Check if any BUILD files were modified
-if ! git diff --quiet -- '*.bazel' '**/BUILD' 'WORKSPACE*'; then
-    echo ""
-    echo "ERROR: gazelle modified BUILD files. Please stage the changes and retry:"
-    echo ""
-    git diff --name-only -- '*.bazel' '**/BUILD' 'WORKSPACE*'
-    echo ""
-    echo "Run: git add -u && git commit"
-    exit 1
-fi

scripts/setup_droplet.sh

@@ -1,149 +0,0 @@
-#!/bin/bash
-#
-# Setup script for Eagle0 production droplet
-# Run this on a fresh DigitalOcean droplet (Ubuntu 24.04)
-#
-# Usage: curl -sSL https://raw.githubusercontent.com/nolen777/eagle0/main/scripts/setup_droplet.sh | sudo bash
-#
-
-set -euo pipefail
-
-DOMAIN="${DOMAIN:-eagle0.net}"
-DEPLOY_USER="${DEPLOY_USER:-deploy}"
-APP_DIR="/opt/eagle0"
-
-echo "=== Eagle0 Production Server Setup ==="
-echo "Domain: ${DOMAIN}"
-echo "Deploy user: ${DEPLOY_USER}"
-echo ""
-
-# Check if running as root
-if [[ $EUID -ne 0 ]]; then
-   echo "This script must be run as root (use sudo)"
-   exit 1
-fi
-
-echo "=== Updating system ==="
-apt-get update
-apt-get upgrade -y
-
-echo "=== Installing Docker ==="
-if ! command -v docker &> /dev/null; then
-    curl -fsSL https://get.docker.com | sh
-    systemctl enable docker
-    systemctl start docker
-else
-    echo "Docker already installed"
-fi
-
-echo "=== Installing Docker Compose plugin ==="
-apt-get install -y docker-compose-plugin
-
-echo "=== Installing additional utilities ==="
-apt-get install -y \
-    curl \
-    wget \
-    git \
-    netcat-openbsd \
-    jq \
-    htop \
-    unattended-upgrades
-
-echo "=== Configuring automatic security updates ==="
-cat > /etc/apt/apt.conf.d/20auto-upgrades << 'EOF'
-APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Unattended-Upgrade "1";
-APT::Periodic::AutocleanInterval "7";
-EOF
-
-echo "=== Creating deploy user ==="
-if ! id "${DEPLOY_USER}" &>/dev/null; then
-    useradd -m -s /bin/bash -G docker "${DEPLOY_USER}"
-    mkdir -p "/home/${DEPLOY_USER}/.ssh"
-    chmod 700 "/home/${DEPLOY_USER}/.ssh"
-    chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "/home/${DEPLOY_USER}/.ssh"
-    echo ""
-    echo "*** IMPORTANT: Add your SSH public key to /home/${DEPLOY_USER}/.ssh/authorized_keys ***"
-    echo ""
-else
-    echo "User ${DEPLOY_USER} already exists"
-    # Ensure user is in docker group
-    usermod -aG docker "${DEPLOY_USER}"
-fi
-
-echo "=== Creating application directory ==="
-mkdir -p "${APP_DIR}"/{nginx,certbot/conf,certbot/www,saves}
-chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "${APP_DIR}"
-
-echo "=== Configuring Docker registry authentication ==="
-echo ""
-echo "*** IMPORTANT: Run the following command to authenticate with DigitalOcean Container Registry: ***"
-echo "  docker login registry.digitalocean.com"
-echo ""
-
-echo "=== Creating systemd service ==="
-cat > /etc/systemd/system/eagle0.service << EOF
-[Unit]
-Description=Eagle0 Game Servers
-Requires=docker.service
-After=docker.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-WorkingDirectory=${APP_DIR}
-ExecStart=/usr/bin/docker compose -f docker-compose.prod.yml up -d
-ExecStop=/usr/bin/docker compose -f docker-compose.prod.yml down
-User=${DEPLOY_USER}
-Group=${DEPLOY_USER}
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl daemon-reload
-systemctl enable eagle0
-
-echo "=== Configuring firewall (UFW) ==="
-if ! command -v ufw &> /dev/null; then
-    apt-get install -y ufw
-fi
-
-ufw default deny incoming
-ufw default allow outgoing
-ufw allow ssh
-ufw allow 80/tcp
-ufw allow 443/tcp
-ufw --force enable
-
-echo "=== Setting up log rotation ==="
-cat > /etc/logrotate.d/eagle0 << EOF
-/var/log/eagle0/*.log {
-    daily
-    missingok
-    rotate 14
-    compress
-    delaycompress
-    notifempty
-    create 0640 ${DEPLOY_USER} ${DEPLOY_USER}
-    sharedscripts
-}
-EOF
-
-mkdir -p /var/log/eagle0
-chown "${DEPLOY_USER}:${DEPLOY_USER}" /var/log/eagle0
-
-echo ""
-echo "=== Setup Complete ==="
-echo ""
-echo "Next steps:"
-echo "1. Add SSH public key to /home/${DEPLOY_USER}/.ssh/authorized_keys"
-echo "2. Copy docker-compose.prod.yml to ${APP_DIR}/"
-echo "3. Copy nginx/nginx.conf to ${APP_DIR}/nginx/"
-echo "4. Create .env file in ${APP_DIR}/ with OPENAI_API_KEY"
-echo "5. Run: docker login registry.digitalocean.com"
-echo "6. Get SSL certificate: (see init_ssl.sh)"
-echo "7. Start services: systemctl start eagle0"
-echo ""
-echo "Server IP: $(curl -s ifconfig.me)"
-echo ""

scripts/updateActionResultTypes.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+bazel run //src/main/go/net/eagle0/build/action_result_type_build_file_generator \
+  ${PWD}/src/main/scala/net/eagle0/eagle/model/action_result/types/

scripts/warmup-eagle.sh

@@ -1,142 +0,0 @@
-#!/bin/bash
-#
-# Warmup Script for Eagle Server
-#
-# This script warms up the JIT compiler before switching traffic to a new instance.
-# It uses the Go warmup tool which:
-# 1. Creates a test game via bidirectional streaming
-# 2. Posts an Improve command
-# 3. Verifies action results and new commands
-# 4. Cleans up the test game
-#
-# Usage: ./warmup-eagle.sh HOST:PORT
-#
-# Example:
-#   ./warmup-eagle.sh localhost:40032
-#   ./warmup-eagle.sh localhost:40034
-#
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-
-log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
-log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
-log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
-
-HOST="${1:-localhost:40032}"
-
-log_info "Warming up Eagle server at ${HOST}..."
-
-# Try to find the Go warmup tool
-WARMUP_TOOL=""
-
-# Check if we're in the project directory with bazel
-if [ -f "${PROJECT_ROOT}/WORKSPACE" ] || [ -f "${PROJECT_ROOT}/WORKSPACE.bazel" ]; then
-    # Try to find the pre-built binary
-    BAZEL_BIN="${PROJECT_ROOT}/bazel-bin/src/main/go/net/eagle0/warmup/warmup_/warmup"
-    if [ -x "${BAZEL_BIN}" ]; then
-        WARMUP_TOOL="${BAZEL_BIN}"
-    fi
-fi
-
-# Check for the warmup tool in common locations (for deployed environments)
-if [ -z "${WARMUP_TOOL}" ]; then
-    for path in \
-        "${SCRIPT_DIR}/bin/warmup" \
-        "/opt/eagle0/scripts/bin/warmup" \
-        "/opt/eagle0/bin/warmup" \
-        "/usr/local/bin/eagle-warmup" \
-        "${SCRIPT_DIR}/warmup"; do
-        if [ -x "${path}" ]; then
-            WARMUP_TOOL="${path}"
-            break
-        fi
-    done
-fi
-
-# If we found the Go tool, use it
-if [ -n "${WARMUP_TOOL}" ]; then
-    log_info "Using Go warmup tool: ${WARMUP_TOOL}"
-    if "${WARMUP_TOOL}" --address="${HOST}" --timeout=60s; then
-        log_info "Warmup complete!"
-        exit 0
-    else
-        log_error "Go warmup tool failed"
-        exit 1
-    fi
-fi
-
-# Fallback to grpcurl-based warmup
-log_warn "Go warmup tool not found, falling back to grpcurl"
-
-# Check for grpcurl
-if ! command -v grpcurl &> /dev/null; then
-    log_error "Neither Go warmup tool nor grpcurl is available"
-    log_error "Build the warmup tool with: bazel build //src/main/go/net/eagle0/warmup"
-    log_error "Or install grpcurl: brew install grpcurl (macOS)"
-    exit 1
-fi
-
-# Warmup iterations
-WARMUP_ITERATIONS=3
-
-# 1. Call GetRunningGames multiple times - this exercises the gRPC layer and basic game access
-log_info "Warming up GetRunningGames..."
-for i in $(seq 1 ${WARMUP_ITERATIONS}); do
-    RESULT=$(grpcurl -plaintext -d '{}' "${HOST}" net.eagle0.eagle.api.Eagle/GetRunningGames 2>&1) || true
-    if echo "$RESULT" | grep -q "games\|{}"; then
-        echo -n "."
-    else
-        log_error "GetRunningGames failed on iteration $i"
-        exit 1
-    fi
-done
-echo " done"
-
-# 2. Call GetSettings - exercises settings loading
-log_info "Warming up GetSettings..."
-for i in $(seq 1 ${WARMUP_ITERATIONS}); do
-    if grpcurl -plaintext -d '{}' "${HOST}" net.eagle0.eagle.api.Eagle/GetSettings > /dev/null 2>&1; then
-        echo -n "."
-    else
-        log_warn "GetSettings failed on iteration $i (non-fatal)"
-    fi
-done
-echo " done"
-
-# 3. Call AddSettings with empty list - exercises settings path
-log_info "Warming up AddSettings..."
-for i in $(seq 1 ${WARMUP_ITERATIONS}); do
-    if grpcurl -plaintext -d '{"settings": []}' "${HOST}" net.eagle0.eagle.api.Eagle/AddSettings > /dev/null 2>&1; then
-        echo -n "."
-    else
-        log_warn "AddSettings failed on iteration $i (non-fatal)"
-    fi
-done
-echo " done"
-
-# Final health check
-log_info "Verifying server health..."
-if grpcurl -plaintext -d '{}' "${HOST}" net.eagle0.eagle.api.Eagle/GetRunningGames > /dev/null 2>&1; then
-    log_info "Health check passed"
-else
-    log_error "Health check failed"
-    exit 1
-fi
-
-log_info ""
-log_info "Warmup complete (basic mode - bidirectional streaming warmup not available)!"
-log_info "The JIT should be warmed for:"
-log_info "  - gRPC layer and protobuf parsing"
-log_info "  - Settings loading and management"
-log_info ""
-log_warn "Note: For full warmup including game creation and command processing,"
-log_warn "      build and use the Go warmup tool: bazel build //src/main/go/net/eagle0/warmup"

src/main/cpp/net/eagle0/common/FilesystemUtils.cpp

@@ -26,13 +26,6 @@ namespace fs = std::filesystem;
 static string rLocation;
 
 auto rloc(const string& execPath) -> string {
-    // First check for environment variable override for Docker deployment
-    const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
-    if (resourcesPath != nullptr) {
-        return "";  // Return empty so StaticShardokFilesDirectory uses env var directly
-    }
-
-    // Fall back to Bazel runfiles for development
     string error;
     const std::unique_ptr<Runfiles> runfiles(Runfiles::Create(execPath, &error));
 
@@ -65,14 +58,10 @@ auto FilesystemUtils::FileExistsAtPath(const string& path) -> bool { return fs::
 auto FilesystemUtils::StaticEagle0FilesDirectory() -> string { return "/usr/local/share/eagle0/"; }
 
 auto FilesystemUtils::StaticShardokFilesDirectory() -> string {
-    const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
-    if (resourcesPath != nullptr) { return string(resourcesPath) + "/"; }
     return rLocation + "/src/main/resources/net/eagle0/shardok/";
 }
 
 auto FilesystemUtils::MapFilesDirectory() -> string {
-    const char* mapsPath = getenv("SHARDOK_MAPS_PATH");
-    if (mapsPath != nullptr) { return string(mapsPath) + "/"; }
     return StaticShardokFilesDirectory() + "maps/";
 }
 

src/main/cpp/net/eagle0/common/IterableBitset.hpp

@@ -7,7 +7,6 @@
 
 #include <algorithm>
 #include <bit>
-#include <cstdint>
 #include <cstdlib>
 
 #define ITERABLE_BITSET_INDEX_CHECKS false

src/main/cpp/net/eagle0/common/MapUtils.cpp

@@ -9,7 +9,6 @@
 #include "MapUtils.hpp"
 
 #include <algorithm>
-#include <stdexcept>
 
 static inline std::string StringForKey(
         const std::unordered_map<std::string, std::string>& map,

src/main/cpp/net/eagle0/common/SequenceRandomGenerator.hpp

@@ -20,8 +20,14 @@
 // Values in the sequence are treated as [0, 1] probabilities that are returned
 // by DoubleZeroToOne(). The normal percentile methods (including open-ended
 // variants) work as usual, so callers must provide appropriate sequences.
-// For example, to get an open-ended low result of -50, provide [0.02, 0.52]
-// which produces: initial=2 (triggers open-ended), accumulated=52, final=2-52=-50
+//
+// Open-ended percentile example:
+// To get an open-ended low result of -50, provide [0.02, 0.52]:
+//   1. First call returns 0.02 → Percentile() converts to 2
+//   2. Since 2 < 5, triggers open-ended LOW: result = initial - OpenEndedHighImpl()
+//   3. Second call returns 0.52 → Percentile() converts to 52
+//   4. Since 52 < 95, accumulation stops with total = 52
+//   5. Final result: 2 - 52 = -50
 class SequenceRandomGenerator : public ::RandomGenerator {
 private:
     const std::vector<double> sequence;

src/main/cpp/net/eagle0/common/byte_vector.hpp

@@ -9,7 +9,6 @@
 #ifndef byte_vector_h
 #define byte_vector_h
 
-#include <cstdint>
 #include <cstring>
 #include <fstream>
 #include <sstream>

src/main/cpp/net/eagle0/common/mcts/abstract/AbstractMCTSAI.cpp

@@ -5,7 +5,6 @@
 #include "AbstractMCTSAI.hpp"
 
 #include <algorithm>
-#include <chrono>
 #include <fstream>
 #include <future>
 #include <iomanip>
@@ -85,7 +84,7 @@ auto AbstractMCTSAI::Search(
         LogSearchResults(rootNode.get(), bestChild, result);
     }
 
-    // Dump tree if explicitly requested via config
+    // Dump tree if requested
     if (!config_.debugDumpPath.empty()) { DumpTreeToFile(rootNode.get(), config_.debugDumpPath); }
 
     return result;
@@ -130,37 +129,6 @@ auto AbstractMCTSAI::BuildMCTSTree(
     // Initialize action counter
     root->totalActions = rootActions.size();
 
-    // CRITICAL: Do at least one expansion before entering the time-bounded loop.
-    // This ensures we always have at least one child to return, even if the deadline
-    // has already passed (e.g., due to debugger pause, system load, etc.)
-    {
-        auto* selected = MCTSSelection(root.get());
-        const bool selectedIsRoot = (selected == root.get());
-        const size_t childrenBeforeExpansion = root->children.size();
-
-        if (selected) {
-            auto* expanded = MCTSExpansion(selected, engine);
-            const double reward =
-                    MCTSSimulation(engine, *expanded->gameState, playerId_, expanded->playerFlips);
-            MCTSBackpropagation(expanded, reward, config_.backpropagationPolicy);
-        }
-
-        // Verify we actually have at least one child after the initial expansion
-        if (root->children.empty()) {
-            throw MCTSInternalError(
-                    "MCTS BuildMCTSTree: Initial expansion failed to produce any children. "
-                    "totalActions=" +
-                    std::to_string(root->totalActions) +
-                    ", selected=" + (selected ? "non-null" : "null") +
-                    ", selectedIsRoot=" + (selectedIsRoot ? "true" : "false") +
-                    ", childrenBefore=" + std::to_string(childrenBeforeExpansion) +
-                    ", childrenAfter=" + std::to_string(root->children.size()) +
-                    ", root->CanExpand()=" + (root->CanExpand() ? "true" : "false") +
-                    ", root->nextUntriedActionIndex=" +
-                    std::to_string(root->nextUntriedActionIndex));
-        }
-    }
-
     std::atomic<int> iterations{0};
 
     if (config_.useMultithreading && config_.numThreads > 1) {
@@ -237,19 +205,10 @@ auto AbstractMCTSAI::BuildMCTSTree(
 auto AbstractMCTSAI::MCTSSelection(MCTSNode* root) const -> MCTSNode* {
     MCTSNode* current = root;
 
-    while (current->depth < config_.maxTreeDepth) {
-        // Check expansion FIRST - allows expanding "terminal" nodes that still have
-        // untried actions (e.g., final round where we need to pick an action)
+    while (!current->isTerminal && current->depth < config_.maxTreeDepth) {
         if (current->CanExpand()) {
             return current;  // Node has untried actions/outcomes
-        }
-
-        // Only after expansion check: stop if terminal and fully expanded
-        if (current->isTerminal) {
-            break;  // Terminal and no more actions to try
-        }
-
-        if (!current->children.empty()) {
+        } else if (!current->children.empty()) {
             // Choose child based on node type
             if (current->IsChanceNode()) {
                 // Chance nodes: select outcome proportional to probability
@@ -269,9 +228,7 @@ auto AbstractMCTSAI::MCTSSelection(MCTSNode* root) const -> MCTSNode* {
 
 auto AbstractMCTSAI::MCTSExpansion(MCTSNode* node, const MCTSGameEngine& engine) const
         -> MCTSNode* {
-    // Only skip if we truly can't expand. Allow expansion even if "terminal" as long as
-    // there are untried actions (e.g., final round where we need to pick an action).
-    if (!node->CanExpand()) {
+    if (!node->CanExpand() || node->isTerminal) {
         return node;  // Nothing to expand
     }
 
@@ -436,8 +393,10 @@ auto AbstractMCTSAI::MCTSExpansion(MCTSNode* node, const MCTSGameEngine& engine)
         // (since chance nodes have parent's gameState), which is wrong. We need to simulate
         // from an actual outcome state.
         //
-        // Note: This recursion is bounded because outcome children are decision nodes,
-        // not chance nodes, so the recursion goes exactly one level deep.
+        // Note: This recursion is bounded because:
+        // 1. Chance nodes only have binary outcomes (success/failure)
+        // 2. Outcome children are decision nodes, not chance nodes
+        // 3. So the recursion goes exactly one level deep
         return MCTSExpansion(node->children.back().get(), engine);
     }
 

src/main/cpp/net/eagle0/common/mcts/abstract/MCTSGameEngine.hpp

@@ -16,39 +16,28 @@
 namespace shardok {
 namespace mcts {
 
-// Information about chance outcomes (supports both binary and multi-outcome)
-struct ChanceOutcomeInfo {
-    std::vector<double> probabilities;  // Probability of each outcome (must sum to 1.0)
-    std::vector<double> rolls;          // Roll values for each outcome
+// Information about binary chance outcomes (success/failure)
+struct BinaryOutcomeInfo {
+    double successProbability;  // Probability of success (0.0 to 1.0)
 
-    // Factory for binary success/failure outcomes (e.g., START_FIRE)
-    [[nodiscard]] static ChanceOutcomeInfo binary(double successProbability) {
+    // Returns extreme roll values that guarantee success/failure against any threshold.
+    //
+    // NOTE: These are not truly "representative" rolls - they guarantee outcomes rather
+    // than simulating typical rolls. Some commands have variance beyond success/failure
+    // (e.g., BUILD_BRIDGE quality depends on roll margin). This simplification ignores
+    // that variance. If outcome quality matters for AI decisions, we may need to revisit
+    // this approach with actual representative rolls based on the command's threshold.
+    [[nodiscard]] static std::vector<double> getRepresentativeRolls() {
         // -100: triggers open-ended low sequence, succeeds against any threshold
         // 150: triggers open-ended high sequence, fails against any threshold
-        return {{successProbability, 1.0 - successProbability}, {-100.0, 150.0}};
+        return {-100.0, 150.0};
     }
 
-    // Factory for multi-outcome with fixed seeds (e.g., END_TURN)
-    // Uses uniformly distributed roll values to sample different random outcomes
-    [[nodiscard]] static ChanceOutcomeInfo multiOutcome(int numOutcomes) {
-        std::vector<double> probs(numOutcomes, 1.0 / numOutcomes);
-        std::vector<double> rollValues;
-        rollValues.reserve(numOutcomes);
-        // Spread rolls across the percentile range: 10, 30, 50, 70, 90 for 5 outcomes
-        for (int i = 0; i < numOutcomes; ++i) {
-            rollValues.push_back(10.0 + (80.0 * i) / (numOutcomes - 1));
-        }
-        return {probs, rollValues};
+    [[nodiscard]] std::vector<double> getProbabilities() const {
+        return {successProbability, 1.0 - successProbability};
     }
-
-    [[nodiscard]] const std::vector<double>& getRepresentativeRolls() const { return rolls; }
-
-    [[nodiscard]] const std::vector<double>& getProbabilities() const { return probabilities; }
 };
 
-// Backward compatibility alias
-using BinaryOutcomeInfo = ChanceOutcomeInfo;
-
 // Abstract interface for game engines
 class MCTSGameEngine {
 public:

src/main/cpp/net/eagle0/common/mcts/abstract/MCTSNode.hpp

@@ -223,6 +223,7 @@ struct MCTSNode {
     }
 
     // Get best child based on visit count (for final selection)
+    // Uses "robust child selection with score-based tie-breaking" when visits are close
     [[nodiscard]] MCTSNode* GetBestFinalChild() const {
         if (children.empty()) return nullptr;
 
@@ -231,22 +232,34 @@ struct MCTSNode {
         double bestScore = isMaximizingPlayer ? -std::numeric_limits<double>::max()
                                               : std::numeric_limits<double>::max();
 
+        // When visit counts are within this margin, use lookahead score to decide
+        // This handles cases where multiple actions have similar visit counts due to
+        // UCB exploration spreading visits across many equivalent options
+        constexpr double kVisitMarginRatio = 0.10;  // 10% margin
+
         for (const auto& child : children) {
             // Skip redundant nodes
             if (child->isRedundant) continue;
 
