Add nginx proxy for admin server at /admin/

The admin server was exposed on port 8080 without TLS, making it
inaccessible from networks/browsers that block non-HTTPS traffic.

This adds an nginx route to proxy admin requests through HTTPS at
https://prod.eagle0.net/admin/

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.bazelrc

@@ -26,8 +26,8 @@ common --host_cxxopt="--std=c++23"
 common --javacopt="-Xlint:-options"
 
 # suppress warnings due to https://developer.apple.com/forums/thread/733317
-common --linkopt=-Wl
-common:macos --linkopt=-Wl,-no_warn_duplicate_libraries
+# Use host_linkopt for macOS-specific flags to avoid passing them to Linux cross-compilation
+common:macos --host_linkopt=-Wl,-no_warn_duplicate_libraries
 
 # Fix Xcode version caching issue - avoids need for `bazel clean --expunge` after Xcode updates
 common:macos --repo_env=DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
@@ -36,3 +36,7 @@ common --java_language_version=17
 common --java_runtime_version=remotejdk_17
 common --tool_java_language_version=17
 common --tool_java_runtime_version=remotejdk_17
+
+# Workspace status for build stamping (git commit, timestamp)
+common --workspace_status_command=tools/workspace_status.sh
+common --stamp

.github/workflows/cloudflare_oauth_relay.yml

@@ -0,0 +1,24 @@
+name: Deploy OAuth Relay Worker
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'cloudflare/oauth-relay/**'
+  workflow_dispatch:  # Allow manual trigger
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    name: Deploy to Cloudflare Workers
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Deploy Worker
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          workingDirectory: cloudflare/oauth-relay

.github/workflows/docker_build.yml

@@ -5,11 +5,14 @@ on:
     branches: [ "main" ]
     paths:
       - 'src/main/cpp/**'
+      - 'src/main/go/**'
       - 'src/main/scala/**'
       - 'src/main/protobuf/**'
       - 'src/main/resources/**'
       - 'ci/BUILD.bazel'
       - 'MODULE.bazel'
+      - 'docker-compose.prod.yml'
+      - 'nginx/**'
       - '.github/workflows/docker_build.yml'
   workflow_dispatch:
     inputs:
@@ -25,6 +28,8 @@ permissions:
 jobs:
   build-eagle:
     runs-on: self-hosted
+    outputs:
+      image_tag: ${{ steps.push-eagle.outputs.image_tag }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -32,7 +37,15 @@ jobs:
           lfs: false
 
       - name: Build Eagle Docker image
-        run: bazel build //ci:eagle_server_image
+        id: build-eagle
+        run: |
+          set -ex
+          bazel build --platforms=//:linux_x86_64 //ci:eagle_server_image
+
+          # Save the resolved path before any other bazel command changes bazel-bin symlink
+          IMAGE_PATH=$(readlink -f bazel-bin/ci/eagle_server_image)
+          echo "Image path: $IMAGE_PATH"
+          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
 
       - name: Login to DigitalOcean Container Registry
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
@@ -42,21 +55,168 @@ jobs:
           mkdir -p ~/.docker
           AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
           echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          # Also set for current directory in case Bazel uses different home
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
 