-            // Prefer most-visited node (robust child selection)
-            if (child->visitCount > bestVisits) {
+            // Calculate if visits are "effectively equal" to best
+            // Two children are effectively equal if their visits are within 10% of each other
+            const bool visitsEffectivelyEqual =
+                    bestVisits > 0 && std::abs(child->visitCount - bestVisits) <=
+                                              static_cast<int>(bestVisits * kVisitMarginRatio);
+
+            if (child->visitCount > bestVisits && !visitsEffectivelyEqual) {
+                // Clear winner by visit count - use this child
                 bestVisits = child->visitCount;
                 bestScore = child->lookaheadScore;
                 bestChild = child.get();
-            } else if (child->visitCount == bestVisits) {
-                // Tie-break on lookahead score (minimax value, not poisoned average)
+            } else if (child->visitCount >= bestVisits || visitsEffectivelyEqual) {
+                // Visits are close enough - use lookahead score to decide
                 // Maximizing: prefer higher score (better for root player)
                 // Minimizing: prefer lower score (worse for root player)
                 const bool shouldReplace = isMaximizingPlayer ? (child->lookaheadScore > bestScore)
                                                               : (child->lookaheadScore < bestScore);
                 if (shouldReplace) {
+                    bestVisits = child->visitCount;
                     bestScore = child->lookaheadScore;
                     bestChild = child.get();
                 }

src/main/cpp/net/eagle0/shardok/BUILD.bazel

@@ -14,7 +14,6 @@ cc_library(
         "//src/main/cpp/net/eagle0/shardok/library:engine",
         "//src/main/cpp/net/eagle0/shardok/server:eagle_interface_grpc_server",
         "//src/main/cpp/net/eagle0/shardok/server:server_configuration",
-        "//src/main/cpp/net/eagle0/shardok/server:token_auth",
         "//src/main/protobuf/net/eagle0/common:common_unit_cc_proto",
         "@grpc//:grpc++",
     ],

src/main/cpp/net/eagle0/shardok/ai/AIHeuristicWeighting.cpp

@@ -222,6 +222,7 @@ double AIHeuristicWeighting::GetCommandWeight(
         case CommandType::RELEASE_UNIT_COMMAND: return 0.0;
 
         case CommandType::REINFORCE_COMMAND: return 10.0;
+        case CommandType::MANAGE_PRISONER: return 1.0;
 
         // === ZERO WEIGHT - NEVER SELECT (0.0) ===
         // Explicitly bad actions

src/main/cpp/net/eagle0/shardok/ai/AITimeBudget.cpp

@@ -25,8 +25,7 @@ auto CalculateTimeBudget(
         const PlayerId playerId,
         const GameSettingsSPtr &settings,
         const GameStateW &state,
-        const size_t numCommands,
-        const bool isAllAiBattle) -> AITimeBudget {
+        const size_t numCommands) -> AITimeBudget {
     const auto settingsGetter = settings->GetGetter();
     const auto castleCoords = AllCastleCoords(state->hex_map());
 
@@ -35,10 +34,8 @@ auto CalculateTimeBudget(
                               net::eagle0::shardok::storage::fb::GameStatus_::State_SET_UP;
 
     // Get maximum budget cap from settings (in seconds)
-    // For all-AI battles, use the faster budget limit
     const double maxBudgetSeconds =
-            isAllAiBattle ? settingsGetter.Backing().all_ai_battle_time_budget_maximum()
-                          : settingsGetter.Backing().lookahead_time_budget_maximum_seconds();
+            settingsGetter.Backing().lookahead_time_budget_maximum_seconds();
     const double maxBudgetMs = maxBudgetSeconds * 1000.0;
 
     // During setup, use the setup-specific time budget

src/main/cpp/net/eagle0/shardok/ai/AITimeBudget.hpp

@@ -38,13 +38,11 @@ struct AITimeBudget {
 // Calculate time budget based on proximity to enemies and castles
 // Time budget is calculated dynamically based on number of available commands:
 //   budget = msPerCommand × numCommands (clamped to 200-5000ms)
-// If isAllAiBattle is true, uses allAiBattleTimeBudgetMaximum instead of the normal maximum.
 auto CalculateTimeBudget(
         PlayerId playerId,
         const GameSettingsSPtr &settings,
         const GameStateW &state,
-        size_t numCommands,
-        bool isAllAiBattle) -> AITimeBudget;
+        size_t numCommands) -> AITimeBudget;
 
 }  // namespace shardok
 

src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.cpp

@@ -53,7 +53,6 @@ auto RoundsRemaining(const GameSettingsSPtr &settings, const GameStateView &gsv)
 ShardokAIClient::ShardokAIClient(
         const PlayerId playerId,
         const bool isDefender,
-        const bool isAllAiBattle,
         const HexMap *hexMap,
         const SettingsGetter &settings,
         const AIAlgorithmType aiAlgorithmType,
@@ -61,7 +60,6 @@ ShardokAIClient::ShardokAIClient(
         const mcts::MCTSConfig &mctsConfig)
     : playerId(playerId),
       isDefender(isDefender),
-      isAllAiBattle(isAllAiBattle),
       aiAlgorithmType(aiAlgorithmType),
       scoringCalculatorType(scoringCalculatorType),
       alCache(std::make_unique<AttackLocationsCache>(hexMap, settings)),
@@ -137,8 +135,7 @@ auto ShardokAIClient::StandardChooseCommandIndex(
     const auto commandCount = guessedCommands->size();
 
     // Calculate time budget based on game situation using new dynamic per-command settings
-    const auto timeBudget =
-            CalculateTimeBudget(playerId, settings, guessedState, commandCount, isAllAiBattle);
+    const auto timeBudget = CalculateTimeBudget(playerId, settings, guessedState, commandCount);
 
     // Configure MCTS based on proximity to enemy
     // When far from enemy: use AVERAGING with maxPlayerFlips=0 (single-player lookahead)

src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.hpp

@@ -41,7 +41,6 @@ class ShardokAIClient {
 private:
     const PlayerId playerId;
     const bool isDefender;
-    const bool isAllAiBattle;  // Whether this battle has only AI players (for faster time budgets)
     const AIAlgorithmType aiAlgorithmType;
     const ScoringCalculatorType scoringCalculatorType;
 
@@ -66,11 +65,15 @@ private:
             const GameStateW& guessedState,
             const CommandListSPtr& realAvailableCommands) const -> CommandChoiceResults;
 
+    [[nodiscard]] auto ChooseCommandIndex(
+            const GameSettingsSPtr& settings,
+            const net::eagle0::shardok::api::GameStateView& gsv,
+            const CommandListSPtr& realAvailableCommands) const -> CommandChoiceResults;
+
 public:
     explicit ShardokAIClient(
             PlayerId playerId,
             bool isDefender,
-            bool isAllAiBattle,
             const HexMap* hexMap,
             const SettingsGetter& settings,
             AIAlgorithmType aiAlgorithmType,
@@ -83,12 +86,6 @@ public:
     [[nodiscard]] auto ChooseCommandIndex(const ShardokEngine& engine) const
             -> CommandChoiceResults;
 
-    // Overload that works on copies of state - allows caller to release lock during AI thinking
-    [[nodiscard]] auto ChooseCommandIndex(
-            const GameSettingsSPtr& settings,
-            const net::eagle0::shardok::api::GameStateView& gsv,
-            const CommandListSPtr& realAvailableCommands) const -> CommandChoiceResults;
-
     // MCTS configuration methods (only relevant when using MCTS algorithm)
     [[nodiscard]] auto GetMCTSConfig() const -> const mcts::MCTSConfig& { return mctsConfig; }
     void SetMCTSConfig(const mcts::MCTSConfig& config) { mctsConfig = config; }

src/main/cpp/net/eagle0/shardok/ai/TranspositionTable.cpp

@@ -4,7 +4,6 @@
 
 #include "TranspositionTable.hpp"
 
-#include <cinttypes>
 #include <cstdio>
 #include <cstring>
 
@@ -102,10 +101,10 @@ void TranspositionTable::clear() {
 
 void TranspositionTable::printStats() const {
     printf("TranspositionTable Stats:\n");
-    printf("  Probes: %" PRIu64 "\n", stats.probes.load());
-    printf("  Hits: %" PRIu64 " (%.1f%%)\n", stats.hits.load(), stats.hitRate());
-    printf("  Stores: %" PRIu64 "\n", stats.stores.load());
-    printf("  Collisions: %" PRIu64 "\n", stats.collisions.load());
+    printf("  Probes: %llu\n", stats.probes.load());
+    printf("  Hits: %llu (%.1f%%)\n", stats.hits.load(), stats.hitRate());
+    printf("  Stores: %llu\n", stats.stores.load());
+    printf("  Collisions: %llu\n", stats.collisions.load());
     printf("  Table size: %zu entries (%.1f MB)\n",
            TABLE_SIZE,
            (TABLE_SIZE * sizeof(TTEntry)) / (1024.0 * 1024.0));

src/main/cpp/net/eagle0/shardok/ai/mcts/adapters/BUILD.bazel

@@ -32,7 +32,6 @@ cc_library(
         "//src/main/cpp/net/eagle0/shardok/library:engine",
         "//src/main/cpp/net/eagle0/shardok/library:game_state_w",
         "//src/main/cpp/net/eagle0/shardok/library/settings:game_settings",
-        "//src/main/protobuf/net/eagle0/shardok/common:command_type_cc_proto",
     ],
 )
 

src/main/cpp/net/eagle0/shardok/ai/mcts/adapters/ShardokAction.cpp

@@ -67,22 +67,8 @@ bool ShardokAction::equals(const MCTSAction& other) const {
 }
 
 bool ShardokAction::requiresChanceNode() const {
-    // Actions with probabilistic outcomes require chance nodes:
-    // 1. Binary success/failure actions (hasOdds_): START_FIRE, FEAR, etc.
-    // 2. END_TURN: random effects (fire spread, weather changes)
-    // 3. Combat actions: roll affects damage dealt (MELEE, ARCHERY, CHARGE, DUEL)
-    if (hasOdds_) { return true; }
-
-    using namespace net::eagle0::shardok::common;
-    switch (type_) {
-        case END_TURN_COMMAND:
-        case MELEE_COMMAND:
-        case ARCHERY_COMMAND:
-        case CHARGE_COMMAND:
-        case CHALLENGE_DUEL_COMMAND:
-        case REDUCE_COMMAND: return true;
-        default: return false;
-    }
+    // Actions with probabilistic outcomes require chance nodes
+    return hasOdds_;
 }
 
 }  // namespace shardok::mcts

src/main/cpp/net/eagle0/shardok/ai/mcts/adapters/ShardokGameEngine.cpp

@@ -98,9 +98,16 @@ std::unique_ptr<MCTSGameState> ShardokGameEngine::applyAction(
     // Any other value (including negative) creates a deterministic generator
     // For open-ended percentile commands, we compute a sequence of values that will
     // produce the desired final result through the normal open-ended mechanics
+    //
+    // IMPORTANT: Do NOT use deterministic rolls for END_TURN commands because they can
+    // trigger cascade actions (like MeteorCastAction) that need multiple random values.
+    // The SequenceRandomGenerator would wrap around and produce invalid values, causing crashes.
     std::shared_ptr<::RandomGenerator> randomGen = nullptr;
     constexpr double kNoRollSentinel = -1.0;
-    if (deterministicRoll != kNoRollSentinel) {
+    const bool isEndTurn =
+            shardokAction->getType() ==
+            static_cast<int>(net::eagle0::shardok::common::CommandType::END_TURN_COMMAND);
+    if (deterministicRoll != kNoRollSentinel && !isEndTurn) {
         std::vector<double> sequence;
 
         if (deterministicRoll >= 5.0 && deterministicRoll <= 95.0) {
@@ -112,27 +119,34 @@ std::unique_ptr<MCTSGameState> ShardokGameEngine::applyAction(
             // We want: initial - accumulated = deterministicRoll
             // Use initial = 2 (clearly < 5), so accumulated = 2 - deterministicRoll
             constexpr double kInitialLow = 2.0;
+            // 96 is the minimum value that continues accumulation (> 95 threshold)
+            constexpr double kContinueAccumulationRoll = 0.96;
+            constexpr double kContinueAccumulationValue = 96.0;
             sequence = {kInitialLow / 100.0};
             // OpenEndedHighImpl accumulates rolls until one < 95
-            // Split accumulated into rolls: 96 (continues) + remaining (stops)
-            double remaining = kInitialLow - deterministicRoll;
-            while (remaining > 95.0) {
-                sequence.push_back(0.96);  // 96 > 95, continues accumulation
-                remaining -= 96.0;
+            // Split accumulated into rolls: 96 (continues) + toAccumulate (stops)
+            double toAccumulate = kInitialLow - deterministicRoll;
+            while (toAccumulate > 95.0) {
+                sequence.push_back(kContinueAccumulationRoll);  // 96 > 95, continues accumulation
+                toAccumulate -= kContinueAccumulationValue;
             }
-            sequence.push_back(remaining / 100.0);  // Final roll < 95, stops
+            // Final roll must be in [0, 95) to stop accumulation
+            sequence.push_back(toAccumulate / 100.0);
         } else {
             // Need open-ended HIGH result (e.g., 150 for guaranteed failure)
             // OpenEndedPercentile: if initial > 95, returns OpenEndedHighImpl(initial, 4)
             // OpenEndedHighImpl accumulates rolls until one < 95
             constexpr double kInitialHigh = 96.0;
+            constexpr double kContinueAccumulationRoll = 0.96;
+            constexpr double kContinueAccumulationValue = 96.0;
             sequence = {kInitialHigh / 100.0};
-            double remaining = deterministicRoll - kInitialHigh;
-            while (remaining > 95.0) {
-                sequence.push_back(0.96);
-                remaining -= 96.0;
+            double toAccumulate = deterministicRoll - kInitialHigh;
+            while (toAccumulate > 95.0) {
+                sequence.push_back(kContinueAccumulationRoll);
+                toAccumulate -= kContinueAccumulationValue;
             }
-            sequence.push_back(remaining / 100.0);
+            // Final roll must be in [0, 95) to stop accumulation
+            sequence.push_back(toAccumulate / 100.0);
         }
 
         randomGen = std::make_shared<::SequenceRandomGenerator>(sequence);
@@ -140,7 +154,7 @@ std::unique_ptr<MCTSGameState> ShardokGameEngine::applyAction(
 
     engine->PostCommand(currentPlayer, shardokAction->getIndex(), randomGen);
 
-    // Create and return the new state
+    // Create and return the new state (don't cache the mutated engine)
     auto newState = std::make_unique<ShardokGameState>(
             engine->GetCurrentGameState(),
             scoreCalculator_,
@@ -152,11 +166,6 @@ std::unique_ptr<MCTSGameState> ShardokGameEngine::applyAction(
             *alCache_,
             criticalTileCoords_);
 
-    // Cache the engine on the new state so score() can use it for END_TURN normalization
-    // The engine's command list may be stale after the action was applied, but that's OK -
-    // we'll refresh it when we call GetAvailableCommandsForAIPlayer() in score()
-    newState->setCachedEngine(engine);
-
     // Don't pre-compute hash - let it be computed lazily on first use
     // Many states (especially in simulation) never need their hash computed
     return newState;
@@ -543,7 +552,7 @@ void ShardokGameEngine::resetCacheStatistics() {
     timeInLegalActionsComputation_.store(0, std::memory_order_relaxed);
 }
 
-ChanceOutcomeInfo ShardokGameEngine::getBinaryOutcomeInfo(
+BinaryOutcomeInfo ShardokGameEngine::getBinaryOutcomeInfo(
         const MCTSGameState& state,
         const MCTSAction& action) const {
     const auto* shardokState = dynamic_cast<const ShardokGameState*>(&state);
@@ -553,33 +562,6 @@ ChanceOutcomeInfo ShardokGameEngine::getBinaryOutcomeInfo(
         throw ShardokInternalErrorException("Invalid state or action type in getBinaryOutcomeInfo");
     }
 
-    // Check for multi-outcome commands (roll affects outcome quality, not just success/failure)
-    // These use multiOutcome() with fixed seeds to sample the range of possible results
-    using namespace net::eagle0::shardok::common;
-    const auto commandType = static_cast<CommandType>(shardokAction->getType());
-
-    switch (commandType) {
-        case END_TURN_COMMAND:
-            // END_TURN has random effects (fire spread, weather changes)
-            return ChanceOutcomeInfo::multiOutcome(5);
-
-        case MELEE_COMMAND:
-        case ARCHERY_COMMAND:
-        case CHARGE_COMMAND:
-        case REDUCE_COMMAND:
-            // Combat/siege commands: OpenEndedPercentile roll affects damage dealt
-            // Use 5 outcomes to sample the roll distribution
-            return ChanceOutcomeInfo::multiOutcome(5);
-
-        case CHALLENGE_DUEL_COMMAND:
-            // Duels have multiple combat rounds with rolls, so outcomes vary significantly
-            return ChanceOutcomeInfo::multiOutcome(5);
-
-        default:
-            // Continue to binary outcome handling below
-            break;
-    }
-
     const auto currentPlayer = static_cast<PlayerId>(state.currentPlayerId());
 
     // Get or create the engine for this state
@@ -609,7 +591,7 @@ ChanceOutcomeInfo ShardokGameEngine::getBinaryOutcomeInfo(
 
     const auto& descriptor = descriptors->at(actionIndex);
 
-    // Get success probability for binary outcome actions
+    // Get success probability
     if (!descriptor->HasOdds()) {
         throw ShardokInternalErrorException("Action does not have odds in getBinaryOutcomeInfo");
     }
@@ -617,7 +599,7 @@ ChanceOutcomeInfo ShardokGameEngine::getBinaryOutcomeInfo(
     const auto successChancePercentile = descriptor->GetOddsPercentile();
     const double successProbability = static_cast<double>(successChancePercentile) / 100.0;
 
-    return ChanceOutcomeInfo::binary(successProbability);
+    return BinaryOutcomeInfo{successProbability};
 }
 
 void ShardokGameEngine::clearLegalActionsCache() { legalActionsCache_.clear(); }

src/main/cpp/net/eagle0/shardok/ai/mcts/adapters/ShardokGameState.cpp

@@ -64,7 +64,7 @@ double ShardokGameState::score(MCTSPlayerId playerId) const {
     const bool scoreFromDefenderPerspective =
             foundDefender ? requestedPlayerIsDefender : isDefender_;
 
-    // Score the current state directly
+    // Call score calculator with correct perspective for the requested player
     return scoreCalculator_
             ->GuessedStateScore(scoreFromDefenderPerspective, state_, strategy_, castleCoords_);
 }

src/main/cpp/net/eagle0/shardok/ai_battle_simulator/ai_battle_simulator_main.cpp

@@ -10,6 +10,7 @@
 #include "AiBattleConfig.hpp"
 #include "AiBattleSimulator.hpp"
 #include "src/main/cpp/net/eagle0/common/FilesystemUtils.hpp"
+#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 
 using shardok::ai_battle_simulator::AiBattleConfigLoader;
 using shardok::ai_battle_simulator::AiBattleSimulator;
@@ -108,6 +109,10 @@ int main(int argc, char* argv[]) {
     // Set exec path for FilesystemUtils
     FilesystemUtils::SetExecPath(argv[0]);
 
+    // Set cache directory for ActionPointDistances
+    shardok::FixedActionPointDistances::SetCacheDirectory(
+            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
+
     try {
         if (argc < 2) {
             PrintUsage(argv[0]);

src/main/cpp/net/eagle0/shardok/ai_performance_runner/AIPerformanceRunner.cpp

@@ -16,6 +16,7 @@
 #include "src/main/cpp/net/eagle0/shardok/ai_testing_common/AIClientFactory.hpp"
 #include "src/main/cpp/net/eagle0/shardok/ai_testing_common/GamePhaseRunner.hpp"
 #include "src/main/cpp/net/eagle0/shardok/library/ShardokEngine.hpp"
+#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 #include "src/main/protobuf/net/eagle0/shardok/common/command_type.pb.h"
 
 using namespace shardok;
@@ -83,6 +84,10 @@ int main(int argc, char* argv[]) {
     // Set exec path so FilesystemUtils can find resource files
     FilesystemUtils::SetExecPath(argv[0]);
 
+    // Set cache directory for ActionPointDistances
+    FixedActionPointDistances::SetCacheDirectory(
+            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
+
     try {
         std::cout << "Shardok AI Performance Runner\n";
         std::cout << "==============================\n";

src/main/cpp/net/eagle0/shardok/controller/ShardokGameController.cpp

@@ -24,6 +24,9 @@ using std::scoped_lock;
 using std::string;
 using std::unique_lock;
 using std::weak_ptr;
+using std::chrono::duration;
+
+static constexpr duration kWaitForUpdatesDuration = std::chrono::milliseconds(5000);
 
 using net::eagle0::shardok::common::GameStatus;
 
@@ -71,21 +74,15 @@ vector<shared_ptr<ShardokAIClient>> ShardokGameController::MakeAIClients(
     mctsConfig.maxSimulationFlips = 1;
     mctsConfig.simulationPolicy = mcts::MCTSSimulationPolicy::WEIGHTED_HEURISTIC;
 
-    // Check if all players are AI - if so, use faster time budgets
-    const auto &playerInfos = e->GetPlayerInfos();
-    const bool isAllAiBattle =
-            std::ranges::all_of(playerInfos, [](const auto &pi) { return pi.is_ai(); });
-
-    for (const auto &pi : playerInfos) {
+    for (const auto &pi : e->GetPlayerInfos()) {
         if (pi.is_ai()) {
             auto newClient = std::make_shared<ShardokAIClient>(
                     pi.player_id(),
                     pi.is_defender(),
-                    isAllAiBattle,
                     e->GetCurrentGameState()->hex_map(),
                     e->GetGameSettings()->GetGetter(),
-                    AIAlgorithmType::ITERATIVE_DEEPENING,
-                    ScoringCalculatorType::STANDARD,
+                    AIAlgorithmType::MCTS,
+                    ScoringCalculatorType::MCTS_OPTIMIZED,
                     mctsConfig);
 
             // MCTS config is dynamically adjusted in ShardokAIClient based on proximity:
@@ -114,67 +111,17 @@ void ShardokGameController::DoAIThread() {
     if (aiClients.empty()) { printf("No AI players, exiting AI thread.\n"); }
 
     while (aiThreadKeepGoing) {
-        // Phase 1: Gather data for AI decision (brief lock)
-        shared_ptr<ShardokAIClient> aiClient;
-        PlayerId playerId;
-        GameSettingsSPtr settings;
-        net::eagle0::shardok::api::GameStateView gsv;
-        CommandListSPtr availableCommands;
-        size_t expectedHistoryCount;
-
-        {
-            unique_lock lk(masterLock);
-
-            if (engine->GameIsOver()) {
-                aiThreadKeepGoing = false;
-                continue;
-            }
-
-            playerId = engine->GetCurrentPlayerId();
-            aiClient = LockedAIClientForPid(playerId);
-
-            if (!aiClient) {
-                // Not an AI player's turn - wait for signal
-                aiCondition.wait(lk);
-                aiThreadKeepGoing = aiThreadKeepGoing && !engine->GameIsOver();
-                continue;
-            }
-
-            // Get copies of everything the AI needs
-            settings = engine->GetGameSettings();
-            gsv = engine->GetGameStateView(playerId);
-            availableCommands = engine->GetAvailableCommandsForAIPlayer(playerId);
-            expectedHistoryCount = engine->GetUnfilteredHistoryCount();
-        }
-        // Lock released - polls can now get through
-
-        if (availableCommands->empty()) {
-            printf("no commands for player %d\n", playerId);
-            continue;
+        while (incomingRegistrations > 0) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
         }
 
-        // Phase 2: AI thinks (NO LOCK - this is the slow part)
-        const auto results = aiClient->ChooseCommandIndex(settings, gsv, availableCommands);
-
-        // Phase 3: Post the command (brief lock)
-        {
-            unique_lock lk(masterLock);
-
-            // Verify state hasn't changed while we were thinking
-            if (engine->GetUnfilteredHistoryCount() != expectedHistoryCount) {
-                // State changed (e.g., human posted command) - re-evaluate
-                printf("AI: State changed while thinking, re-evaluating\n");
-                continue;
-            }
-
-            if (engine->GameIsOver()) {
-                aiThreadKeepGoing = false;
-                continue;
-            }
-
-            engine->PostCommand(playerId, results.chosenIndex);
+        unique_lock lk(masterLock);
+        if (LockedCheckOneAICommand()) {
             LockedNotifyClients();
-            aiThreadKeepGoing = !engine->GameIsOver();
+            aiThreadKeepGoing = aiThreadKeepGoing && !engine->GameIsOver();
+        } else {
+            aiCondition.wait(lk);
+            aiThreadKeepGoing = aiThreadKeepGoing && !engine->GameIsOver();
         }
     }
     printf("Exiting AI thread.\n");
@@ -189,6 +136,24 @@ ShardokGameController::~ShardokGameController() {
     aiThread.join();
 }
 
+auto ShardokGameController::LockedCheckOneAICommand() -> bool {
+    if (engine->GameIsOver()) {
+        printf("Game is over!\n");
+        return false;
+    }
+
+    const PlayerId currentPid = engine->GetCurrentPlayerId();
+    if (const shared_ptr<ShardokAIClient> currentPlayerClient = LockedAIClientForPid(currentPid)) {
+        const int index = currentPlayerClient->ChooseCommandIndex(*engine).chosenIndex;
+
+        engine->PostCommand(currentPid, index);
+        LockedNotifyClients();
+        return true;
+    }
+
+    return false;
+}
+
 void CheckFactionId(
         const unique_ptr<ShardokEngine> &engine,
         const PlayerId shardokPlayerId,
@@ -264,7 +229,6 @@ void ShardokGameController::PostPlacementCommands(
 }
 
 auto ShardokGameController::GetCurrentGameStateBytes() -> byte_vector {
-    scoped_lock<mutex> guard(masterLock);
     return engine->GetCurrentGameStateBytes();
 }
 
@@ -281,9 +245,15 @@ auto ShardokGameController::GetUpdates(const int64_t startingActionId) -> AllUpd
         awrs = engine->GetGameHistory(startingActionId);
         incomingRegistrations--;
 
-        // Note: Previously this had a 5-second wait for AI players to support long-polling.
-        // With streaming (WaitForUpdatesAndPush), the caller already waits for updates,
-        // so this wait is no longer needed. GetGameStatus is deprecated in favor of streaming.
+        // If the current player is an AI, wait for some results to post. Otherwise go ahead and
+        // return, we might be telling the caller about available commands.
+        if (awrs.empty() && !engine->GameIsOver() &&
+            engine->GetPlayerInfos()[engine->GetCurrentPlayerId()].is_ai()) {
+            updateCondition.wait_for(guard, kWaitForUpdatesDuration);
+            incomingRegistrations++;
+            awrs = engine->GetGameHistory(startingActionId);
+            incomingRegistrations--;
+        }
 
         updates.mainResults.reserve(awrs.size());
         std::ranges::transform(
@@ -322,9 +292,6 @@ auto ShardokGameController::GetUpdates(const int64_t startingActionId) -> AllUpd
                 -1,
                 engine->FilterNewResults(-1, startingActionId),
                 nullptr);
-
-        auto gameStateBytes = engine->GetCurrentGameStateBytes();
-        updates.currentGameState.swap(gameStateBytes);
     }
 
     return updates;
@@ -354,78 +321,4 @@ auto ShardokGameController::ResolvedPlayerInfos()
     return engine->GetPlayerInfos();
 }
 
-void ShardokGameController::RegisterSubscriber(std::shared_ptr<StreamSubscriber> subscriber) {
-    scoped_lock<mutex> guard(subscriberLock);
-    subscribers.push_back(subscriber);
-}
-
-void ShardokGameController::UnregisterSubscriber(const StreamSubscriber *subscriber) {
-    scoped_lock<mutex> guard(subscriberLock);
-    subscribers.erase(
-            std::remove_if(
-                    subscribers.begin(),
-                    subscribers.end(),
-                    [subscriber](const std::weak_ptr<StreamSubscriber> &weakSub) {
-                        auto sub = weakSub.lock();
-                        return !sub || sub.get() == subscriber;
-                    }),
-            subscribers.end());
-}
-
-auto ShardokGameController::WaitForUpdatesAndPush(
-        std::shared_ptr<StreamSubscriber> subscriber,
-        int64_t startingActionId) -> bool {
-    int64_t lastPushedActionId = startingActionId;
-
-    while (subscriber->IsActive()) {
-        bool gameOver = false;
-        GameOverInfo gameOverInfo{};
-
-        {
-            unique_lock<mutex> guard(masterLock);
-
-            // Wait for updates or game over
-            updateCondition.wait(guard, [this, lastPushedActionId] {
-                return engine->GetUnfilteredHistoryCount() >
-                               static_cast<size_t>(lastPushedActionId) ||
-                       engine->GameIsOver();
-            });
-
-            if (!subscriber->IsActive()) { return false; }
-
-            gameOver = engine->GameIsOver();
-
-            if (gameOver) {
-                gameOverInfo.gameStatus = fb::ToProto(engine->GetGameStatus());
-                gameOverInfo.playerInfos = engine->GetPlayerInfos();
-                gameOverInfo.endGameUnits = engine->EndGameUnits();
-            }
-        }
-        // Lock released - GetUpdates will acquire its own lock
-
-        // IMPORTANT: Send any pending updates FIRST, including the final actions
-        // that caused the game to end. Previously, we returned early on gameOver
-        // without sending these final updates, causing the client to never see
-        // the last few battle actions.
-        AllUpdates updates = GetUpdates(lastPushedActionId);
-        lastPushedActionId = updates.newUnfilteredCount;
-
-        if (!updates.mainResults.empty()) {
-            subscriber->OnUpdate(
-                    updates.mainResults,
-                    updates.filteredResults,
-                    updates.newUnfilteredCount,
-                    updates.currentGameState);
-        }
-
-        // Now send gameOver notification after all updates have been sent
-        if (gameOver) {
-            subscriber->OnGameOver(gameOverInfo);
-            return true;
-        }
-    }
-
-    return false;  // Subscriber disconnected
-}
-
 }  // namespace shardok

src/main/cpp/net/eagle0/shardok/controller/ShardokGameController.hpp

@@ -10,7 +10,6 @@
 #define ShardokGameController_hpp
 
 #include <functional>
-#include <memory>
 #include <mutex>
 #include <utility>
 #include <vector>
@@ -30,50 +29,6 @@ using std::shared_ptr;
 using std::unique_ptr;
 using std::weak_ptr;
 
-// Forward declaration
-class ShardokGameController;
-
-/// Info about a game that has ended, for notifying subscribers
-struct GameOverInfo {
-    vector<net::eagle0::shardok::common::PlayerInfo> playerInfos;
-    vector<net::eagle0::shardok::storage::ResolvedUnit> endGameUnits;
-    net::eagle0::shardok::common::GameStatus gameStatus;
-};
-
-/// Updates for a single player (includes faction ID for client routing)
-struct OnePlayerUpdates {
-    int32_t eagleFactionId;
-    vector<ActionResultView> resultViews;
-    shared_ptr<AvailableCommands> availableCommands;
-
-    OnePlayerUpdates(
-            const int32_t fid,
-            const vector<ActionResultView>& arvs,
-            const shared_ptr<AvailableCommands>& acs)
-        : eagleFactionId(fid),
-          resultViews(arvs),
-          availableCommands(acs) {}
-};
-
-/// Interface for subscribers that receive streaming updates from a game
-class StreamSubscriber {
-public:
-    virtual ~StreamSubscriber() = default;
-
-    /// Called when new game updates are available
-    virtual void OnUpdate(
-            const vector<ActionResult>& mainResults,
-            const vector<OnePlayerUpdates>& filteredResults,
-            int32_t newUnfilteredCount,
-            const byte_vector& currentGameState) = 0;
-
-    /// Called when the game ends
-    virtual void OnGameOver(const GameOverInfo& info) = 0;
-
-    /// Returns true if this subscriber is still active and should receive updates
-    [[nodiscard]] virtual auto IsActive() const -> bool = 0;
-};
-
 class ShardokGameController {
 private:
     // This lock should be held any time we call into engine or modify clients.
@@ -84,17 +39,10 @@ private:
     // Fires whenever there is a new game state update.
     mutable std::condition_variable updateCondition{};
 
-    // Stream subscribers - protected by separate lock to avoid deadlock with masterLock
-    mutable std::mutex subscriberLock{};
-    std::vector<std::weak_ptr<StreamSubscriber>> subscribers{};
-
     string serializedRequest;
 
     unique_ptr<ShardokEngine> engine;
 
-    // Cached immutable data - safe to access without lock since it never changes after construction
-    const GameId cachedGameId;
-
     std::atomic_int incomingRegistrations = 0;
 
     const string mapName;
@@ -112,9 +60,11 @@ private:
 
     void LockedNotifyClients() const;
 
+    auto LockedCheckOneAICommand() -> bool;
+
     auto LockedAIClientForPid(PlayerId pid) const -> shared_ptr<ShardokAIClient>;
 
-    static vector<shared_ptr<ShardokAIClient>> MakeAIClients(const unique_ptr<ShardokEngine>& e);
+    static vector<shared_ptr<ShardokAIClient>> MakeAIClients(const unique_ptr<ShardokEngine> &e);
 
     void DoAIThread();
 
@@ -125,7 +75,6 @@ public:
             string serializedRequest = "")
         : serializedRequest(std::move(serializedRequest)),
           engine(std::move(e)),
-          cachedGameId(engine->GetGameId()),
           mapName(std::move(mapName)),
           logFilePath(MakeLogFilePath()),
           aiClients(MakeAIClients(engine)),
@@ -149,13 +98,26 @@ public:
             PlayerId shardokPlayerId,
             int eagleFactionId,
             int64_t token,
-            const vector<UnitPlacementInfo>& infos);
+            const vector<UnitPlacementInfo> &infos);
+
+    struct OnePlayerUpdates {
+        int32_t eagleFactionId;
+        vector<ActionResultView> resultViews;
+        shared_ptr<AvailableCommands> availableCommands;
+
+        OnePlayerUpdates(
+                const int32_t fid,
+                const vector<ActionResultView> &arvs,
+                const shared_ptr<AvailableCommands> &acs)
+            : eagleFactionId(fid),
+              resultViews(arvs),
+              availableCommands(acs) {}
+    };
 
     struct AllUpdates {
         vector<ActionResult> mainResults;
         vector<OnePlayerUpdates> filteredResults;
         int32_t newUnfilteredCount;
-        byte_vector currentGameState;
     };
     auto GetUpdates(int64_t startingActionId) -> AllUpdates;
     auto GetCurrentGameStateBytes() -> byte_vector;
@@ -165,23 +127,13 @@ public:
     auto ResolvedPlayerInfos() -> vector<net::eagle0::shardok::common::PlayerInfo>;
     auto EndGameUnits() -> vector<net::eagle0::shardok::storage::ResolvedUnit>;
 
-    [[nodiscard]] auto GetGameId() const -> GameId { return cachedGameId; }
+    [[nodiscard]] auto GetGameId() const -> GameId { return engine->GetGameId(); }
+
+    [[nodiscard]] auto GetHexMap() const -> const HexMap * {
+        return engine->GetCurrentGameState()->hex_map();
+    }
 
     [[nodiscard]] auto GetLogFilePath() const -> string { return logFilePath; }
-
-    /// Register a subscriber to receive streaming updates for this game.
-    /// The subscriber will receive updates until it becomes inactive or is unregistered.
-    void RegisterSubscriber(std::shared_ptr<StreamSubscriber> subscriber);
-
-    /// Unregister a subscriber. Safe to call even if the subscriber was never registered.
-    void UnregisterSubscriber(const StreamSubscriber* subscriber);
-
-    /// Wait for game updates, pushing them to the given subscriber.
-    /// Blocks until the game ends or the subscriber becomes inactive.
-    /// Returns true if the game ended normally, false if subscriber disconnected.
-    auto WaitForUpdatesAndPush(
-            std::shared_ptr<StreamSubscriber> subscriber,
-            int64_t startingActionId) -> bool;
 };
 }  // namespace shardok
 

src/main/cpp/net/eagle0/shardok/library/FireUtils.cpp

@@ -8,8 +8,6 @@
 
 #include "FireUtils.hpp"
 
-#include <algorithm>
-
 #include "src/main/cpp/net/eagle0/shardok/library/map/TileModifier.hpp"
 
 namespace shardok {
@@ -73,13 +71,10 @@ auto GetFireDamage(
         const double openEndedPercentileRoll1,
         const double openEndedPercentileRoll2) -> CombatDamage {
     double randomSwing = 1.0 + (2 * openEndedPercentileRoll1 - 100.0) * RANDOMNESS_FACTOR / 100.0;
-    // Clamp damage to minimum 0 to prevent negative damage from extreme open-ended rolls.
-    // Open-ended percentile rolls can theoretically go as low as -475 (with max roll depth).
-    const double basicDamage = std::max(0.0, BASE_FIRE_DAMAGE_PER_TROOP * randomSwing * troops);
+    const double basicDamage = BASE_FIRE_DAMAGE_PER_TROOP * randomSwing * troops;
 
     randomSwing = 1.0 + (2 * openEndedPercentileRoll2 - 100.0) * RANDOMNESS_FACTOR / 100.0;
-    const double penetratingDamage =
-            std::max(0.0, BASE_PENETRATING_FIRE_DAMAGE_PER_TROOP * randomSwing * troops);
+    const double penetratingDamage = BASE_PENETRATING_FIRE_DAMAGE_PER_TROOP * randomSwing * troops;
 
     return CombatDamage::Builder()
             .SetFire(basicDamage)

src/main/cpp/net/eagle0/shardok/library/action_point_distances/ActionPointDistancesCache.cpp

@@ -29,6 +29,8 @@ thread_local struct {
     int localMisses = 0;
     int sharedAccesses = 0;
     int evictionEvents = 0;
+    int apdLoadedFromFile = 0;
+    int apdGeneratedFresh = 0;
     std::chrono::steady_clock::time_point lastReportTime = std::chrono::steady_clock::now();
 } cacheStats;
 
@@ -38,13 +40,16 @@ static void MaybePrintCacheStats() {
     if (std::chrono::duration_cast<std::chrono::seconds>(now - cacheStats.lastReportTime).count() >=
         CACHE_STATS_FREQUENCY_SECONDS_) {
         printf("Thread cache stats: %d persistent hits, %d persistent misses, %d local hits, "
-               "%d local misses, %d shared accesses, %d eviction events\n",
+               "%d local misses, %d shared accesses, %d eviction events, "
+               "%d APD loaded from file, %d APD generated fresh\n",
                cacheStats.persistentHits,
                cacheStats.persistentMisses,
                cacheStats.localHits,
                cacheStats.localMisses,
                cacheStats.sharedAccesses,
-               cacheStats.evictionEvents);
+               cacheStats.evictionEvents,
+               cacheStats.apdLoadedFromFile,
+               cacheStats.apdGeneratedFresh);
         cacheStats.lastReportTime = now;
     }
 }
@@ -190,12 +195,25 @@ auto ActionPointDistancesCache::GetRaw(
     }
 
     // Create new pathfinding result using factory method
-    auto result = FixedActionPointDistances::Create(
+    auto creationResult = FixedActionPointDistances::Create(
             mapToUse,
+            mapId.terrainTypesId,
+            mapId.modifierId,
             battalionType,
             includeBravingWater,
             braveWaterActionPointCost);
 
+#if CACHE_STATS_LOGGING_
+    // Track whether this was loaded from file or generated fresh
+    if (creationResult.loadedFromFile) {
+        cacheStats.apdLoadedFromFile++;
+    } else {
+        cacheStats.apdGeneratedFresh++;
+    }
+#endif
+
+    auto result = creationResult.apd;
+
     // Store in shared cache
     sharedDistances.lazy_emplace_l(
             cacheKey,

src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.cpp

@@ -22,56 +22,110 @@ static const int ASYNC_COUNT = []() {
 
 namespace shardok {
 
+void FixedActionPointDistances::SetCacheDirectory(const string& newDir) {
+    cacheDirectory = newDir;
+    FilesystemUtils::MakeDirectoryIfNecessary(cacheDirectory);
+}
+
+static thread_local byte_vector _scratch;
+
 FixedActionPointDistances::FixedActionPointDistances(const HexMap* /*map*/, int columnCount)
     : ActionPointDistances(columnCount) {}
 
 auto FixedActionPointDistances::Create(
         const HexMap* map,
+        int64_t terrainTypesHash,
+        int64_t modifierHash,
         const BattalionTypeSPtr& battalionType,
         bool includeBravingWater,
-        int braveWaterActionPointCost) -> std::shared_ptr<FixedActionPointDistances> {
+        int braveWaterActionPointCost) -> CreationResult {
     // Create the object using private constructor
     auto apd = std::shared_ptr<FixedActionPointDistances>(
             new FixedActionPointDistances(map, map->column_count()));
 
+    CreationResult result;
+    result.apd = apd;
+    result.loadedFromFile = false;
+
+    string path = "";
+
+    if (!cacheDirectory.empty()) {
+        std::stringstream stream;
+        stream << cacheDirectory;
+        stream << std::hex << terrainTypesHash << '/';
+
+        if (auto directoryPath = stream.str(); !FilesystemUtils::FileExistsAtPath(directoryPath)) {
+            FilesystemUtils::MakeDirectoryIfNecessary(stream.str());
+        }
+
+        stream << std::hex << modifierHash;
+        stream << " " << battalionType->typeId;
+        if (includeBravingWater) { stream << " " << braveWaterActionPointCost; }
+        stream << ".apd";
+        path = stream.str();
+    }
+
     const int indexCount = map->row_count() * map->column_count();
 
-    vector<std::future<vector<vector<DIST_T>>>> futures(indexCount);
+    if (!path.empty() && FilesystemUtils::FileExistsAtPath(path)) {
+        apd->distances.resize(indexCount);
+        // load from file
+        const auto& bytes = _scratch.ReplaceWithPath(path);
+        const auto* ptr = reinterpret_cast<const DIST_T*>(bytes.data());
 
-    auto braveWaterPossibleCoords =
-            includeBravingWater ? apd->BraveWaterPossibleCoords(map) : nullptr;
+        for (int fromIndex = 0; fromIndex < indexCount; fromIndex++) {
+            apd->distances[fromIndex].insert(
+                    apd->distances[fromIndex].end(),
+                    &(ptr[0]),
+                    &(ptr[indexCount]));
+            ptr += indexCount;
+        }
+        result.loadedFromFile = true;
+    } else {
+        _scratch.reserve(indexCount * indexCount * sizeof(DIST_T));
 
-    int chunkSize = (indexCount + ASYNC_COUNT - 1) / ASYNC_COUNT;
-    // Break into chunks for async
-    for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
-        futures[chunkIdx] = std::async(std::launch::async, [=]() -> vector<vector<DIST_T>> {
-            vector<vector<DIST_T>> chunkVec;
-            chunkVec.reserve(chunkSize);
-            const int chunkStartIndex = chunkIdx * chunkSize;
+        vector<std::future<vector<vector<DIST_T>>>> futures(indexCount);
 
-            for (int i = 0; i < chunkSize; i++) {
-                const auto fromIndex = chunkStartIndex + i;
-                if (fromIndex >= indexCount) { continue; }
-                chunkVec.push_back(ActionPointDistances::GenerateDistances(
-                        fromIndex,
-                        map,
-                        includeBravingWater,
-                        braveWaterActionPointCost,
-                        battalionType,
-                        braveWaterPossibleCoords));
-            }
-            return chunkVec;
-        });
+        auto braveWaterPossibleCoords =
+                includeBravingWater ? apd->BraveWaterPossibleCoords(map) : nullptr;
+
+        int chunkSize = (indexCount + ASYNC_COUNT - 1) / ASYNC_COUNT;
+        // Break into chunks for async
+        for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
+            futures[chunkIdx] = std::async(std::launch::async, [=]() -> vector<vector<DIST_T>> {
+                vector<vector<DIST_T>> chunkVec;
+                chunkVec.reserve(chunkSize);
+                const int chunkStartIndex = chunkIdx * chunkSize;
+
+                for (int i = 0; i < chunkSize; i++) {
+                    const auto fromIndex = chunkStartIndex + i;
+                    if (fromIndex >= indexCount) { continue; }
+                    chunkVec.push_back(ActionPointDistances::GenerateDistances(
+                            fromIndex,
+                            map,
+                            includeBravingWater,
+                            braveWaterActionPointCost,
+                            battalionType,
+                            braveWaterPossibleCoords));
+                }
+                return chunkVec;
+            });
+        }
+
+        apd->distances.reserve(indexCount);
+        _scratch.clear();
+        _scratch.reserve(indexCount * indexCount * sizeof(DIST_T));
+
+        for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
+            auto resultsVec = futures[chunkIdx].get();
+            apd->distances.insert(apd->distances.end(), resultsVec.begin(), resultsVec.end());
+            for (const auto& r : resultsVec) { _scratch.append(r); }
+        }
+
+        if (!path.empty()) { FilesystemUtils::AtomicallySaveToPath(path, _scratch); }
     }
 
-    apd->distances.reserve(indexCount);
-
-    for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
-        auto resultsVec = futures[chunkIdx].get();
-        apd->distances.insert(apd->distances.end(), resultsVec.begin(), resultsVec.end());
-    }
-
-    return apd;
+    return result;
 }
 