       - name: Push Eagle image to DO registry
+        id: push-eagle
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        run: bazel run //ci:eagle_server_push
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
+        run: |
+          set -ex
+
+          # Use cross-compiled image path from build step
+          EAGLE_IMAGE="${{ steps.build-eagle.outputs.image_path }}"
+          echo "Using Eagle image: $EAGLE_IMAGE"
+
+          if [ -z "$EAGLE_IMAGE" ] || [ ! -d "$EAGLE_IMAGE" ]; then
+            echo "ERROR: Eagle image not found at: $EAGLE_IMAGE"
+            exit 1
+          fi
+
+          # Debug: show OCI layout contents
+          echo "=== OCI Layout Contents ==="
+          cat "$EAGLE_IMAGE/index.json"
+          echo ""
+          echo "=== Blobs ==="
+          ls -la "$EAGLE_IMAGE/blobs/sha256/" | head -20
+
+          # Verify OCI layout consistency before pushing
+          echo "=== Verifying OCI layout consistency ==="
+          for digest in $(cat "$EAGLE_IMAGE/index.json" | grep -o '"sha256:[^"]*"' | tr -d '"'); do
+            blob_path="$EAGLE_IMAGE/blobs/${digest/://}"
+            if [ ! -f "$blob_path" ]; then
+              echo "ERROR: Blob not found: $blob_path"
+              exit 1
+            fi
+            actual_digest="sha256:$(shasum -a 256 "$blob_path" | cut -d' ' -f1)"
+            if [ "$digest" != "$actual_digest" ]; then
+              echo "ERROR: Digest mismatch for $blob_path"
+              echo "  Index says: $digest"
+              echo "  Actual: $actual_digest"
+              exit 1
+            fi
+            echo "✓ Verified: $digest"
+          done
+
+          # Build the push target to get crane in runfiles
+          bazel build //ci:eagle_server_push
+
+          # Use crane directly for push (avoids OCI->Docker digest mismatch)
+          CRANE="bazel-bin/ci/push_eagle_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
+          echo "Using crane: $CRANE"
+
+          # Push with SHA tag
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
+          IMAGE_TAG="registry.digitalocean.com/eagle0/eagle-server:${GIT_SHA}"
+          echo "Pushing eagle image: $IMAGE_TAG"
+          $CRANE push "$EAGLE_IMAGE" "$IMAGE_TAG"
+
+          # Verify push by checking what's in the registry
+          echo "=== Verifying push ==="
+          $CRANE manifest "$IMAGE_TAG" | head -50
+          PUSHED_DIGEST=$($CRANE digest "$IMAGE_TAG")
+          echo "Registry reports digest: $PUSHED_DIGEST"
+
+          # Output the full image tag for deploy step
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+          # Also update :latest for convenience (but deploy won't use it)
+          echo "Copying to :latest tag"
+          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/eagle-server:latest"
 
   build-shardok:
     runs-on: self-hosted
+    outputs:
+      image_tag: ${{ steps.push-shardok.outputs.image_tag }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           lfs: false
 