 }  // namespace shardok

src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp

@@ -17,19 +17,31 @@ using std::vector;
 using BattalionTypeSPtr = std::shared_ptr<const BattalionType>;
 
 class FixedActionPointDistances final : public ActionPointDistances {
+public:
+    struct CreationResult {
+        std::shared_ptr<FixedActionPointDistances> apd;
+        bool loadedFromFile;
+    };
+
 private:
     vector<vector<DIST_T>> distances;
 
+    inline static string cacheDirectory = "";
+
     // Private constructor - use Create factory method instead
     explicit FixedActionPointDistances(const HexMap *map, int columnCount);
 
 public:
-    // Factory method to create FixedActionPointDistances
+    static void SetCacheDirectory(const string &newDir);
+
+    // Factory method to create FixedActionPointDistances with metadata
     static auto Create(
             const HexMap *map,
+            int64_t terrainTypesHash,
+            int64_t modifierHash,
             const BattalionTypeSPtr &battalionType,
             bool includeBravingWater,
-            int braveWaterActionPointCost = -1) -> std::shared_ptr<FixedActionPointDistances>;
+            int braveWaterActionPointCost = -1) -> CreationResult;
 
     ~FixedActionPointDistances() override = default;
 
@@ -40,6 +52,8 @@ public:
     [[nodiscard]] auto Distance(const Coords &from, const Coords &to) const -> DIST_T override {
         return Distance(ToIndex(from), ToIndex(to));
     }
+
+    friend struct CreationResult;
 };
 
 }  // namespace shardok

src/main/cpp/net/eagle0/shardok/library/unit/Battalion.cpp

@@ -10,8 +10,6 @@
 
 #include <algorithm>
 
-#include "src/main/cpp/net/eagle0/shardok/library/ShardokException.hpp"
-
 namespace shardok {
 
 auto MutatingMaybeSetMorale(Battalion *battalion, double newVal, const BattalionTypeSPtr &type)
@@ -149,12 +147,6 @@ int32_t MutatingInternalTakeDamage(
     int32_t newNumber;
     const int32_t casualties = (int32_t)(takenDamage * baseDeadliness);
 
-    if (casualties < 0) {
-        throw ShardokInternalErrorException(
-                "Negative casualties in MutatingInternalTakeDamage: " + std::to_string(casualties) +
-                " (takenDamage=" + std::to_string(takenDamage) + ")");
-    }
-
     if (battalion->size() > casualties) {
         newNumber = battalion->size() - casualties;
     } else {

src/main/cpp/net/eagle0/shardok/library/view_filters/UnitFilter.cpp

@@ -19,13 +19,7 @@ using net::eagle0::shardok::api::UnitView;
 using net::eagle0::shardok::common::CommandType;
 using std::vector;
 
-auto UnknownUnit(
-        UnitId uid,
-        PlayerId pid,
-        BattalionTypeId bt,
-        int size,
-        bool hidden,
-        int8_t startingPositionIndex) -> UnitView;
+auto UnknownUnit(UnitId uid, PlayerId pid, BattalionTypeId bt, int size, bool hidden) -> UnitView;
 
 [[nodiscard]] auto UnitFilteredForPlayer(
         const SettingsGetter &settings,
@@ -42,8 +36,7 @@ auto UnknownUnit(
                 unit->player_id(),
                 unit->battalion().type(),
                 unit->battalion().size(),
-                true,
-                unit->starting_position_index());
+                true);
     }
     if (IsUnplaced(unit->location()) && !visibleToAsker) {
         return UnknownUnit(
@@ -51,8 +44,7 @@ auto UnknownUnit(
                 unit->player_id(),
                 unit->battalion().type(),
                 unit->battalion().size(),
-                false,
-                unit->starting_position_index());
+                false);
     }
 
     UnitView filtered{};
@@ -150,8 +142,7 @@ auto UnknownUnit(
         const PlayerId pid,
         BattalionTypeId bt,
         const int size,
-        const bool hidden,
-        const int8_t startingPositionIndex) -> UnitView {
+        const bool hidden) -> UnitView {
     UnitView uv;
     uv.set_unit_id(uid);
     uv.set_player_id(pid);
@@ -163,11 +154,6 @@ auto UnknownUnit(
     uv.mutable_battalion()->set_size(size);
     uv.set_hidden(hidden);
 
-    // starting_position_index is public info - defenders know attacker spawn directions
-    if (startingPositionIndex != -1) {
-        uv.mutable_starting_position_index()->set_value(startingPositionIndex);
-    }
-
     uv.set_my_knowledge(0);
 
     return uv;

src/main/cpp/net/eagle0/shardok/server/BUILD.bazel

@@ -34,17 +34,6 @@ cc_library(
     ],
 )
 
-cc_library(
-    name = "token_auth",
-    hdrs = ["TokenAuthInterceptor.hpp"],
-    copts = COPTS,
-    visibility = ["//src/main/cpp/net/eagle0/shardok:__subpackages__"],
-    deps = [
-        "//src/main/cpp/net/eagle0/common:protobuf_warning_suppression",
-        "@grpc//:grpc++",
-    ],
-)
-
 cc_library(
     name = "eagle_interface_grpc_server",
     srcs = ["EagleInterfaceGrpcServer.cpp"],
@@ -53,7 +42,6 @@ cc_library(
     visibility = ["//src/main/cpp/net/eagle0/shardok:__subpackages__"],
     deps = [
         ":games_manager",
-        ":token_auth",
         "//src/main/cpp/net/eagle0/common:unit_conversions",
         "//src/main/protobuf/net/eagle0/common:shardok_internal_interface_cc_grpc",
         "//src/main/protobuf/net/eagle0/common:victory_condition_cc_proto",

src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.cpp

@@ -81,17 +81,8 @@ static auto FromInternalStatus(
 
 const std::string &kShardokGameRequestExtension = *(new string(".e0gr"));
 
-EagleInterfaceImpl::EagleInterfaceImpl(
-        shared_ptr<ShardokGamesManager> manager,
-        std::string authToken)
-    : gamesManager(std::move(manager)),
-      tokenValidator_(std::move(authToken)) {
-    if (tokenValidator_.IsEnabled()) {
-        std::cout << "Token authentication enabled" << std::endl;
-    } else {
-        std::cout << "Token authentication disabled (no token configured)" << std::endl;
-    }
-}
+EagleInterfaceImpl::EagleInterfaceImpl(shared_ptr<ShardokGamesManager> manager)
+    : gamesManager(std::move(manager)) {}
 
 auto ConvertPlayerInfo(
         const google::protobuf::RepeatedPtrField<net::eagle0::common::PlayerSetupInfo> &allPis,
@@ -197,12 +188,9 @@ void EagleInterfaceImpl::StartGame(const NewGameRequest &request) {
 }
 
 auto EagleInterfaceImpl::PostCommand(
-        ServerContext *context,
+        ServerContext * /*context*/,
         const PostCommandRequest *request,
         GameStatusResponse *response) -> Status {
-    // Validate auth token
-    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
-
     shared_ptr<ShardokGameController> controller;
     try {
         controller = ControllerForGame(request->game_id(), request->game_setup_info());
@@ -241,12 +229,9 @@ auto EagleInterfaceImpl::PostCommand(
 }
 
 auto EagleInterfaceImpl::PostPlacementCommands(
-        ServerContext *context,
+        ServerContext * /*context*/,
         const PlacementCommandsRequest *request,
         GameStatusResponse *response) -> Status {
-    // Validate auth token
-    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
-
     shared_ptr<ShardokGameController> controller;
     try {
         controller = ControllerForGame(request->game_id(), request->game_setup_info());
@@ -337,13 +322,27 @@ void EagleInterfaceImpl::PopulateGameStatusResponse(
     }
 }
 
+auto EagleInterfaceImpl::GetGameStatus(
+        ServerContext * /*context*/,
+        const GameStatusRequest *request,
+        GameStatusResponse *response) -> Status {
+    shared_ptr<ShardokGameController> controller;
+    try {
+        controller = ControllerForGame(request->game_id(), request->game_setup_info());
+    } catch (NewGameException &e) { return e.GetStatus(); }
+
+    PopulateGameStatusResponse(
+            controller,
+            request->game_setup_info().known_result_count(),
+            response);
+
+    return Status::OK;
+}
+
 auto EagleInterfaceImpl::GetHexMap(
-        ServerContext *context,
+        ServerContext * /*context*/,
         const HexMapRequest *request,
         HexMapResponse *response) -> Status {
-    // Validate auth token
-    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
-
     // TODO: return appropriate status code if a bad map name is sent
     *response->mutable_map() = LoadMap(request->map_name());
 
@@ -351,12 +350,9 @@ auto EagleInterfaceImpl::GetHexMap(
 }
 
 auto EagleInterfaceImpl::GetHexMapNames(
-        ServerContext *context,
+        ServerContext * /*context*/,
         const HexMapNamesRequest * /*request*/,
         HexMapNamesResponse *response) -> Status {
-    // Validate auth token
-    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
-
     for (const string &mapName : GetMapNames()) { response->add_map_names(mapName); }
 
     return Status::OK;
@@ -533,133 +529,6 @@ auto FromInternalStatus(
     throw ShardokInternalErrorException("Bad unit status on resolved unit");
 }
 
-auto EagleInterfaceImpl::SubscribeToGame(
-        ServerContext *context,
-        const GameSubscriptionRequest *request,
-        grpc::ServerWriter<GameStatusResponse> *writer) -> Status {
-    // Validate auth token
-    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
-
-    shared_ptr<ShardokGameController> controller;
-    try {
-        controller = ControllerForGame(request->game_id(), request->game_setup_info());
-    } catch (NewGameException &e) { return e.GetStatus(); }
-
-    if (!controller) { return Status(StatusCode::NOT_FOUND, "Game not found"); }
-
-    // Send initial state
-    GameStatusResponse initialResponse;
-    PopulateGameStatusResponse(
-            controller,
-            request->game_setup_info().known_result_count(),
-            &initialResponse);
-    if (!writer->Write(initialResponse)) {
-        return Status::OK;  // Client disconnected
-    }
-
-    // If game was already over, we're done
-    if (initialResponse.has_game_over_response()) { return Status::OK; }
-
-    // Track the actual count after initial response to avoid duplicate sends
-    const int64_t countAfterInitialResponse =
-            initialResponse.has_game_update_response()
-                    ? initialResponse.game_update_response().total_action_result_count()
-                    : request->game_setup_info().known_result_count();
-
-    // Create a subscriber that writes to the gRPC stream
-    class GrpcStreamSubscriber : public StreamSubscriber {
-    private:
-        grpc::ServerWriter<GameStatusResponse> *writer_;
-        ServerContext *context_;
-        std::atomic<bool> active_{true};
-        std::string gameId_;
-
-    public:
-        GrpcStreamSubscriber(
-                grpc::ServerWriter<GameStatusResponse> *w,
-                ServerContext *ctx,
-                std::string gameId)
-            : writer_(w),
-              context_(ctx),
-              gameId_(std::move(gameId)) {}
-
-        void OnUpdate(
-                const vector<ActionResult> &mainResults,
-                const vector<OnePlayerUpdates> &filteredResults,
-                int32_t newUnfilteredCount,
-                const byte_vector &currentGameState) override {
-            if (!active_) return;
-
-            GameStatusResponse response;
-            response.set_game_id(gameId_);
-
-            response.mutable_game_update_response()->mutable_update_responses()->Add(
-                    begin(mainResults),
-                    end(mainResults));
-
-            // Add filtered results for each player with their faction IDs
-            for (const auto &playerUpdate : filteredResults) {
-                auto *filtered =
-                        response.mutable_game_update_response()->add_filtered_update_responses();
-                filtered->set_eagle_faction_id(playerUpdate.eagleFactionId);
-                filtered->mutable_action_result_views()->Add(
-                        begin(playerUpdate.resultViews),
-                        end(playerUpdate.resultViews));
-                if (playerUpdate.availableCommands) {
-                    *filtered->mutable_available_commands() = *playerUpdate.availableCommands;
-                }
-            }
-
-            response.mutable_game_update_response()->set_total_action_result_count(
-                    newUnfilteredCount);
-            *response.mutable_game_update_response()->mutable_current_game_state() =
-                    std::string(currentGameState.begin(), currentGameState.end());
-
-            if (!writer_->Write(response)) { active_ = false; }
-        }
-
-        void OnGameOver(const GameOverInfo &info) override {
-            if (!active_) return;
-
-            GameStatusResponse response;
-            response.set_game_id(gameId_);
-
-            PopulateGameOverResponse(
-                    gameId_,
-                    info.gameStatus,
-                    info.playerInfos,
-                    info.endGameUnits,
-                    response.mutable_game_over_response());
-
-            writer_->Write(response);
-            active_ = false;
-        }
-
-        [[nodiscard]] auto IsActive() const -> bool override {
-            return active_ && !context_->IsCancelled();
-        }
-    };
-
-    auto subscriber =
-            std::make_shared<GrpcStreamSubscriber>(writer, context, controller->GetGameId());
-
-    controller->RegisterSubscriber(subscriber);
-
-    // Wait for updates and push them until game ends or subscriber disconnects
-    // Use countAfterInitialResponse to avoid re-sending results already in initial response
-    bool gameEnded = controller->WaitForUpdatesAndPush(subscriber, countAfterInitialResponse);
-
-    controller->UnregisterSubscriber(subscriber.get());
-
-    if (gameEnded) {
-        printf("SubscribeToGame: Game ended normally\n");
-    } else {
-        printf("SubscribeToGame: Subscriber disconnected\n");
-    }
-
-    return Status::OK;
-}
-
 }  // namespace shardok
 
 #ifndef NDEBUG

src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.hpp

@@ -13,9 +13,8 @@
 #include <string>
 #include <thread>
 
+#include "ShardokGamesManager.hpp"
 #include "src/main/cpp/net/eagle0/common/ProtobufWarningSuppression.hpp"
-#include "src/main/cpp/net/eagle0/shardok/server/ShardokGamesManager.hpp"
-#include "src/main/cpp/net/eagle0/shardok/server/TokenAuthInterceptor.hpp"
 #pragma GCC diagnostic push
 SUPPRESS_PROTOBUF_WARNINGS
 #include <grpc/grpc.h>
@@ -32,8 +31,8 @@ namespace shardok {
 using grpc::ServerContext;
 using grpc::Status;
 using net::eagle0::common::GameSetupInfo;
+using net::eagle0::common::GameStatusRequest;
 using net::eagle0::common::GameStatusResponse;
-using net::eagle0::common::GameSubscriptionRequest;
 using net::eagle0::common::HexMapNamesRequest;
 using net::eagle0::common::HexMapNamesResponse;
 using net::eagle0::common::HexMapRequest;
@@ -47,7 +46,6 @@ using std::shared_ptr;
 class EagleInterfaceImpl final : public ShardokInternalInterface::Service {
 private:
     std::shared_ptr<ShardokGamesManager> gamesManager;
-    TokenValidator tokenValidator_;
 
     auto ControllerForGame(const GameId& gameId, const GameSetupInfo& setupInfo)
             -> std::shared_ptr<ShardokGameController>;
@@ -59,14 +57,7 @@ private:
             GameStatusResponse* response);
 
 public:
-    /**
-     * Create the service.
-     *
-     * @param manager Games manager
-     * @param authToken Optional auth token. If non-empty, all requests must include
-     *                  "authorization: Bearer <token>" metadata.
-     */
-    EagleInterfaceImpl(std::shared_ptr<ShardokGamesManager> manager, std::string authToken = "");
+    explicit EagleInterfaceImpl(std::shared_ptr<ShardokGamesManager> manager);
 
     auto PostCommand(
             ServerContext* context,
@@ -76,6 +67,10 @@ public:
             ServerContext* context,
             const PlacementCommandsRequest* request,
             GameStatusResponse* response) -> Status override;
+    auto GetGameStatus(
+            ServerContext* context,
+            const GameStatusRequest* request,
+            GameStatusResponse* response) -> Status override;
 
     auto GetHexMap(ServerContext* context, const HexMapRequest* request, HexMapResponse* response)
             -> Status override;
@@ -83,11 +78,6 @@ public:
             ServerContext* context,
             const HexMapNamesRequest* request,
             HexMapNamesResponse* response) -> Status override;
-
-    auto SubscribeToGame(
-            ServerContext* context,
-            const GameSubscriptionRequest* request,
-            grpc::ServerWriter<GameStatusResponse>* writer) -> Status override;
 };
 }  // namespace shardok
 

src/main/cpp/net/eagle0/shardok/server/ServerConfiguration.cpp

@@ -8,7 +8,6 @@
 
 #include "ServerConfiguration.hpp"
 
-#include <cstdlib>
 #include <cstring>
 #include <fstream>
 #include <iostream>
@@ -24,7 +23,6 @@ const string ServerConfiguration::kEagleInterfaceGrpcAddress = "eagleInterfaceGr
 const string ServerConfiguration::kEagleGrpcAddress = "eagleGrpcAddress";
 const string ServerConfiguration::kSslCertPath = "sslCertPath";
 const string ServerConfiguration::kSslPrivateKeyPath = "sslPrivateKeyPath";
-const string ServerConfiguration::kAuthTokenPath = "authTokenPath";
 #pragma GCC diagnostic pop
 
 using std::unordered_map;
@@ -32,16 +30,9 @@ using std::unordered_map;
 unordered_map<string, string> DefaultValues();
 
 unordered_map<string, string> DefaultValues() {
-    // Check environment variables for Docker deployment
-    // Docker containers should set SHARDOK_EAGLE_INTERFACE_ADDRESS=0.0.0.0:40042
-    // to listen on all interfaces for container networking
-    const char* eagleInterfaceAddr = getenv("SHARDOK_EAGLE_INTERFACE_ADDRESS");
-    const char* shardokAddr = getenv("SHARDOK_GRPC_ADDRESS");
-
     return unordered_map<string, string>{
-            {ServerConfiguration::kShardokGrpcAddress, shardokAddr ? shardokAddr : "localhost"},
-            {ServerConfiguration::kEagleInterfaceGrpcAddress,
-             eagleInterfaceAddr ? eagleInterfaceAddr : "localhost:40042"}};
+            {ServerConfiguration::kShardokGrpcAddress, "localhost"},
+            {ServerConfiguration::kEagleInterfaceGrpcAddress, "localhost"}};
 }
 
 ServerConfiguration::ServerConfiguration(const string& filePath) {

src/main/cpp/net/eagle0/shardok/server/ServerConfiguration.hpp

@@ -29,7 +29,6 @@ public:
     const static string kEagleGrpcAddress;
     const static string kSslCertPath;
     const static string kSslPrivateKeyPath;
-    const static string kAuthTokenPath;
 };
 
 #endif /* ServerConfiguration_hpp */

src/main/cpp/net/eagle0/shardok/server/ShardokGamesManager.cpp

@@ -15,6 +15,7 @@
 #include "ServerConfiguration.hpp"
 #include "src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.hpp"
 #include "src/main/cpp/net/eagle0/shardok/controller/ShardokGameController.hpp"
+#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 #include "src/main/cpp/net/eagle0/shardok/library/settings_loader/SettingsLoader.hpp"
 #include "src/main/cpp/net/eagle0/shardok/util/MapLoader.hpp"
 #include "src/main/flatbuffer/net/eagle0/shardok/storage/unit.hpp"
@@ -44,6 +45,9 @@ ShardokGamesManager::ShardokGamesManager(const std::vector<std::string> &extraSe
         std::cerr << "NOT SETTING" << std::endl;
         //        setter.SetRaw(key, value);
     }
+
+    FixedActionPointDistances::SetCacheDirectory(
+            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
 }
 
 auto ShardokGamesManager::GetController(const GameId &gameId)

src/main/cpp/net/eagle0/shardok/server/TokenAuthInterceptor.hpp

@@ -1,119 +0,0 @@
-//
-//  TokenAuthInterceptor.hpp
-//  eagle0
-//
-//  Token-based authentication for gRPC.
-//  Validates Bearer tokens in the 'authorization' metadata header.
-//
-
-#ifndef TokenAuthInterceptor_hpp
-#define TokenAuthInterceptor_hpp
-
-#include <fstream>
-#include <iostream>
-#include <optional>
-#include <sstream>
-#include <string>
-
-#include "src/main/cpp/net/eagle0/common/ProtobufWarningSuppression.hpp"
-#pragma GCC diagnostic push
-SUPPRESS_PROTOBUF_WARNINGS
-#include <grpcpp/server_context.h>
-#include <grpcpp/support/status.h>
-#pragma GCC diagnostic pop
-
-namespace shardok {
-
-/**
- * Validates Bearer tokens in gRPC request metadata.
- *
- * Usage:
- *   TokenValidator validator(expectedToken);
- *   if (!validator.Validate(context)) {
- *       return grpc::Status(grpc::UNAUTHENTICATED, "Invalid token");
- *   }
- */
-class TokenValidator {
-public:
-    /**
-     * Create a validator with the expected token.
-     * If expectedToken is empty, all requests are allowed (no auth required).
-     */
-    explicit TokenValidator(std::string expectedToken) : expectedToken_(std::move(expectedToken)) {}
-
-    /**
-     * Validate the authorization header in the server context.
-     *
-     * Expects: "authorization" metadata with value "Bearer <token>"
-     *
-     * @return true if valid (or no auth configured), false otherwise
-     */
-    [[nodiscard]] auto Validate(grpc::ServerContext* context) const -> bool {
-        // If no auth token is configured, allow all requests
-        if (expectedToken_.empty()) { return true; }
-
-        const auto& metadata = context->client_metadata();
-        auto it = metadata.find("authorization");
-        if (it == metadata.end()) {
-            std::cerr << "Auth failed: no authorization header" << std::endl;
-            return false;
-        }
-
-        std::string authHeader(it->second.begin(), it->second.end());
-        std::string expectedHeader = "Bearer " + expectedToken_;
-
-        if (authHeader != expectedHeader) {
-            std::cerr << "Auth failed: invalid token" << std::endl;
-            return false;
-        }
-
-        return true;
-    }
-
-    /**
-     * Validate and return appropriate Status.
-     *
-     * @return std::nullopt if valid, Status(UNAUTHENTICATED) if invalid
-     */
-    [[nodiscard]] auto ValidateOrStatus(grpc::ServerContext* context) const
-            -> std::optional<grpc::Status> {
-        if (Validate(context)) { return std::nullopt; }
-        return grpc::Status(grpc::UNAUTHENTICATED, "Invalid or missing authentication token");
-    }
-
-    /**
-     * Check if authentication is enabled.
-     */
-    [[nodiscard]] auto IsEnabled() const -> bool { return !expectedToken_.empty(); }
-
-private:
-    std::string expectedToken_;
-};
-
-/**
- * Read auth token from a file, stripping whitespace.
- * Returns empty string if file doesn't exist or is empty.
- */
-inline auto ReadAuthTokenFromFile(const std::string& filePath) -> std::string {
-    if (filePath.empty()) { return ""; }
-
-    std::ifstream file(filePath);
-    if (!file.is_open()) {
-        std::cerr << "Warning: Could not open auth token file: " << filePath << std::endl;
-        return "";
-    }
-
-    std::stringstream buffer;
-    buffer << file.rdbuf();
-    std::string token = buffer.str();
-
-    // Trim whitespace
-    auto start = token.find_first_not_of(" \t\n\r");
-    if (start == std::string::npos) { return ""; }
-    auto end = token.find_last_not_of(" \t\n\r");
-    return token.substr(start, end - start + 1);
-}
-
-}  // namespace shardok
-
-#endif /* TokenAuthInterceptor_hpp */

src/main/cpp/net/eagle0/shardok/shardok_server_main.cpp

@@ -7,9 +7,7 @@
 //
 
 #include <cstddef>
-#include <fstream>
 #include <memory>
-#include <sstream>
 #include <thread>
 
 #include "src/main/cpp/net/eagle0/common/ProtobufWarningSuppression.hpp"
@@ -19,16 +17,14 @@ SUPPRESS_PROTOBUF_WARNINGS
 
 #include <execinfo.h>
 #include <grpcpp/channel.h>
-#include <grpcpp/security/server_credentials.h>
 #include <signal.h>
 #include <unistd.h>
 
 #pragma GCC diagnostic pop
 
-#include "src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.hpp"
-#include "src/main/cpp/net/eagle0/shardok/server/ServerConfiguration.hpp"
-#include "src/main/cpp/net/eagle0/shardok/server/ShardokGamesManager.hpp"
-#include "src/main/cpp/net/eagle0/shardok/server/TokenAuthInterceptor.hpp"
+#include "server/EagleInterfaceGrpcServer.hpp"
+#include "server/ServerConfiguration.hpp"
+#include "server/ShardokGamesManager.hpp"
 
 using ::GameStatePersister;
 using shardok::EagleInterfaceImpl;
@@ -45,15 +41,12 @@ struct ServerThreadInfo {
 
 auto StartInThread(grpc::ServerBuilder *serverBuilder) -> ServerThreadInfo;
 
-auto CreateServerBuilder(const string &serverAddress, const string &certPath, const string &keyPath)
-        -> grpc::ServerBuilder *;
+auto CreateServerBuilder(const string &serverAddress) -> grpc::ServerBuilder *;
 
 auto CreateEagleInterfaceService(
         const std::shared_ptr<ServerConfiguration> &config,
         std::shared_ptr<ShardokGamesManager> shardokGamesManager) -> ServerThreadInfo;
 
-auto ReadFileContents(const string &path) -> string;
-
 void handler(const int sig) {
     void *array[10];
     size_t size;
@@ -89,46 +82,11 @@ auto main(const int argc, char **argv) -> int {
     eagleInterfaceInfo.thread.join();
 }
 
-auto ReadFileContents(const string &path) -> string {
-    std::ifstream file(path);
-    if (!file.is_open()) { return ""; }
-    std::stringstream buffer;
-    buffer << file.rdbuf();
-    return buffer.str();
-}
-
-auto CreateServerBuilder(const string &serverAddress, const string &certPath, const string &keyPath)
-        -> grpc::ServerBuilder * {
+auto CreateServerBuilder(const string &serverAddress) -> grpc::ServerBuilder * {
     auto *serverBuilder = new grpc::ServerBuilder;
 
-    std::shared_ptr<grpc::ServerCredentials> credentials;
-
-    // Check if TLS is configured
-    if (!certPath.empty() && !keyPath.empty()) {
-        const string certContents = ReadFileContents(certPath);
-        const string keyContents = ReadFileContents(keyPath);
-
-        if (certContents.empty() || keyContents.empty()) {
-            std::cerr << "Error: Could not read TLS certificate or key file" << std::endl;
-            std::cerr << "  cert path: " << certPath << std::endl;
-            std::cerr << "  key path: " << keyPath << std::endl;
-            std::cerr << "Falling back to insecure connection" << std::endl;
-            credentials = grpc::InsecureServerCredentials();
-        } else {
-            grpc::SslServerCredentialsOptions::PemKeyCertPair keyCert;
-            keyCert.private_key = keyContents;
-            keyCert.cert_chain = certContents;
-
-            grpc::SslServerCredentialsOptions sslOpts;
-            sslOpts.pem_key_cert_pairs.push_back(keyCert);
-
-            credentials = grpc::SslServerCredentials(sslOpts);
-            std::cout << "TLS enabled with certificate from: " << certPath << std::endl;
-        }
-    } else {
-        credentials = grpc::InsecureServerCredentials();
-        std::cout << "Creating insecure connection (no TLS configured)" << std::endl;
-    }
+    const auto credentials = grpc::InsecureServerCredentials();
+    std::cout << "Creating insecure connection" << std::endl;
 
     serverBuilder->AddListeningPort(serverAddress, credentials);
     return serverBuilder;
@@ -140,19 +98,9 @@ auto CreateEagleInterfaceService(
     const string eagleInterfaceServerAddress =
             config->stringForKey(ServerConfiguration::kEagleInterfaceGrpcAddress);
 
-    // TLS configuration
-    const string certPath = config->stringForKey(ServerConfiguration::kSslCertPath);
-    const string keyPath = config->stringForKey(ServerConfiguration::kSslPrivateKeyPath);
+    auto *eagleInterfaceServerBuilder = CreateServerBuilder(eagleInterfaceServerAddress);
 
-    auto *eagleInterfaceServerBuilder =
-            CreateServerBuilder(eagleInterfaceServerAddress, certPath, keyPath);
-
-    // Auth token configuration
-    const string authTokenPath = config->stringForKey(ServerConfiguration::kAuthTokenPath);
-    const string authToken = shardok::ReadAuthTokenFromFile(authTokenPath);
-
-    const auto eagleInterfaceService =
-            std::make_shared<EagleInterfaceImpl>(shardokGamesManager, authToken);
+    const auto eagleInterfaceService = std::make_shared<EagleInterfaceImpl>(shardokGamesManager);
     eagleInterfaceServerBuilder->RegisterService(eagleInterfaceService.get());
 
     ServerThreadInfo eagleInterfaceThreadInfo = StartInThread(eagleInterfaceServerBuilder);

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth.meta

@@ -1,8 +0,0 @@
-fileFormatVersion: 2
-guid: 683e069fbc3074e35ac6fc3881a03f4a
-folderAsset: yes
-DefaultImporter:
-  externalObjects: {}
-  userData: 
-  assetBundleName: 
-  assetBundleVariant: 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/AuthClient.cs

@@ -1,203 +0,0 @@
-using System;
-using System.Threading.Tasks;
-using Cysharp.Net.Http;
-using Grpc.Core;
-using Grpc.Core.Interceptors;
-using Grpc.Net.Client;
-using Net.Eagle0.Eagle.Api.Auth;
-using UnityEngine;
-using GrpcAuthClient = Net.Eagle0.Eagle.Api.Auth.Auth.AuthClient;
-
-namespace Auth {
-    /// <summary>
-    /// gRPC client for the Auth service.
-    /// Routes OAuth requests (GetOAuthUrl, CheckOAuthStatus, RefreshToken) to the Go auth service.
-    /// Routes user requests (SetDisplayName, GetCurrentUser, Logout) to Eagle.
-    /// </summary>
-    public class AuthClient : IDisposable {
-        private const int PollIntervalMs = 2000;   // Poll every 2 seconds
-        private const int PollTimeoutMs = 300000;  // 5 minute timeout
-
-        private readonly GrpcAuthClient _authServiceClient;  // Go auth service
-        private readonly GrpcAuthClient _eagleClient;        // Eagle server
-        private readonly GrpcChannel _authServiceChannel;
-        private readonly GrpcChannel _eagleChannel;
-
-        /// <summary>
-        /// Create auth client with separate channels for auth service and Eagle.
-        /// </summary>
-        /// <param name="authServiceUrl">Go auth service URL, e.g.
-        /// "https://prod.eagle0.net:40033"</param> <param name="eagleUrl">Eagle server URL, e.g.
-        /// "https://prod.eagle0.net:40032"</param>
-        public AuthClient(string authServiceUrl, string eagleUrl) {
-            // Auth service channel (no JWT needed for OAuth flow)
-            _authServiceChannel = GrpcChannel.ForAddress(
-                    authServiceUrl,
-                    new GrpcChannelOptions {
-                        HttpHandler = new YetAnotherHttpHandler { Http2Only = true },
-                        DisposeHttpClient = true
-                    });
-            _authServiceClient = new GrpcAuthClient(_authServiceChannel);
-
-            // Eagle channel with JWT interceptor for authenticated requests
-            _eagleChannel = GrpcChannel.ForAddress(
-                    eagleUrl,
-                    new GrpcChannelOptions {
-                        HttpHandler = new YetAnotherHttpHandler { Http2Only = true },
-                        DisposeHttpClient = true
-                    });
-            CallInvoker eagleInvoker = _eagleChannel.Intercept(new JwtAuthInterceptor());
-            _eagleClient = new GrpcAuthClient(eagleInvoker);
-
-            Debug.Log($"[AuthClient] Configured: authService={authServiceUrl}, eagle={eagleUrl}");
-        }
-
-        /// <summary>
-        /// Get OAuth URL to open in system browser.
-        /// Returns both the URL and the state token for polling.
-        /// Routed to Go auth service.
-        /// </summary>
-        /// <param name="provider">Discord or Google</param>
-        /// <param name="invitationCode">Optional invitation code for new account
-        /// registration</param> <returns>Tuple of (URL to open in browser, state token for
-        /// polling)</returns>
-        public async Task<(string authUrl, string state)> GetOAuthUrlAsync(
-                OAuthProvider provider,
-                string invitationCode = null) {
-            var request = new GetOAuthUrlRequest { Provider = provider };
-
-            if (!string.IsNullOrEmpty(invitationCode)) {
-                request.InvitationCode = invitationCode;
-                Debug.Log("[AuthClient] Including invitation code in OAuth request");
-            }
-
-            var response = await _authServiceClient.GetOAuthUrlAsync(request);
-
-            Debug.Log($"[AuthClient] Got OAuth URL for {provider}, state={response.State}");
-            return (response.AuthUrl, response.State);
-        }
-
-        /// <summary>
-        /// Poll for OAuth completion. Blocks until success, failure, or timeout.
-        /// The server handles the OAuth callback and token exchange.
-        /// Routed to Go auth service.
-        /// </summary>
-        /// <param name="state">State token from GetOAuthUrlAsync</param>
-        /// <returns>Response with tokens and user info on success</returns>
-        public async Task<CheckOAuthStatusResponse> PollForOAuthCompletionAsync(string state) {
-            var startTime = DateTime.UtcNow;
-
-            while (true) {
-                var request = new CheckOAuthStatusRequest { State = state };
-                var response = await _authServiceClient.CheckOAuthStatusAsync(request);
-
-                switch (response.Status) {
-                    case OAuthStatus.Success:
-                        Debug.Log(
-                                $"[AuthClient] OAuth successful, user={response.User?.DisplayName}, isNew={response.IsNewUser}");
-                        return response;
-
-                    case OAuthStatus.Failed:
-                        throw new Exception($"OAuth failed: {response.ErrorMessage}");
-
-                    case OAuthStatus.Expired:
-                        throw new Exception("OAuth session expired. Please try again.");
-
-                    case OAuthStatus.InvitationRequired:
-                        Debug.Log("[AuthClient] Server requires invitation code for new account");
-                        return response;  // Return so OAuthManager can handle this
-
-                    case OAuthStatus.Pending:
-                        // Check timeout
-                        if ((DateTime.UtcNow - startTime).TotalMilliseconds > PollTimeoutMs) {
-                            throw new TimeoutException("OAuth login timed out. Please try again.");
-                        }
-                        // Wait before polling again
-                        await Task.Delay(PollIntervalMs);
-                        break;
-
-                    default: throw new Exception($"Unknown OAuth status: {response.Status}");
-                }
-            }
-        }
-
-        /// <summary>
-        /// Refresh access token using stored refresh token.
-        /// Routed to Go auth service.
-        /// </summary>
-        /// <returns>New access token and expiry, or null if refresh failed</returns>
-        public async Task<RefreshTokenResponse> RefreshTokenAsync() {
-            var refreshToken = TokenStorage.RefreshToken;
-            if (string.IsNullOrEmpty(refreshToken)) {
-                throw new InvalidOperationException("No refresh token available");
-            }
-
-            var request = new RefreshTokenRequest { RefreshToken = refreshToken };
-
-            var response = await _authServiceClient.RefreshTokenAsync(request);
-
-            // Update stored access token
-            TokenStorage.UpdateAccessToken(response.AccessToken, response.ExpiresAt);
-
-            Debug.Log($"[AuthClient] Token refreshed, expires at {response.ExpiresAt}");
-            return response;
-        }
-
-        /// <summary>
-        /// Set display name for new users.
-        /// Requires valid JWT in interceptor.
-        /// Routed to Eagle.
-        /// </summary>
-        public async Task<SetDisplayNameResponse> SetDisplayNameAsync(string displayName) {
-            var request = new SetDisplayNameRequest { DisplayName = displayName };
-            var response = await _eagleClient.SetDisplayNameAsync(request);
-
-            if (response.Success) {
-                TokenStorage.UpdateDisplayName(displayName);
-                // Update the access token with the new one that has updated displayName claim
-                if (!string.IsNullOrEmpty(response.AccessToken)) {
-                    // Token expires in 7 days from now
-                    var expiresAt = DateTimeOffset.UtcNow.AddDays(7).ToUnixTimeSeconds();
-                    TokenStorage.UpdateAccessToken(response.AccessToken, expiresAt);
-                    Debug.Log($"[AuthClient] Display name set to: {displayName}, token updated");
-                } else {
-                    Debug.Log($"[AuthClient] Display name set to: {displayName}");
-                }
-            } else {
-                Debug.LogWarning(
-                        $"[AuthClient] Failed to set display name: {response.ErrorMessage}");
-            }
-
-            return response;
-        }
-
-        /// <summary>
-        /// Get current user info. Validates the stored JWT.
-        /// Routed to Eagle.
-        /// </summary>
-        public async Task<GetCurrentUserResponse> GetCurrentUserAsync() {
-            var response = await _eagleClient.GetCurrentUserAsync(new GetCurrentUserRequest());
-            Debug.Log($"[AuthClient] Current user: {response.User?.DisplayName}");
-            return response;
-        }
-
-        /// <summary>
-        /// Logout - invalidates refresh token on server.
-        /// Does NOT clear local tokens (OAuthManager handles that decision).
-        /// Routed to Eagle.
-        /// </summary>
-        public async Task LogoutAsync() {
-            try {
-                await _eagleClient.LogoutAsync(new LogoutRequest());
-                Debug.Log("[AuthClient] Server logout successful");
-            } catch (Exception ex) {
-                Debug.LogWarning($"[AuthClient] Logout RPC failed (may be expected): {ex.Message}");
-            }
-        }
-
-        public void Dispose() {
-            _authServiceChannel?.Dispose();
-            _eagleChannel?.Dispose();
-        }
-    }
-}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/AuthClient.cs.meta

@@ -1,2 +0,0 @@
-fileFormatVersion: 2
-guid: 4ba94126c2d2145b8875612eaf5bc371

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/InvitationCodeManager.cs

@@ -1,136 +0,0 @@
-using System;
-using System.IO;
-using UnityEngine;
-
-namespace Auth {
-    /// <summary>
-    /// Manages invitation codes for new account registration.
-    /// Reads codes from installer-provided file or allows manual entry.
-    /// </summary>
-    public static class InvitationCodeManager {
-        private const string InvitationFileName = "invitation.json";
-        private const string PlayerPrefsKey = "InvitationCode";
-
-        // Cache the code to avoid repeated file reads
-        private static string _cachedCode;
-        private static bool _cacheInitialized;
-
-        /// <summary>
-        /// Get the invitation code, if available.
-        /// Checks: 1) Cached value, 2) PlayerPrefs, 3) File from installer
-        /// </summary>
-        public static string GetInvitationCode() {
-            if (_cacheInitialized) { return _cachedCode; }
-
-            // Check PlayerPrefs first (manual entry takes priority)
-            string prefsCode = PlayerPrefs.GetString(PlayerPrefsKey, null);
-            if (!string.IsNullOrEmpty(prefsCode)) {
-                _cachedCode = prefsCode;
-                _cacheInitialized = true;
-                Debug.Log("[InvitationCodeManager] Using invitation code from PlayerPrefs");
-                return _cachedCode;
-            }
-
-            // Try to read from installer file
-            string fileCode = ReadFromFile();
-            if (!string.IsNullOrEmpty(fileCode)) {
-                _cachedCode = fileCode;
-                _cacheInitialized = true;
-                Debug.Log("[InvitationCodeManager] Using invitation code from installer file");
-                return _cachedCode;
-            }
-
-            _cacheInitialized = true;
-            return null;
-        }
-
-        /// <summary>
-        /// Set invitation code manually (e.g., from UI input).
-        /// </summary>
-        public static void SetInvitationCode(string code) {
-            if (string.IsNullOrEmpty(code)) {
-                PlayerPrefs.DeleteKey(PlayerPrefsKey);
-                _cachedCode = null;
-            } else {
-                PlayerPrefs.SetString(PlayerPrefsKey, code);
-                _cachedCode = code;
-            }
-            _cacheInitialized = true;
-            PlayerPrefs.Save();
-            Debug.Log(
-                    $"[InvitationCodeManager] Invitation code {(string.IsNullOrEmpty(code) ? "cleared" : "set")}");
-        }
-
-        /// <summary>
-        /// Clear the invitation code after successful account creation.
-        /// </summary>
-        public static void ClearInvitationCode() {
-            PlayerPrefs.DeleteKey(PlayerPrefsKey);
-            _cachedCode = null;
-            _cacheInitialized = true;
-            PlayerPrefs.Save();
-
-            // Also delete the installer file if it exists
-            DeleteInstallerFile();
-
-            Debug.Log("[InvitationCodeManager] Invitation code cleared");
-        }
-
-        /// <summary>
-        /// Check if an invitation code is available.
-        /// </summary>
-        public static bool HasInvitationCode => !string.IsNullOrEmpty(GetInvitationCode());
-
-        private static string ReadFromFile() {
-            try {
-                string installDir = GetInstallDirectory();
-                if (string.IsNullOrEmpty(installDir)) { return null; }
-
-                string filePath = Path.Combine(installDir, InvitationFileName);
-                if (!File.Exists(filePath)) { return null; }
-
-                string json = File.ReadAllText(filePath);
-                // Simple JSON parsing for {"invitation_code":"XXXX"}
-                var parsed = JsonUtility.FromJson<InvitationFile>(json);
-                return parsed?.invitation_code;
-            } catch (Exception ex) {
-                Debug.LogWarning(
-                        $"[InvitationCodeManager] Failed to read invitation file: {ex.Message}");
-                return null;
-            }
-        }
-
-        private static void DeleteInstallerFile() {
-            try {
-                string installDir = GetInstallDirectory();
-                if (string.IsNullOrEmpty(installDir)) { return; }
-
-                string filePath = Path.Combine(installDir, InvitationFileName);
-                if (File.Exists(filePath)) {
-                    File.Delete(filePath);
-                    Debug.Log("[InvitationCodeManager] Deleted installer invitation file");
-                }
-            } catch (Exception ex) {
-                Debug.LogWarning(
-                        $"[InvitationCodeManager] Failed to delete invitation file: {ex.Message}");
-            }
-        }
-
-        private static string GetInstallDirectory() {
-#if UNITY_STANDALONE_WIN || UNITY_EDITOR_WIN
-            // Windows: %LOCALAPPDATA%\eagle0
-            string localAppData =
-                    Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
-            return Path.Combine(localAppData, "eagle0");
-#else
-            // Other platforms don't use the Windows installer
-            return null;
-#endif
-        }
-
-        [Serializable]
-        private class InvitationFile {
-            public string invitation_code;
-        }
-    }
-}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/InvitationCodeManager.cs.meta

@@ -1,2 +0,0 @@
-fileFormatVersion: 2
-guid: a2a19f11d1f82412e8e2811b366113ac

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/JwtAuthInterceptor.cs

@@ -1,75 +0,0 @@
-using System;
-using Grpc.Core;
-using Grpc.Core.Interceptors;
-
-namespace Auth {
-    /// <summary>
-    /// gRPC interceptor that attaches JWT Bearer token to requests.
-    /// Reads token from TokenStorage on each request.
-    /// </summary>
-    public class JwtAuthInterceptor : Interceptor {
-        private const string HeaderName = "Authorization";
-
-        private string GetBearerHeader() {
-            var token = TokenStorage.AccessToken;
-            return string.IsNullOrEmpty(token) ? null : $"Bearer {token}";
-        }
-
-        public override TResponse BlockingUnaryCall<TRequest, TResponse>(
-                TRequest request,
-                ClientInterceptorContext<TRequest, TResponse> context,
-                BlockingUnaryCallContinuation<TRequest, TResponse> continuation) {
-            return continuation(request, ContextWithHeaders(context));
-        }
-
-        public override AsyncUnaryCall<TResponse> AsyncUnaryCall<TRequest, TResponse>(
-                TRequest request,
-                ClientInterceptorContext<TRequest, TResponse> context,
-                AsyncUnaryCallContinuation<TRequest, TResponse> continuation) {
-            return continuation(request, ContextWithHeaders(context));
-        }
-
-        public override AsyncServerStreamingCall<TResponse>
-        AsyncServerStreamingCall<TRequest, TResponse>(
-                TRequest request,
-                ClientInterceptorContext<TRequest, TResponse> context,
-                AsyncServerStreamingCallContinuation<TRequest, TResponse> continuation) {
-            return continuation(request, ContextWithHeaders(context));
-        }
-
-        public override AsyncClientStreamingCall<TRequest, TResponse>
-        AsyncClientStreamingCall<TRequest, TResponse>(
-                ClientInterceptorContext<TRequest, TResponse> context,
-                AsyncClientStreamingCallContinuation<TRequest, TResponse> continuation) {
-            return continuation(ContextWithHeaders(context));
-        }
-
-        public override AsyncDuplexStreamingCall<TRequest, TResponse>
-        AsyncDuplexStreamingCall<TRequest, TResponse>(
-                ClientInterceptorContext<TRequest, TResponse> context,
-                AsyncDuplexStreamingCallContinuation<TRequest, TResponse> continuation) {
-            return continuation(ContextWithHeaders(context));
-        }
-
-        private ClientInterceptorContext<TRequest, TResponse>
-        ContextWithHeaders<TRequest, TResponse>(
-                ClientInterceptorContext<TRequest, TResponse> original)
-                where TRequest : class
-                where TResponse : class {
-            var bearerHeader = GetBearerHeader();
-            if (string.IsNullOrEmpty(bearerHeader)) {
-                // No token available - return original context
-                // Auth service endpoints don't require token
-                return original;
-            }
-
-            var headers = new Metadata();
-            headers.Add(HeaderName, bearerHeader);
-
-            return new ClientInterceptorContext<TRequest, TResponse>(
-                    original.Method,
-                    original.Host,
-                    original.Options.WithHeaders(headers));
-        }
-    }
-}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/JwtAuthInterceptor.cs.meta

@@ -1,2 +0,0 @@
-fileFormatVersion: 2
-guid: 8528d8ee967e042ecb2a5e8285c425e0

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/OAuthManager.cs

@@ -1,294 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Threading.Tasks;
-using Net.Eagle0.Eagle.Api.Auth;
-using UnityEngine;
-
-namespace Auth {
-    /// <summary>
-    /// Manages OAuth authentication flow using server-mediated polling:
-    /// - Opens system browser for OAuth consent
-    /// - Polls server for OAuth completion (no deep links needed)
-    /// - Token storage and refresh
-    /// - Multi-account support
-    /// </summary>
-    public class OAuthManager : MonoBehaviour {
-        public static OAuthManager Instance { get; private set; }
-
-        private AuthClient _authClient;
-        private string _currentAuthServiceUrl;
-        private string _currentEagleUrl;
-        private OAuthProvider _currentLoginProvider;  // Track provider during login
-
-        // Events for UI updates
-        public event Action<UserInfo> OnLoginSuccess;
-        public event Action<string> OnLoginFailed;
-        public event Action OnLogout;
-        public event Action<bool> OnNewUserNeedsDisplayName;  // true if new user
-        public event Action OnInvitationRequired;             // new user needs invitation code
-
-        public bool IsAuthenticated => TokenStorage.HasValidToken;
-        public string DisplayName => TokenStorage.DisplayName;
-        public string UserId => TokenStorage.UserId;
-
-        private void Awake() {
-            if (Instance != null && Instance != this) {
-                Destroy(gameObject);
-                return;
-            }
-
-            Instance = this;
-            DontDestroyOnLoad(gameObject);
-
-            // Initialize TokenStorage cache from PlayerPrefs on main thread
-            // This allows background threads to access tokens safely
-            TokenStorage.InitializeCache();
-
-            // AuthClient is created lazily when SetServerUrls is called
-        }
-
-        /// <summary>
-        /// Set the server URLs for OAuth and game requests. Call this before any OAuth operations.
-        /// </summary>
-        /// <param name="authServiceUrl">Go auth service URL, e.g.
-        /// "https://prod.eagle0.net:40033"</param> <param name="eagleUrl">Eagle server URL, e.g.
-        /// "https://prod.eagle0.net:40032"</param>
-        public void SetServerUrls(string authServiceUrl, string eagleUrl) {
-            if (_currentAuthServiceUrl == authServiceUrl && _currentEagleUrl == eagleUrl &&
-                _authClient != null) {
-                return;  // Already configured for these URLs
-            }
-
-            _authClient?.Dispose();
-            _currentAuthServiceUrl = authServiceUrl;
-            _currentEagleUrl = eagleUrl;
-            _authClient = new AuthClient(authServiceUrl, eagleUrl);
-            Debug.Log($"[OAuthManager] Configured: authService={authServiceUrl}, eagle={eagleUrl}");
-        }
-
-        private void OnDestroy() {
-            _authClient?.Dispose();
-            if (Instance == this) { Instance = null; }
-        }
-
-        private void EnsureConfigured() {
-            if (_authClient == null) {
-                throw new InvalidOperationException(
-                        "OAuthManager not configured. Call SetServerUrls() first.");
-            }
-        }
-
-        /// <summary>
-        /// Start OAuth login with specified provider.
-        /// Opens system browser for user consent, then polls for completion.
-        /// </summary>
-        public async Task<CheckOAuthStatusResponse> LoginAsync(OAuthProvider provider) {
-            EnsureConfigured();
-            _currentLoginProvider = provider;  // Track for later storage
-
-            try {
-                // Get invitation code if available (for new account registration)
-                string invitationCode = InvitationCodeManager.GetInvitationCode();
-
-                // Get OAuth URL and state from server
-                var (authUrl, state) = await _authClient.GetOAuthUrlAsync(provider, invitationCode);
-
-                // Open system browser
-                Debug.Log($"[OAuthManager] Opening browser: {authUrl}");
-                Application.OpenURL(authUrl);
-
-                // Poll for OAuth completion (server handles the callback)
-                var response = await _authClient.PollForOAuthCompletionAsync(state);
-
-                // Handle invitation required status
-                if (response.Status == OAuthStatus.InvitationRequired) {
-                    Debug.Log("[OAuthManager] Server requires invitation code for new account");
-                    OnInvitationRequired?.Invoke();
-                    throw new Exception("An invitation code is required to create a new account");
-                }
-
-                // Store tokens with provider info
-                var providerName = provider.ToString().ToLowerInvariant();
-                TokenStorage.StoreTokens(
-                        response.AccessToken,
-                        response.RefreshToken,
-                        response.ExpiresAt,
-                        response.User.UserId,
-                        response.User.DisplayName ?? "",
-                        providerName);
-
-                // Clear invitation code after successful new account creation
-                if (response.IsNewUser) {
-                    InvitationCodeManager.ClearInvitationCode();
-                    OnNewUserNeedsDisplayName?.Invoke(true);
-                } else {
-                    OnLoginSuccess?.Invoke(response.User);
-                }
-
-                return response;
-            } catch (Exception ex) {
-                Debug.LogError($"[OAuthManager] Login failed: {ex.Message}");
-                OnLoginFailed?.Invoke(ex.Message);
-                throw;
-            }
-        }
-
-        /// <summary>
-        /// Set display name for new user after OAuth.
-        /// </summary>
-        public async Task<bool> SetDisplayNameAsync(string displayName) {
-            EnsureConfigured();
-            var response = await _authClient.SetDisplayNameAsync(displayName);
-
-            if (response.Success) { OnLoginSuccess?.Invoke(response.User); }
-
-            return response.Success;
-        }
-
-        /// <summary>
-        /// Try to restore session from stored tokens.
-        /// Returns true if valid session exists.
-        /// Must call SetServerUrls() before this method.
-        /// </summary>
-        public async Task<bool> TryRestoreSessionAsync() {
-            if (_authClient == null) {
-                Debug.Log("[OAuthManager] Not configured yet, skipping session restore");
-                return false;
-            }
-
-            if (!TokenStorage.HasValidToken && !TokenStorage.HasRefreshToken) {
-                Debug.Log("[OAuthManager] No stored session");
-                return false;
-            }
-
-            // If token is expired but we have refresh token, try to refresh
-            if (!TokenStorage.HasValidToken && TokenStorage.HasRefreshToken) {
-                try {
-                    await _authClient.RefreshTokenAsync();
-                } catch (Exception ex) {
-                    Debug.LogWarning($"[OAuthManager] Token refresh failed: {ex.Message}");
-                    TokenStorage.Clear();
-                    return false;
-                }
-            }
-
-            // Validate session with server
-            try {
-                var response = await _authClient.GetCurrentUserAsync();
-
-                // Check if user still needs to set display name (e.g., closed app before setting
-                // it)
-                if (string.IsNullOrEmpty(response.User.DisplayName)) {
-                    Debug.Log("[OAuthManager] Session restored but user needs display name");
-                    OnNewUserNeedsDisplayName?.Invoke(false);  // false = not a brand new user
-                    return true;
-                }
-
-                Debug.Log($"[OAuthManager] Session restored for {response.User.DisplayName}");
-                OnLoginSuccess?.Invoke(response.User);
-                return true;
-            } catch (Exception ex) {
-                Debug.LogWarning($"[OAuthManager] Session validation failed: {ex.Message}");
-                TokenStorage.Clear();
-                return false;
-            }
-        }
-
-        /// <summary>
-        /// Refresh access token if needed.
-        /// Call this before making API requests.
-        /// </summary>
-        public async Task EnsureValidTokenAsync() {
-            EnsureConfigured();
-            if (TokenStorage.NeedsRefresh && TokenStorage.HasRefreshToken) {
-                await _authClient.RefreshTokenAsync();
-            }
-        }
-
-        /// <summary>
-        /// Logout - clears current session but preserves stored tokens for quick re-login.
-        /// </summary>
-        public async Task LogoutAsync() {
-            // Notify server of logout if connected
-            if (_authClient != null) {
-                try {
-                    await _authClient.LogoutAsync();
-                } catch (Exception ex) {
-                    Debug.LogWarning($"[OAuthManager] Server logout failed: {ex.Message}");
-                }
-            }
-
-            // Clear current account selection but keep tokens stored
-            TokenStorage.ClearCurrentAccount();
-            OnLogout?.Invoke();
-        }
-
-        /// <summary>
-        /// Get all stored accounts for display in UI.
-        /// </summary>
-        public IReadOnlyList<StoredAccount> GetStoredAccounts() {
-            return TokenStorage.GetAllAccounts();
-        }
-
-        /// <summary>
-        /// Select and connect with a stored account.
-        /// If token is expired or about to expire, refreshes it first.
-        /// </summary>
-        public async Task<bool> ConnectWithStoredAccountAsync(StoredAccount account) {
-            EnsureConfigured();
-
-            // Select this account as current
-            TokenStorage.SelectAccount(account.AccountKey);
-
-            // Check if token needs refresh
-            if (!account.HasValidToken || account.NeedsRefresh) {
-                if (account.HasRefreshToken) {
-                    try {
-                        await _authClient.RefreshTokenAsync();
-                        Debug.Log($"[OAuthManager] Refreshed token for {account.DisplayName}");
-                    } catch (Exception ex) {
-                        Debug.LogWarning($"[OAuthManager] Token refresh failed: {ex.Message}");
-                        // Token refresh failed - need to re-authenticate
-                        // Parse provider from account key
-                        var provider = account.Provider.ToLowerInvariant() == "google"
-                                               ? OAuthProvider.Google
-                                               : OAuthProvider.Discord;
-                        OnLoginFailed?.Invoke("Session expired. Please sign in again.");
-                        return false;
-                    }
-                } else {
-                    OnLoginFailed?.Invoke("Session expired. Please sign in again.");
-                    return false;
-                }
-            }
-
-            // Validate session with server
-            try {
-                var response = await _authClient.GetCurrentUserAsync();
-
-                // Check if user still needs to set display name
-                if (string.IsNullOrEmpty(response.User.DisplayName)) {
-                    Debug.Log("[OAuthManager] Stored account needs display name");
-                    OnNewUserNeedsDisplayName?.Invoke(false);
-                    return true;
-                }
-
-                Debug.Log(
-                        $"[OAuthManager] Connected with stored account: {response.User.DisplayName}");
-                OnLoginSuccess?.Invoke(response.User);
-                return true;
-            } catch (Exception ex) {
-                Debug.LogWarning($"[OAuthManager] Session validation failed: {ex.Message}");
-                OnLoginFailed?.Invoke("Session invalid. Please sign in again.");
-                return false;
-            }
-        }
-
-        /// <summary>
-        /// Remove a stored account permanently.
-        /// </summary>
-        public void RemoveStoredAccount(StoredAccount account) {
-            TokenStorage.RemoveAccount(account.AccountKey);
-        }
-    }
-}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/OAuthManager.cs.meta

@@ -1,2 +0,0 @@
-fileFormatVersion: 2
-guid: 0e9d5b0cb9f26477eaf26e8a09c41707

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/TokenStorage.cs

@@ -1,310 +0,0 @@
-using System;
-using System.Collections.Generic;
-using UnityEngine;
-
-namespace Auth {
-    /// <summary>
-    /// Represents a stored OAuth account with tokens.
-    /// </summary>
-    [Serializable]
-    public class StoredAccount {
-        public string Provider;     // "discord" or "google"
-        public string UserId;       // OAuth provider user ID
-        public string DisplayName;  // User's display name
-        public string AccessToken;
-        public string RefreshToken;
-        public long ExpiresAt;  // Unix timestamp
-
-        public string AccountKey => $"{Provider}:{UserId}";
-
-        public bool HasValidToken => !string.IsNullOrEmpty(AccessToken) &&
-                                     ExpiresAt > DateTimeOffset.UtcNow.ToUnixTimeSeconds();
-
-        public bool HasRefreshToken => !string.IsNullOrEmpty(RefreshToken);
-
-        public bool NeedsRefresh {
-            get {
-                var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
-                return ExpiresAt > 0 && ExpiresAt - now < 300;  // 5 minutes
-            }
-        }
-    }
-
-    /// <summary>
-    /// Container for all stored accounts, serialized to JSON.
-    /// </summary>
-    [Serializable]
-    public class StoredAccountsData {
-        public List<StoredAccount> Accounts = new();
-        public string CurrentAccountKey;  // Provider:UserId of active account
-    }
-
-    /// <summary>
-    /// Secure storage for OAuth tokens using Unity's PlayerPrefs.
-    /// Supports multiple accounts - tokens are preserved on logout.
-    /// Values are cached in memory to allow access from background threads.
-    /// In production, consider using platform-specific secure storage
-    /// (Keychain on iOS, Keystore on Android).
-    /// </summary>
-    public static class TokenStorage {
-        private const string AccountsDataKey = "eagle0_accounts_data";
-
-        // Legacy keys for migration
-        private const string LegacyAccessTokenKey = "eagle0_access_token";
-        private const string LegacyRefreshTokenKey = "eagle0_refresh_token";
-        private const string LegacyExpiresAtKey = "eagle0_expires_at";
-        private const string LegacyUserIdKey = "eagle0_user_id";
-        private const string LegacyDisplayNameKey = "eagle0_display_name";
-
-        // In-memory cache
-        private static StoredAccountsData _accountsData;
-        private static bool _cacheInitialized = false;
-
-        /// <summary>
-        /// Initialize cache from PlayerPrefs. Must be called from main thread.
-        /// Call this early in app startup (e.g., in Awake or Start).
-        /// </summary>
-        public static void InitializeCache() {
-            var json = PlayerPrefs.GetString(AccountsDataKey, "");
-
-            if (!string.IsNullOrEmpty(json)) {
-                try {
-                    _accountsData = JsonUtility.FromJson<StoredAccountsData>(json);
-                } catch (Exception ex) {
-                    Debug.LogWarning($"[TokenStorage] Failed to parse accounts data: {ex.Message}");
-                    _accountsData = new StoredAccountsData();
-                }
-            } else {
-                _accountsData = new StoredAccountsData();
-                // Try to migrate legacy single-account data
-                MigrateLegacyData();
-            }
-
-            _cacheInitialized = true;
-            Debug.Log(
-                    $"[TokenStorage] Cache initialized, {_accountsData.Accounts.Count} accounts stored");
-        }
-
-        private static void MigrateLegacyData() {
-            var legacyAccessToken = PlayerPrefs.GetString(LegacyAccessTokenKey, "");
-            if (string.IsNullOrEmpty(legacyAccessToken)) return;
-
-            var legacyRefreshToken = PlayerPrefs.GetString(LegacyRefreshTokenKey, "");
-            var legacyExpiresAt =
-                    long.TryParse(PlayerPrefs.GetString(LegacyExpiresAtKey, "0"), out var val) ? val
-                                                                                               : 0;
-            var legacyUserId = PlayerPrefs.GetString(LegacyUserIdKey, "");
-            var legacyDisplayName = PlayerPrefs.GetString(LegacyDisplayNameKey, "");
-
-            if (!string.IsNullOrEmpty(legacyUserId)) {
-                // Assume discord for legacy data (most common)
-                var account = new StoredAccount {
-                    Provider = "discord",
-                    UserId = legacyUserId,
-                    DisplayName = legacyDisplayName,
-                    AccessToken = legacyAccessToken,
-                    RefreshToken = legacyRefreshToken,
-                    ExpiresAt = legacyExpiresAt
-                };
-                _accountsData.Accounts.Add(account);
-                _accountsData.CurrentAccountKey = account.AccountKey;
-                SaveAccountsData();
-
-                // Clear legacy keys
-                PlayerPrefs.DeleteKey(LegacyAccessTokenKey);
-                PlayerPrefs.DeleteKey(LegacyRefreshTokenKey);
-                PlayerPrefs.DeleteKey(LegacyExpiresAtKey);
-                PlayerPrefs.DeleteKey(LegacyUserIdKey);
-                PlayerPrefs.DeleteKey(LegacyDisplayNameKey);
-                PlayerPrefs.Save();
-
-                Debug.Log($"[TokenStorage] Migrated legacy account: {account.DisplayName}");
-            }
-        }
-
-        private static void SaveAccountsData() {
-            var json = JsonUtility.ToJson(_accountsData);
-            PlayerPrefs.SetString(AccountsDataKey, json);
-            PlayerPrefs.Save();
-        }
-
-        /// <summary>
-        /// Get all stored accounts.
-        /// </summary>
-        public static IReadOnlyList<StoredAccount> GetAllAccounts() {
-            EnsureInitialized();
-            return _accountsData.Accounts.AsReadOnly();
-        }
-
-        /// <summary>
-        /// Get the currently active account, or null if none selected.
-        /// </summary>
-        public static StoredAccount CurrentAccount {
-            get {
-                EnsureInitialized();
-                if (string.IsNullOrEmpty(_accountsData.CurrentAccountKey)) return null;
-                return _accountsData.Accounts.Find(
-                        a => a.AccountKey == _accountsData.CurrentAccountKey);
-            }
-        }
-
-        /// <summary>
-        /// Select an account as the current active account.
-        /// </summary>
-        public static void SelectAccount(string accountKey) {
-            EnsureInitialized();
-            var account = _accountsData.Accounts.Find(a => a.AccountKey == accountKey);
-            if (account != null) {
-                _accountsData.CurrentAccountKey = accountKey;
-                SaveAccountsData();
-                Debug.Log($"[TokenStorage] Selected account: {account.DisplayName}");
-            }
-        }
-
-        /// <summary>
-        /// Clear the current account selection (logout without deleting tokens).
-        /// </summary>
-        public static void ClearCurrentAccount() {
-            EnsureInitialized();
-            _accountsData.CurrentAccountKey = null;
-            SaveAccountsData();
-            Debug.Log("[TokenStorage] Cleared current account selection");
-        }
-
-        /// <summary>
-        /// Remove a specific account and its tokens.
-        /// </summary>
-        public static void RemoveAccount(string accountKey) {
-            EnsureInitialized();
-            var removed = _accountsData.Accounts.RemoveAll(a => a.AccountKey == accountKey);
-            if (_accountsData.CurrentAccountKey == accountKey) {
-                _accountsData.CurrentAccountKey = null;
-            }
-            if (removed > 0) {
-                SaveAccountsData();
-                Debug.Log($"[TokenStorage] Removed account: {accountKey}");
-            }
-        }
-
-        // Compatibility properties that reference the current account
-
-        public static bool HasValidToken => CurrentAccount?.HasValidToken ?? false;
-
-        public static bool HasRefreshToken => CurrentAccount?.HasRefreshToken ?? false;
-
-        public static string AccessToken => CurrentAccount?.AccessToken;
-
-        public static string RefreshToken => CurrentAccount?.RefreshToken;
-
-        public static long ExpiresAt => CurrentAccount?.ExpiresAt ?? 0;
-
-        public static string UserId => CurrentAccount?.UserId;
-
-        public static string DisplayName => CurrentAccount?.DisplayName;
-
-        public static bool NeedsRefresh => CurrentAccount?.NeedsRefresh ?? false;
-
-        /// <summary>
-        /// Store tokens for an account. Creates new or updates existing.
-        /// </summary>
-        public static void StoreTokens(
-                string accessToken,
-                string refreshToken,
-                long expiresAt,
-                string userId,
-                string displayName,
-                string provider = "discord") {
-            EnsureInitialized();
-
-            var accountKey = $"{provider}:{userId}";
-            var existingAccount = _accountsData.Accounts.Find(a => a.AccountKey == accountKey);
-
-            if (existingAccount != null) {
-                existingAccount.AccessToken = accessToken;
-                existingAccount.RefreshToken = refreshToken;
-                existingAccount.ExpiresAt = expiresAt;
-                existingAccount.DisplayName = displayName;
-            } else {
-                var newAccount = new StoredAccount {
-                    Provider = provider,
-                    UserId = userId,
-                    DisplayName = displayName,
-                    AccessToken = accessToken,
-                    RefreshToken = refreshToken,
-                    ExpiresAt = expiresAt
-                };
-                _accountsData.Accounts.Add(newAccount);
-            }
-
-            // Set as current account
-            _accountsData.CurrentAccountKey = accountKey;
-            SaveAccountsData();
-
-            Debug.Log($"[TokenStorage] Stored tokens for {displayName} ({provider})");
-        }
-
-        /// <summary>
-        /// Update access token after refresh for the current account.
-        /// </summary>
-        public static void UpdateAccessToken(string accessToken, long expiresAt) {
-            EnsureInitialized();
-            var account = CurrentAccount;
-            if (account != null) {
-                account.AccessToken = accessToken;
-                account.ExpiresAt = expiresAt;
-                SaveAccountsData();
-                Debug.Log($"[TokenStorage] Updated access token (expires at {expiresAt})");
-            }
-        }
-
-        /// <summary>
-        /// Update access token for a specific account (by key).
-        /// </summary>
-        public static void
-        UpdateAccessTokenForAccount(string accountKey, string accessToken, long expiresAt) {
-            EnsureInitialized();
-            var account = _accountsData.Accounts.Find(a => a.AccountKey == accountKey);
-            if (account != null) {
-                account.AccessToken = accessToken;
-                account.ExpiresAt = expiresAt;
-                SaveAccountsData();
-                Debug.Log(
-                        $"[TokenStorage] Updated access token for {account.DisplayName} (expires at {expiresAt})");
-            }
-        }
-
-        /// <summary>
-        /// Update display name for the current account.
-        /// </summary>
-        public static void UpdateDisplayName(string displayName) {
-            EnsureInitialized();
-            var account = CurrentAccount;
-            if (account != null) {
-                account.DisplayName = displayName;
-                SaveAccountsData();
-            }
-        }
-
-        /// <summary>
-        /// Clear all stored accounts (full reset).
-        /// </summary>
-        public static void ClearAll() {
-            _accountsData = new StoredAccountsData();
-            PlayerPrefs.DeleteKey(AccountsDataKey);
-            PlayerPrefs.Save();
-            Debug.Log("[TokenStorage] Cleared all accounts");
-        }
-
-        /// <summary>
-        /// Legacy Clear method - now just clears current selection, not tokens.
-        /// </summary>
-        public static void Clear() { ClearCurrentAccount(); }
-
-        private static void EnsureInitialized() {
-            if (!_cacheInitialized) {
-                Debug.LogWarning("[TokenStorage] Cache not initialized, initializing now");
-                InitializeCache();
-            }
-        }
-    }
-}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/TokenStorage.cs.meta

@@ -1,2 +0,0 @@
-fileFormatVersion: 2
-guid: 4b1f130cec656466893fa04ba789d34f

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/AvailableGame item prefab.prefab

@@ -29,9 +29,9 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 616210323856016607}
+  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -105,23 +105,20 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
-  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_TextWrappingMode: 1
+  m_enableWordWrapping: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
-  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
-  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -188,9 +185,9 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 616210323856016607}
+  m_RootOrder: 2
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -264,23 +261,20 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
-  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_TextWrappingMode: 1
+  m_enableWordWrapping: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
-  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
-  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -350,10 +344,10 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
   m_Children:
   - {fileID: 1806945232979884877}
   m_Father: {fileID: 616210323856016607}
+  m_RootOrder: 3
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -431,7 +425,6 @@ MonoBehaviour:
     atime6: 0
     atime7: 0
     m_Mode: 0
-    m_ColorSpace: -1
     m_NumColorKeys: 2
     m_NumAlphaKeys: 2
   _gradientType: 0
@@ -571,9 +564,9 @@ RectTransform:
   m_LocalRotation: {x: -0, y: -0, z: -0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 7057983938046569337}
+  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 1, y: 1}
@@ -647,23 +640,20 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
-  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_TextWrappingMode: 1
+  m_enableWordWrapping: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
-  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
-  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -711,15 +701,13 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
   m_Children:
   - {fileID: 2291298599107070085}
   - {fileID: 8906549728612534620}
   - {fileID: 6686534948942979506}
-  - {fileID: 6700597635350808166}
-  - {fileID: 8218751192785770547}
   - {fileID: 7057983938046569337}
   m_Father: {fileID: 0}
+  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 1, y: 1}
@@ -808,295 +796,31 @@ MonoBehaviour:
   playerCountField: {fileID: 8350902200036365361}
   joinButton: {fileID: 437043893514773017}
   buttonText: {fileID: 2170549136187147757}
-  dropButton: {fileID: 19903828017934214}
---- !u!1 &7127645211350815762
-GameObject:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  serializedVersion: 6
-  m_Component:
-  - component: {fileID: 8218751192785770547}
-  - component: {fileID: 3533697289353260343}
-  m_Layer: 5
-  m_Name: spacer
-  m_TagString: Untagged
-  m_Icon: {fileID: 0}
-  m_NavMeshLayer: 0
-  m_StaticEditorFlags: 0
-  m_IsActive: 1
---- !u!224 &8218751192785770547
-RectTransform:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 7127645211350815762}
-  m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
-  m_LocalPosition: {x: 0, y: 0, z: 0}
-  m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
-  m_Children: []
-  m_Father: {fileID: 616210323856016607}
-  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
-  m_AnchorMin: {x: 0, y: 0}
-  m_AnchorMax: {x: 0, y: 0}
-  m_AnchoredPosition: {x: 0, y: 0}
-  m_SizeDelta: {x: 0, y: 0}
-  m_Pivot: {x: 0.5, y: 0.5}
---- !u!114 &3533697289353260343
+--- !u!114 &2580770409874757745
 MonoBehaviour:
   m_ObjectHideFlags: 0
   m_CorrespondingSourceObject: {fileID: 0}
   m_PrefabInstance: {fileID: 0}
   m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 7127645211350815762}
-  m_Enabled: 1
-  m_EditorHideFlags: 0
-  m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
-  m_Name: 
-  m_EditorClassIdentifier: UnityEngine.UI::UnityEngine.UI.LayoutElement
-  m_IgnoreLayout: 0
-  m_MinWidth: 10
-  m_MinHeight: -1
-  m_PreferredWidth: 10
-  m_PreferredHeight: -1
-  m_FlexibleWidth: -1
-  m_FlexibleHeight: -1
-  m_LayoutPriority: 1
---- !u!1 &7934454793097069971
-GameObject:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  serializedVersion: 6
-  m_Component:
-  - component: {fileID: 6700597635350808166}
-  - component: {fileID: 5023923008883954850}
-  - component: {fileID: 19903828017934214}
-  - component: {fileID: 2151248441631091217}
-  - component: {fileID: 7406323257372084547}
-  m_Layer: 5
-  m_Name: Drop Game Button
-  m_TagString: Untagged
-  m_Icon: {fileID: 0}
-  m_NavMeshLayer: 0
-  m_StaticEditorFlags: 0
-  m_IsActive: 1
---- !u!224 &6700597635350808166
-RectTransform:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 7934454793097069971}
-  m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
-  m_LocalPosition: {x: 0, y: 0, z: 0}
-  m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
-  m_Children:
-  - {fileID: 1846732971937087380}
-  m_Father: {fileID: 616210323856016607}
-  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
-  m_AnchorMin: {x: 0, y: 0}
-  m_AnchorMax: {x: 0, y: 0}
-  m_AnchoredPosition: {x: 0, y: 0}
-  m_SizeDelta: {x: 0, y: 0}
-  m_Pivot: {x: 0.5, y: 0.5}
---- !u!222 &5023923008883954850
-CanvasRenderer:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 7934454793097069971}
-  m_CullTransparentMesh: 0
---- !u!114 &19903828017934214
-MonoBehaviour:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 7934454793097069971}
-  m_Enabled: 1
-  m_EditorHideFlags: 0
-  m_Script: {fileID: 11500000, guid: 4e29b1a8efbd4b44bb3f3716e73f07ff, type: 3}
-  m_Name: 
-  m_EditorClassIdentifier: 
-  m_Navigation:
-    m_Mode: 0
-    m_WrapAround: 0
-    m_SelectOnUp: {fileID: 0}
-    m_SelectOnDown: {fileID: 0}
-    m_SelectOnLeft: {fileID: 0}
-    m_SelectOnRight: {fileID: 0}
-  m_Transition: 1
-  m_Colors:
-    m_NormalColor: {r: 1, g: 0.42745098, b: 0.42745098, a: 1}
-    m_HighlightedColor: {r: 0.84313726, g: 0.84313726, b: 0.84313726, a: 1}
-    m_PressedColor: {r: 0, g: 0, b: 0, a: 1}
-    m_SelectedColor: {r: 0.84313726, g: 0.84313726, b: 0.84313726, a: 1}
-    m_DisabledColor: {r: 1, g: 1, b: 1, a: 0.39215687}
-    m_ColorMultiplier: 1
-    m_FadeDuration: 0.1
-  m_SpriteState:
-    m_HighlightedSprite: {fileID: 0}
-    m_PressedSprite: {fileID: 0}
-    m_SelectedSprite: {fileID: 0}
-    m_DisabledSprite: {fileID: 0}
-  m_AnimationTriggers:
-    m_NormalTrigger: Normal
-    m_HighlightedTrigger: Highlighted
-    m_PressedTrigger: Pressed
-    m_SelectedTrigger: Highlighted
-    m_DisabledTrigger: Disabled
-  m_Interactable: 1
-  m_TargetGraphic: {fileID: 2151248441631091217}
-  m_OnClick:
-    m_PersistentCalls:
-      m_Calls:
-      - m_Target: {fileID: 7332722509251528870}
-        m_TargetAssemblyTypeName: AvailableGameItem, Assembly-CSharp
-        m_MethodName: DropClicked
-        m_Mode: 1
-        m_Arguments:
-          m_ObjectArgument: {fileID: 0}
-          m_ObjectArgumentAssemblyTypeName: UnityEngine.Object, UnityEngine
-          m_IntArgument: 0
-          m_FloatArgument: 0
-          m_StringArgument: 
-          m_BoolArgument: 0
-        m_CallState: 2
---- !u!114 &2151248441631091217
-MonoBehaviour:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 7934454793097069971}
-  m_Enabled: 1
-  m_EditorHideFlags: 0
-  m_Script: {fileID: 11500000, guid: fe87c0e1cc204ed48ad3b37840f39efc, type: 3}
-  m_Name: 
-  m_EditorClassIdentifier: 
-  m_Material: {fileID: 0}
-  m_Color: {r: 1, g: 1, b: 1, a: 1}
-  m_RaycastTarget: 1
-  m_RaycastPadding: {x: 0, y: 0, z: 0, w: 0}
-  m_Maskable: 1
-  m_OnCullStateChanged:
-    m_PersistentCalls:
-      m_Calls: []
-  m_Sprite: {fileID: 21300000, guid: f03f625cc7127f244a2f4da835b92720, type: 3}
-  m_Type: 1
-  m_PreserveAspect: 0
-  m_FillCenter: 1
-  m_FillMethod: 4
-  m_FillAmount: 1
-  m_FillClockwise: 1
-  m_FillOrigin: 0
-  m_UseSpriteMesh: 0
-  m_PixelsPerUnitMultiplier: 1
---- !u!114 &7406323257372084547
-MonoBehaviour:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 7934454793097069971}
+  m_GameObject: {fileID: 8906549728612534621}
   m_Enabled: 1
   m_EditorHideFlags: 0
   m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
   m_Name: 
   m_EditorClassIdentifier: 
   m_IgnoreLayout: 0
-  m_MinWidth: 50
+  m_MinWidth: 700
   m_MinHeight: -1
-  m_PreferredWidth: 50
+  m_PreferredWidth: 700
   m_PreferredHeight: -1
-  m_FlexibleWidth: -1
+  m_FlexibleWidth: 1
   m_FlexibleHeight: -1
   m_LayoutPriority: 1
---- !u!1 &8839297347726735035
-GameObject:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  serializedVersion: 6
-  m_Component:
-  - component: {fileID: 1846732971937087380}
-  - component: {fileID: 2464975641276684442}
-  - component: {fileID: 4051352560264867900}
-  m_Layer: 5
-  m_Name: Icon
-  m_TagString: Untagged
-  m_Icon: {fileID: 0}
-  m_NavMeshLayer: 0
-  m_StaticEditorFlags: 0
-  m_IsActive: 1
---- !u!224 &1846732971937087380
-RectTransform:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 8839297347726735035}
-  m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
-  m_LocalPosition: {x: 0, y: 0, z: 0}
-  m_LocalScale: {x: 1, y: 1, z: 1}
-  m_ConstrainProportionsScale: 0
-  m_Children: []
-  m_Father: {fileID: 6700597635350808166}
-  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
-  m_AnchorMin: {x: 0, y: 0}
-  m_AnchorMax: {x: 1, y: 1}
-  m_AnchoredPosition: {x: 0, y: 0}
-  m_SizeDelta: {x: 0, y: 0}
-  m_Pivot: {x: 0.5, y: 0.5}
---- !u!222 &2464975641276684442
-CanvasRenderer:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 8839297347726735035}
-  m_CullTransparentMesh: 1
---- !u!114 &4051352560264867900
-MonoBehaviour:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 8839297347726735035}
-  m_Enabled: 1
-  m_EditorHideFlags: 0
-  m_Script: {fileID: 11500000, guid: 1344c3c82d62a2a41a3576d8abb8e3ea, type: 3}
-  m_Name: 
-  m_EditorClassIdentifier: UnityEngine.UI::UnityEngine.UI.RawImage
-  m_Material: {fileID: 0}
-  m_Color: {r: 0, g: 0, b: 0, a: 1}
-  m_RaycastTarget: 1
-  m_RaycastPadding: {x: 0, y: 0, z: 0, w: 0}
-  m_Maskable: 1
-  m_OnCullStateChanged:
-    m_PersistentCalls:
-      m_Calls: []
-  m_Texture: {fileID: 2800000, guid: 8c998213d53883d4b8fdf7a3eb3c2909, type: 3}
-  m_UVRect:
-    serializedVersion: 2
-    x: 0
-    y: 0
-    width: 1
-    height: 1
 --- !u!1001 &3324269289066796519
 PrefabInstance:
   m_ObjectHideFlags: 0
   serializedVersion: 2
   m_Modification:
-    serializedVersion: 3
     m_TransformParent: {fileID: 616210323856016607}
     m_Modifications:
     - target: {fileID: 6176764421848850767, guid: 59599ef87ad824f52ada88f126d58c5f,
@@ -1109,11 +833,6 @@ PrefabInstance:
       propertyPath: m_fontSizeBase
       value: 24
       objectReference: {fileID: 0}
-    - target: {fileID: 6176764421848850767, guid: 59599ef87ad824f52ada88f126d58c5f,
-        type: 3}
-      propertyPath: 'm_ActiveFontFeatures.Array.data[0]'
-      value: 1801810542
-      objectReference: {fileID: 0}
     - target: {fileID: 6176764421927073094, guid: 59599ef87ad824f52ada88f126d58c5f,
         type: 3}
       propertyPath: m_fontSize
@@ -1240,13 +959,6 @@ PrefabInstance:
       value: 0
       objectReference: {fileID: 0}
     m_RemovedComponents: []
-    m_RemovedGameObjects: []
-    m_AddedGameObjects: []
-    m_AddedComponents:
-    - targetCorrespondingSourceObject: {fileID: 6176764422977772730, guid: 59599ef87ad824f52ada88f126d58c5f,
-        type: 3}
-      insertIndex: -1
-      addedObject: {fileID: 2580770409874757745}
   m_SourcePrefab: {fileID: 100100000, guid: 59599ef87ad824f52ada88f126d58c5f, type: 3}
 --- !u!114 &8906549728612534595 stripped
 MonoBehaviour:
@@ -1272,23 +984,3 @@ GameObject:
     type: 3}
   m_PrefabInstance: {fileID: 3324269289066796519}
   m_PrefabAsset: {fileID: 0}
---- !u!114 &2580770409874757745
-MonoBehaviour:
-  m_ObjectHideFlags: 0
-  m_CorrespondingSourceObject: {fileID: 0}
-  m_PrefabInstance: {fileID: 0}
-  m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 8906549728612534621}
-  m_Enabled: 1
-  m_EditorHideFlags: 0
-  m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
-  m_Name: 
-  m_EditorClassIdentifier: 
-  m_IgnoreLayout: 0
-  m_MinWidth: 700
-  m_MinHeight: -1
-  m_PreferredWidth: 700
-  m_PreferredHeight: -1
-  m_FlexibleWidth: 1
-  m_FlexibleHeight: -1
-  m_LayoutPriority: 1

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/AvailableGameItem.cs

@@ -16,10 +16,8 @@ public class AvailableGameItem : MonoBehaviour {
     public TextMeshProUGUI playerCountField;
     public Button joinButton;
     public TextMeshProUGUI buttonText;
-    public Button dropButton;
 
     public Action<long, string> JoinCallback;
-    public Action<long> DropCallback;
 
     private List<AvailableLeader> availableLeaders;
     private long gameId;
@@ -40,8 +38,6 @@ public class AvailableGameItem : MonoBehaviour {
 
     public void JoinClicked() { JoinCallback(gameId, SelectedLeaderTextId); }
 
-    public void DropClicked() { DropCallback?.Invoke(gameId); }
-
     public void
     SetAvailableNewGame(long gameId, string playersString, List<AvailableLeader> leaders) {
         availableLeaders = leaders;

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/ConnectionHandler.cs

@@ -7,18 +7,15 @@ using System.Net.Http.Headers;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
-using Auth;
 using common;
 using common.GUIUtils;
 using eagle;
 using Grpc.Core;
 using Grpc.Core.Interceptors;
 using Net.Eagle0.Eagle.Api;
-using Net.Eagle0.Eagle.Api.Auth;
 using TMPro;
 using UnityEngine;
 using UnityEngine.SceneManagement;
-using UnityEngine.UI;
 using Object = System.Object;
 
 public class AuthInterceptor : Interceptor {
@@ -80,47 +77,16 @@ public class AuthInterceptor : Interceptor {
 };
 
 public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
+    public TMP_InputField urlField;
+    public TMP_InputField nameField;
+    public TMP_InputField passwordField;
     public TMP_Dropdown resolutionDropdown;
 
-    [Header("OAuth UI")]
-    public GameObject oauthPanel;
-    public Button discordLoginButton;
-    public Button googleLoginButton;
-    public TextMeshProUGUI oauthStatusText;
-
-    [Header("Stored Accounts")]
-    public GameObject storedAccountsContainer;
-    public GameObject storedAccountButtonPrefab;
-    public Sprite discordProviderIcon;
-    public Sprite googleProviderIcon;
-
-    [Header("Display Name Setup")]
-    public GameObject displayNamePanel;
-    public TMP_InputField displayNameField;
-    public Button setDisplayNameButton;
-    public TextMeshProUGUI displayNameErrorText;
-
-    [Header("Invitation Code Entry")]
-    public GameObject invitationCodePanel;
-    public TMP_InputField invitationCodeField;
-    public Button submitInvitationCodeButton;
-    public TextMeshProUGUI invitationCodeErrorText;
-
-    [Header("Status Display")]
-    public TextMeshProUGUI connectionStatusText;
-
     public GameObject connectionPanel;
     public GameObject gameSelectionPanel;
     public GameObject customBattlePanel;
     public ErrorHandler errorHandler;
 
-    [Header("Lobby Controls")]
-    public Button logoutButton;
-    public Button customBattleButton;
-    public Button cancelCustomBattleButton;
-    public TMP_Dropdown lobbyEnvironmentDropdown;
-    public TextMeshProUGUI lobbyUserText;
-
     public GameObject runningGamesListArea;
     public GameObject runningGamesListItemPrefab;
 
@@ -129,8 +95,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
     public GameObject waitingGamesListItemPrefab;
     public GameObject createGameListItemPrefab;
 
-    public DropGameConfirmationPanel dropGameConfirmationPanel;
-
     public Canvas connectionCanvas;
     public Canvas eagleCanvas;
     public Canvas shardokCanvas;
@@ -145,48 +109,14 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
     private bool listen = false;
     private CancellationTokenSource _cancellationTokenSource;
     private readonly Object pendingReplyLock = new Object();
-    private int _connectedEnvironmentIndex = -1;  // -1 means not connected
-    private List<GameObject> _storedAccountButtons = new List<GameObject>();
 
     public ClientPregeneratedText clientPregeneratedText;
 
-    const String BaseDomain = "eagle0.net";
-    const String EnvironmentKey = "environmentKey";
+    const String DefaultUrl = "eagle0.net";
+    const String URLKey = "urlKey";
     const String NameKey = "nameKey";
     const String PasswordKey = "passwordKey";
 
-    // Environment options: index 0 = prod., index 1 = qa., index 2 = (none)
-    private static readonly List<string> EnvironmentOptions = new() { "prod.", "qa.", "" };
-    private static readonly List<string> EnvironmentDisplayNames =
-            new() { "prod.", "qa.", "(none)" };
-
-    /// <summary>
-    /// Returns the connected environment name ("prod." or "qa.") or null if not connected.
-    /// </summary>
-    public string ConnectedEnvironmentName =>
-            _connectedEnvironmentIndex >= 0 &&
-                            _connectedEnvironmentIndex < EnvironmentDisplayNames.Count
-                    ? EnvironmentDisplayNames[_connectedEnvironmentIndex]
-                    : null;
-
-    private string GetUrlFromEnvironment() {
-        int envIndex = PlayerPrefs.GetInt(EnvironmentKey, 0);
-        string prefix = EnvironmentOptions[envIndex];
-        return prefix + BaseDomain;
-    }
-
-    /// <summary>
-    /// Get full URL with scheme for the selected environment (Eagle server).
-    /// Remote servers use HTTPS, could be extended for local HTTP.
-    /// </summary>
-    private string GetEagleUrl() { return "https://" + GetUrlFromEnvironment(); }
-
-    /// <summary>
-    /// Get full URL with scheme for the Go auth service.
-    /// Always uses prod auth service - OAuth tokens work across all environments.
-    /// </summary>
-    private string GetAuthServiceUrl() { return "https://prod.eagle0.net:40033"; }
-
     public void ReceiveLobbyUpdate(LobbyResponse lobbyResponse) {
         _handleLobbyResponse(lobbyResponse);
     }
@@ -203,6 +133,10 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         resolutionDropdown.AddOptions(resolutions.Select(r => $"{r.width} x {r.height}").ToList());
         resolutionDropdown.value = resolutions.ToList().IndexOf(currentResolution);
 
+        urlField.text = PlayerPrefs.GetString(URLKey, DefaultUrl);
+        nameField.text = PlayerPrefs.GetString(NameKey, "sample_name");
+        passwordField.text = PlayerPrefs.GetString(PasswordKey, "sample_password");
+
         connectionCanvas.gameObject.SetActive(true);
         eagleCanvas.gameObject.SetActive(false);
         shardokCanvas.gameObject.SetActive(false);
@@ -213,401 +147,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         customBattlePanel.gameObject.SetActive(false);
 
         errorHandler.gameObject.SetActive(true);
-
-        // Initialize OAuth UI
-        SetupOAuthUI();
-
-        // Initialize Lobby UI (logout button, etc.)
-        SetupLobbyUI();
-
-        // Initialize status text
-        UpdateConnectionStatus();
-
-        // Try to restore existing OAuth session
-        TryRestoreSession();
-    }
-
-    private void SetupOAuthUI() {
-        // Set up OAuth button click handlers for new sign-ins
-        if (discordLoginButton != null) {
-            discordLoginButton.onClick.AddListener(
-                    () => OnOAuthLoginClicked(OAuthProvider.Discord));
-        }
-        if (googleLoginButton != null) {
-            googleLoginButton.onClick.AddListener(() => OnOAuthLoginClicked(OAuthProvider.Google));
-        }
-        if (setDisplayNameButton != null) {
-            setDisplayNameButton.onClick.AddListener(OnSetDisplayNameClicked);
-        }
-        if (submitInvitationCodeButton != null) {
-            submitInvitationCodeButton.onClick.AddListener(OnSubmitInvitationCodeClicked);
-        }
-
-        // Subscribe to OAuthManager events
-        if (OAuthManager.Instance != null) {
-            OAuthManager.Instance.OnLoginSuccess += OnOAuthLoginSuccess;
-            OAuthManager.Instance.OnLoginFailed += OnOAuthLoginFailed;
-            OAuthManager.Instance.OnNewUserNeedsDisplayName += OnNewUserNeedsDisplayName;
-            OAuthManager.Instance.OnLogout += OnOAuthLogout;
-            OAuthManager.Instance.OnInvitationRequired += OnInvitationRequired;
-        }
-
-        // Show auth panel with stored accounts
-        ShowAuthPanel();
-    }
-
-    private void ShowAuthPanel() {
-        // Hide other panels
-        if (displayNamePanel != null) displayNamePanel.SetActive(false);
-        if (invitationCodePanel != null) invitationCodePanel.SetActive(false);
-
-        // Show OAuth panel
-        if (oauthPanel != null) oauthPanel.SetActive(true);
-
-        // Refresh stored account buttons
-        RefreshStoredAccountButtons();
-    }
-
-    private void RefreshStoredAccountButtons() {
-        // Clear existing buttons
-        foreach (var btn in _storedAccountButtons) {
-            if (btn != null) Destroy(btn);
-        }
-        _storedAccountButtons.Clear();
-
-        if (storedAccountsContainer == null || storedAccountButtonPrefab == null) return;
-
-        // Get stored accounts
-        var accounts = OAuthManager.Instance?.GetStoredAccounts();
-        if (accounts == null || accounts.Count == 0) return;
-
-        // Create button for each stored account
-        foreach (var account in accounts) {
-            var buttonObj =
-                    Instantiate(storedAccountButtonPrefab, storedAccountsContainer.transform);
-            buttonObj.transform.localScale = Vector3.one;
-
-            // Set button text (just display name, icon shows provider)
-            var buttonText = buttonObj.GetComponentInChildren<TextMeshProUGUI>();
-            if (buttonText != null) { buttonText.text = account.DisplayName; }
-
-            // Set provider icon (look for child named "ProviderIcon")
-            var providerIconTransform = buttonObj.transform.Find("ProviderIcon");
-            if (providerIconTransform != null) {
-                var providerImage = providerIconTransform.GetComponent<Image>();
-                if (providerImage != null) {
-                    var isGoogle = account.Provider.ToLowerInvariant() == "google";
-                    providerImage.sprite = isGoogle ? googleProviderIcon : discordProviderIcon;
-                }
-            }
-
-            // Set click handler
-            var button = buttonObj.GetComponent<Button>();
-            if (button != null) {
-                var accountCopy = account;  // Capture for lambda
-                button.onClick.AddListener(() => OnStoredAccountClicked(accountCopy));
-            }
-
-            _storedAccountButtons.Add(buttonObj);
-        }
-    }
-
-    private async void OnStoredAccountClicked(StoredAccount account) {
-        // Configure OAuthManager with URLs
-        OAuthManager.Instance.SetServerUrls(GetAuthServiceUrl(), GetEagleUrl());
-
-        if (oauthStatusText != null) {
-            oauthStatusText.text = $"Connecting as {account.DisplayName}...";
-        }
-
-        var success = await OAuthManager.Instance.ConnectWithStoredAccountAsync(account);
-        if (success) {
-            // OnLoginSuccess will handle connection to lobby
-        } else {
-            // Failed - might need re-auth, refresh the buttons
-            RefreshStoredAccountButtons();
-        }
-    }
-
-    private void SetupLobbyUI() {
-        if (logoutButton != null) { logoutButton.onClick.AddListener(OnLogoutClicked); }
-        if (customBattleButton != null) { customBattleButton.onClick.AddListener(CustomBattle); }
-        if (cancelCustomBattleButton != null) {
-            cancelCustomBattleButton.onClick.AddListener(CancelCustomBattle);
-        }
-
-        // Set up environment dropdown
-        if (lobbyEnvironmentDropdown != null) {
-            lobbyEnvironmentDropdown.ClearOptions();
-            lobbyEnvironmentDropdown.AddOptions(EnvironmentDisplayNames);
-            lobbyEnvironmentDropdown.value = PlayerPrefs.GetInt(EnvironmentKey, 0);
-            lobbyEnvironmentDropdown.onValueChanged.AddListener(OnLobbyEnvironmentChanged);
-        }
-    }
-
-    private void UpdateLobbyStatusDisplays() {
-        // Update environment dropdown selection
-        if (lobbyEnvironmentDropdown != null && _connectedEnvironmentIndex >= 0) {
-            // Temporarily remove listener to avoid triggering reconnect
-            lobbyEnvironmentDropdown.onValueChanged.RemoveListener(OnLobbyEnvironmentChanged);
-            lobbyEnvironmentDropdown.value = _connectedEnvironmentIndex;
-            lobbyEnvironmentDropdown.onValueChanged.AddListener(OnLobbyEnvironmentChanged);
-        }
-
-        // Show current user from OAuth
-        if (lobbyUserText != null) { lobbyUserText.text = TokenStorage.DisplayName ?? ""; }
-    }
-
-    private void OnLobbyEnvironmentChanged(int newEnvironmentIndex) {
-        if (newEnvironmentIndex == _connectedEnvironmentIndex) return;
-
-        Debug.Log(
-                $"[ConnectionHandler] Switching environment from {ConnectedEnvironmentName} to {EnvironmentDisplayNames[newEnvironmentIndex]}");
-
-        // Disconnect from current environment
-        _persistentClientConnection?.Dispose();
-        eagleConnection?.Dispose();
-        _httpClient?.Dispose();
-
-        _persistentClientConnection = null;
-        eagleConnection = null;
-        _httpClient = null;
-
-        // Update environment index and reconnect
-        _connectedEnvironmentIndex = newEnvironmentIndex;
-        PlayerPrefs.SetInt(EnvironmentKey, newEnvironmentIndex);
-
-        // Clear current game lists while reconnecting
-        foreach (Transform row in runningGamesListArea.transform) { Destroy(row.gameObject); }
-        foreach (Transform row in availableGamesListArea.transform) { Destroy(row.gameObject); }
-
-        // Reconnect to new environment
-        _createConnection();
-        RequestMaps();
-        StartListeningForLobbyUpdates();
-    }
-
-    private async void OnLogoutClicked() {
-        Debug.Log("[ConnectionHandler] Logout button clicked");
-
-        // Clear OAuth tokens
-        if (OAuthManager.Instance != null) { await OAuthManager.Instance.LogoutAsync(); }
-
-        // Disconnect from server
-        _persistentClientConnection?.Dispose();
-        eagleConnection?.Dispose();
-        _httpClient?.Dispose();
-        _cancellationTokenSource?.Dispose();
-
-        _persistentClientConnection = null;
-        eagleConnection = null;
-        _httpClient = null;
-        _cancellationTokenSource = null;
-        _connectedEnvironmentIndex = -1;
-
-        // Return to connection screen
-        gameSelectionPanel.SetActive(false);
-        connectionPanel.SetActive(true);
-
-        // Re-initialize the auth UI
-        ShowAuthPanel();
-        UpdateConnectionStatus();
-    }
-
-    private async void TryRestoreSession() {
-        if (OAuthManager.Instance == null) return;
-
-        // Configure OAuthManager with auth service and Eagle URLs
-        OAuthManager.Instance.SetServerUrls(GetAuthServiceUrl(), GetEagleUrl());
-
-        if (oauthStatusText != null) { oauthStatusText.text = "Checking for existing session..."; }
-
-        var restored = await OAuthManager.Instance.TryRestoreSessionAsync();
-        if (restored) {
-            // Session restored, connect to lobby
-            ConnectWithOAuth();
-        } else if (oauthStatusText != null) {
-            oauthStatusText.text = "";
-        }
-    }
-
-    private async void OnOAuthLoginClicked(OAuthProvider provider) {
-        // Configure OAuthManager with auth service and Eagle URLs (user may have changed dropdown)
-        OAuthManager.Instance.SetServerUrls(GetAuthServiceUrl(), GetEagleUrl());
-
-        if (oauthStatusText != null) {
-            oauthStatusText.text = $"Opening browser for {provider} login...";
-        }
-
-        try {
-            await OAuthManager.Instance.LoginAsync(provider);
-            // OnLoginSuccess or OnNewUserNeedsDisplayName will be called
-        } catch (Exception ex) {
-            Debug.LogError($"OAuth login failed: {ex.Message}");
-            if (oauthStatusText != null) { oauthStatusText.text = $"Login failed: {ex.Message}"; }
-        }
-    }
-
-    private void OnOAuthLoginSuccess(UserInfo user) {
-        MainQueue.Q.Enqueue(() => {
-            if (oauthStatusText != null) { oauthStatusText.text = $"Welcome, {user.DisplayName}!"; }
-            ConnectWithOAuth();
-        });
-    }
-
-    private void OnOAuthLoginFailed(string error) {
-        MainQueue.Q.Enqueue(() => {
-            if (oauthStatusText != null) { oauthStatusText.text = $"Login failed: {error}"; }
-        });
-    }
-
-    private void OnNewUserNeedsDisplayName(bool isNewUser) {
-        MainQueue.Q.Enqueue(() => {
-            // Show display name panel
-            if (oauthPanel != null) oauthPanel.SetActive(false);
-            if (invitationCodePanel != null) invitationCodePanel.SetActive(false);
-            if (displayNamePanel != null) displayNamePanel.SetActive(true);
-            if (displayNameErrorText != null) displayNameErrorText.text = "";
-        });
-    }
-
-    private void OnInvitationRequired() {
-        MainQueue.Q.Enqueue(() => {
-            // Show invitation code entry panel
-            if (oauthPanel != null) oauthPanel.SetActive(false);
-            if (displayNamePanel != null) displayNamePanel.SetActive(false);
-            if (invitationCodePanel != null) invitationCodePanel.SetActive(true);
-            if (invitationCodeErrorText != null) {
-                invitationCodeErrorText.text =
-                        "An invitation code is required to create a new account.";
-            }
-            if (invitationCodeField != null) invitationCodeField.text = "";
-        });
-    }
-
-    private void OnSubmitInvitationCodeClicked() {
-        if (invitationCodeField == null) return;
-
-        var code = invitationCodeField.text.Trim();
-        if (string.IsNullOrEmpty(code)) {
-            if (invitationCodeErrorText != null) {
-                invitationCodeErrorText.text = "Please enter an invitation code";
-            }
-            return;
-        }
-
-        // Save the code and return to login screen to retry
-        InvitationCodeManager.SetInvitationCode(code);
-
-        if (invitationCodeErrorText != null) {
-            invitationCodeErrorText.text = "Code saved. Please sign in again.";
-        }
-
-        // Return to auth panel after a short delay
-        MainQueue.Q.Enqueue(() => {
-            if (oauthStatusText != null) {
-                oauthStatusText.text = "Invitation code saved. Please sign in to continue.";
-            }
-            ShowAuthPanel();
-        });
-    }
-
-    private async void OnSetDisplayNameClicked() {
-        if (displayNameField == null || OAuthManager.Instance == null) return;
-
-        var displayName = displayNameField.text.Trim();
-        if (string.IsNullOrEmpty(displayName)) {
-            if (displayNameErrorText != null) {
-                displayNameErrorText.text = "Please enter a display name";
-            }
-            return;
-        }
-
-        if (displayNameErrorText != null) { displayNameErrorText.text = "Setting display name..."; }
-
-        var success = await OAuthManager.Instance.SetDisplayNameAsync(displayName);
-        if (!success && displayNameErrorText != null) {
-            displayNameErrorText.text = "Name already taken or invalid. Try another.";
-        }
-        // OnLoginSuccess will be called if successful
-    }
-
-    private void OnOAuthLogout() {
-        MainQueue.Q.Enqueue(() => {
-            ShowAuthPanel();
-            if (oauthStatusText != null) { oauthStatusText.text = ""; }
-        });
-    }
-
-    private void ConnectWithOAuth() { _internalConnectEagle(); }
-
-    private float _statusUpdateTimer = 0f;
-    private const float StatusUpdateInterval = 0.5f;
-
-    void Update() {
-        // Only update status periodically and when connection panel is visible
-        if (!connectionPanel.activeInHierarchy) return;
-
-        _statusUpdateTimer += Time.deltaTime;
-        if (_statusUpdateTimer >= StatusUpdateInterval) {
-            _statusUpdateTimer = 0f;
-            UpdateConnectionStatus();
-        }
-    }
-
-    private void UpdateConnectionStatus() {
-        if (connectionStatusText == null) return;
-
-        // No connection yet - show nothing
-        if (_persistentClientConnection == null) {
-            connectionStatusText.text = "";
-            return;
-        }
-
-        var circuitState = _persistentClientConnection.CircuitBreaker.CurrentState;
-        var connState = _persistentClientConnection.CurrentState;
-
-        // Circuit breaker takes precedence
-        if (circuitState == eagle.ConnectionCircuitBreaker.State.Open) {
-            var nextTest = _persistentClientConnection.CircuitBreaker.NextTestAttempt;
-            if (nextTest.HasValue) {
-                var timeUntilTest = nextTest.Value - DateTime.UtcNow;
-                if (timeUntilTest.TotalSeconds > 0) {
-                    int seconds = Math.Min(10, (int)Math.Ceiling(timeUntilTest.TotalSeconds));
-                    connectionStatusText.text =
-                            $"<color=red>●</color> Server unavailable. Retry in {seconds}s";
-                    return;
-                }
-            }
-            connectionStatusText.text = "<color=red>●</color> Server unavailable";
-            return;
-        }
-
-        if (circuitState == eagle.ConnectionCircuitBreaker.State.HalfOpen) {
-            connectionStatusText.text = "<color=yellow>●</color> Testing connection...";
-            return;
-        }
-
-        // Normal connection states
-        connectionStatusText.text = connState switch {
-            eagle.ConnectionState.Connected => "<color=green>●</color> Connected",
-            eagle.ConnectionState.Connecting => "<color=yellow>●</color> Connecting...",
-            eagle.ConnectionState.Disconnected => "<color=red>●</color> Disconnected",
-            eagle.ConnectionState.Reconnecting => GetReconnectingText(),
-            eagle.ConnectionState.SubscriptionPending => "<color=yellow>●</color> Subscribing...",
-            _ => ""
-        };
-    }
-
-    private string GetReconnectingText() {
-        var nextAttempt = _persistentClientConnection?.NextReconnectAttempt;
-        if (!nextAttempt.HasValue) return "<color=yellow>●</color> Reconnecting...";
-
-        var timeUntilRetry = nextAttempt.Value - DateTime.UtcNow;
-        if (timeUntilRetry.TotalSeconds <= 0) { return "<color=yellow>●</color> Reconnecting..."; }
-
-        int seconds = Math.Min(10, (int)Math.Ceiling(timeUntilRetry.TotalSeconds));
-        return $"<color=orange>●</color> Retry in {seconds}s";
     }
 
     public void EditorButtonClicked() { SceneManager.LoadScene("Map Editor"); }
@@ -616,14 +155,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
 
     public void CustomBattle() { _internalCustomBattle(); }
 
-    public void CancelCustomBattle() {
-        customBattlePanel.SetActive(false);
-        shardokCanvas.gameObject.SetActive(false);
-        connectionCanvas.gameObject.SetActive(true);
-        gameSelectionPanel.SetActive(true);
-        StartListeningForLobbyUpdates();
-    }
-
     public void OnApplicationQuit() { Dispose(); }
 
     public void Dispose() {
@@ -641,8 +172,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         _persistentClientConnection = null;
         eagleConnection?.Dispose();
         eagleConnection = null;
-
-        _connectedEnvironmentIndex = -1;
     }
 
     public void OnResolutionChanged(int dropdownIndex) {
@@ -670,9 +199,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
             connectionPanel.gameObject.SetActive(false);
             gameSelectionPanel.gameObject.SetActive(true);
 
-            // Update lobby status displays
-            UpdateLobbyStatusDisplays();
-
             // Set up running games table
             foreach (Transform row in runningGamesListArea.transform) { Destroy(row.gameObject); }
             foreach (var runningGame in lobbyResponse.RunningGames) {
@@ -681,10 +207,10 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
                         runningGamesListArea.transform,
                         true);
                 listItem.transform.localScale = new Vector3 { x = 1.0f, y = 1.0f, z = 1.0f };
-                var runningGameItem = listItem.GetComponent<RunningGameItem>();
-                runningGameItem.SetRunningGame(runningGame.GameId, runningGame.Leader);
-                runningGameItem.GoCallback = this.SelectEagleGame;
-                runningGameItem.DropCallback = this.DropGame;
+                listItem.GetComponent<RunningGameItem>().SetRunningGame(
+                        runningGame.GameId,
+                        runningGame.Leader);
+                listItem.GetComponent<RunningGameItem>().GoCallback = this.SelectEagleGame;
             }
 
             // Set up available/waiting games table
@@ -720,16 +246,14 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
                         availableGamesListArea.transform,
                         true);
                 listItem.transform.localScale = new Vector3 { x = 1.0f, y = 1.0f, z = 1.0f };
-                var availableGameItem = listItem.GetComponent<AvailableGameItem>();
-                availableGameItem.SetAvailableNewGame(
+                listItem.GetComponent<AvailableGameItem>().SetAvailableNewGame(
                         availableGame.GameId,
                         string.Format(
                                 "{0} / {1}",
                                 availableGame.CurrentHumanPlayerCount,
                                 availableGame.MaxHumanPlayerCount),
                         availableGame.AvailableLeaders.ToList());
-                availableGameItem.JoinCallback = this.JoinGame;
-                availableGameItem.DropCallback = this.DropGame;
+                listItem.GetComponent<AvailableGameItem>().JoinCallback = this.JoinGame;
             }
         });
     }
@@ -743,7 +267,9 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
     }
 
     private void _createConnection() {
-        _connectedEnvironmentIndex = PlayerPrefs.GetInt(EnvironmentKey, 0);
+        PlayerPrefs.SetString(URLKey, urlField.text);
+        PlayerPrefs.SetString(NameKey, nameField.text);
+        PlayerPrefs.SetString(PasswordKey, passwordField.text);
 
         // Dispose existing connections before creating new ones
         _httpClient?.Dispose();
@@ -754,20 +280,7 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         // Initialize cancellation token for thread management
         _cancellationTokenSource = new CancellationTokenSource();
 
-        string url = GetUrlFromEnvironment();
-
-        // OAuth JWT-based connection
-        if (!TokenStorage.HasValidToken) {
-            Debug.LogError("[ConnectionHandler] No valid token available for connection");
-            return;
-        }
-
-        eagleConnection = EagleConnection.CreateWithJwt(url);
-
-        _httpClient = new HttpClient();
-        _httpClient.DefaultRequestHeaders.Authorization =
-                new AuthenticationHeaderValue("Bearer", TokenStorage.AccessToken);
-
+        eagleConnection = new EagleConnection(nameField.text, passwordField.text, urlField.text);
         _persistentClientConnection = new PersistentClientConnection(
                 eagleConnection.EagleGrpcClient,
                 eagleConnection.credentials,
@@ -775,16 +288,20 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         _persistentClientConnection.Connect();
 
         errorHandler.PersistentClientConnection = _persistentClientConnection;
+
+        _httpClient = new HttpClient();
+        _httpClient.DefaultRequestHeaders.Authorization =
+                new AuthenticationHeaderValue("Basic", eagleConnection.authHeader);
         ResourceFetcher.SetUpConnection(_httpClient);
     }
 
     private void _internalCustomBattle() {
-        // Connection already exists when called from lobby
+        _createConnection();
         _persistentClientConnection.SetLobbySubscriber(this);
 
         SetCustomBattleActive(true);
 
-        gameSelectionPanel.SetActive(false);
+        connectionPanel.SetActive(false);
         customBattlePanel.SetActive(true);
     }
 
@@ -832,18 +349,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         var game = _internalJoinEagleGame(gameId, leaderName);
     }
 
-    private void DropGame(long gameId) {
-        if (dropGameConfirmationPanel != null) {
-            dropGameConfirmationPanel.OnConfirm = ConfirmDropGame;
-            dropGameConfirmationPanel.Show(gameId, "Are you sure you want to leave this game?");
-        } else {
-            // Fallback if no confirmation panel is configured
-            ConfirmDropGame(gameId);
-        }
-    }
-
-    private void ConfirmDropGame(long gameId) { _internalDropGame(gameId); }
-
     private void CreateGame(string leaderNameTextId, int humanPlayerCount, int totalPlayerCount) {
         var game = _internalCreateGame(leaderNameTextId, humanPlayerCount, totalPlayerCount);
     }
@@ -920,18 +425,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         }
     }
 
-    private async Task<bool> _internalDropGame(long gameId) {
-        try {
-            return await _persistentClientConnection.SendUpdateStreamRequestAsync(
-                    new UpdateStreamRequest {
-                        DropGameRequest = new DropGameRequest { GameId = gameId }
-                    });
-        } catch (WebException e) {
-            Debug.Log(String.Format("Caught exception in DropGame {0}", e.Message));
-            return false;
-        }
-    }
-
     private void SetLobbyActive(bool active) {
         runningGamesListArea.SetActive(active);
         availableGamesListArea.SetActive(active);
@@ -949,8 +442,7 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
             eagleCanvas.GetComponent<EagleGameController>().SetUpGame(
                     gameInfo.GameId,
                     gameInfo.FactionId,
-                    _persistentClientConnection,
-                    ConnectedEnvironmentName);
+                    _persistentClientConnection);
             connectionCanvas.enabled = false;
             connectionCanvas.gameObject.SetActive(false);
             eagleCanvas.gameObject.SetActive(true);

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/CustomBattleHandler.cs

@@ -174,8 +174,7 @@ public class CustomBattleHandler : MonoBehaviour, IClientConnectionSubscriber {
         });
     }
 
-    // Fire-and-forget - subscription is awaited internally and failures are logged
-    private void Register() { _ = _persistentClientConnection.Subscribe(this); }
+    private void Register() { _persistentClientConnection.Subscribe(this); }
 
     public GameId? CurrentShardokToken(string shardokGameId) { return _shardokModel.History.Count; }
 
@@ -188,14 +187,9 @@ public class CustomBattleHandler : MonoBehaviour, IClientConnectionSubscriber {
                 case GameUpdate.GameUpdateDetailsOneofCase.ShardokActionResultResponse:
                     foreach (var resp in gameUpdate.ShardokActionResultResponse
                                      .ShardokGameResponses) {
-                        var updatesOk = _shardokModel.HandleUpdates(
+                        _shardokModel.HandleUpdates(
                                 resp.ActionResultViews,
                                 resp.NewResultViewCount);
-                        if (!updatesOk) {
-                            // In custom battle mode, just clear and continue
-                            _shardokModel.History.Clear();
-                            continue;
-                        }
                         _shardokModel.HandleAvailableCommands(resp.AvailableCommands);
                     }
 
@@ -449,7 +443,4 @@ public class CustomBattleHandler : MonoBehaviour, IClientConnectionSubscriber {
             } };
 
     public List<IClientConnectionSubscriber.StreamingTextStatus> StreamingTextStatuses => new();
-
-    // CustomBattleHandler only handles Shardok updates, not Eagle, so no count to update
-    public void UpdateResultCounts(GameUpdate update) {}
 }