-      - name: Build Shardok Docker image (cross-compile for Linux)
-        run: bazel build --platforms=//:linux_x86_64 //ci:shardok_server_image
+      - name: Build Shardok binary (cross-compile for Linux)
+        run: |
+          set -ex
+
+          # Step 1: Build JUST the binary with cross-compilation
+          # We need --extra_toolchains to force the Linux toolchain to be used
+          # because toolchains_llvm registers with dev_dependency=True
+          echo "=== Building shardok-server binary for linux-x86_64 ==="
+          bazel build \
+            --platforms=//:linux_x86_64 \
+            --extra_toolchains=@llvm_toolchain_linux//:all \
+            //src/main/cpp/net/eagle0/shardok:shardok-server
+
+          # Step 2: Check the binary directly from bazel-bin
+          # bazel-bin is a symlink that points to the correct output directory
+          LINUX_BIN="bazel-bin/src/main/cpp/net/eagle0/shardok/shardok-server"
+          echo "=== Checking binary at: $LINUX_BIN ==="
+
+          if [ ! -f "$LINUX_BIN" ]; then
+            echo "ERROR: Binary not found at $LINUX_BIN"
+            exit 1
+          fi
+
+          # Debug: show what bazel-bin points to
+          echo "bazel-bin symlink target: $(readlink bazel-bin || echo 'not a symlink')"
+
+          # Step 3: Verify it's ELF (Linux) not Mach-O (macOS)
+          echo "=== Verifying binary format ==="
+          MAGIC=$(head -c 4 "$LINUX_BIN" | xxd -p)
+          echo "Binary magic bytes: $MAGIC"
+
+          if [ "$MAGIC" = "7f454c46" ]; then
+            echo "SUCCESS: Binary is ELF format (Linux)"
+          elif [ "$MAGIC" = "cfaeedfe" ] || [ "$MAGIC" = "cffaedfe" ]; then
+            echo "ERROR: Binary is Mach-O format (macOS) - cross-compilation failed!"
+            echo ""
+            echo "Debug info:"
+            echo "- bazel-bin points to: $(readlink bazel-bin)"
+            file "$LINUX_BIN" || true
+            exit 1
+          else
+            echo "WARNING: Unknown binary format: $MAGIC"
+            file "$LINUX_BIN" || true
+          fi
+
+      - name: Build Shardok Docker image
+        id: build-shardok
+        run: |
+          set -ex
+
+          # Build the OCI image with cross-compilation flags
+          bazel build \
+            --platforms=//:linux_x86_64 \
+            --extra_toolchains=@llvm_toolchain_linux//:all \
+            //ci:shardok_server_image
+
+          # The image is output to bazel-bin which is a symlink.
+          # Resolve it now before any other bazel commands change where it points.
+          IMAGE_PATH=$(readlink -f bazel-bin/ci/shardok_server_image)
+          echo "Image path: $IMAGE_PATH"
+          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
+
+          # Verify the binary inside the tar layer is ELF
+          echo "=== Verifying binary in image tar ==="
+          BINARY_TAR="bazel-bin/ci/shardok_binary_layer.tar"
+          if [ -f "$BINARY_TAR" ]; then
+            echo "Checking binary in $BINARY_TAR"
+            # Extract just the first 4 bytes of the binary from the tar
+            MAGIC=$(tar -xOf "$BINARY_TAR" app/shardok-server 2>/dev/null | head -c 4 | xxd -p)
+            echo "Binary magic in tar: $MAGIC"
+            if [ "$MAGIC" = "7f454c46" ]; then
+              echo "SUCCESS: Binary in tar is ELF format (Linux)"
+            else
+              echo "ERROR: Binary in tar is NOT ELF format!"
+              echo "This means pkg_tar is packaging the wrong binary."
+              exit 1
+            fi
+          else
+            echo "WARNING: Could not find $BINARY_TAR"
+          fi
 
       - name: Login to DigitalOcean Container Registry
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
@@ -66,7 +226,320 @@ jobs:
           mkdir -p ~/.docker
           AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
           echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          # Also set for current directory in case Bazel uses different home
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
 
       - name: Push Shardok image to DO registry
+        id: push-shardok
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        run: bazel run --platforms=//:linux_x86_64 //ci:shardok_server_push
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
+        run: |
+          set -ex
+
+          # Use cross-compiled image path from build step
+          CROSS_IMAGE="${{ steps.build-shardok.outputs.image_path }}"
+          echo "Using cross-compiled image: $CROSS_IMAGE"
+
+          if [ -z "$CROSS_IMAGE" ] || [ ! -d "$CROSS_IMAGE" ]; then
+            echo "ERROR: Cross-compiled image not found at: $CROSS_IMAGE"
+            exit 1
+          fi
+
+          # Get crane from Eagle push target (which doesn't need cross-compilation)
+          # This gives us a macOS crane binary we can actually run.
+          # We can't build shardok_server_push with platform flags because it would
+          # download a Linux crane that can't run on macOS.
+          bazel build //ci:eagle_server_push
+
+          # Find the Darwin crane binary (may be a symlink)
+          RUNFILES="bazel-bin/ci/push_eagle_server_push.sh.runfiles"
+          CRANE=$(find "$RUNFILES" -path "*darwin*" -name crane 2>/dev/null | head -1)
+          if [ -z "$CRANE" ]; then
+            # Fallback to any crane
+            CRANE=$(find "$RUNFILES" -name crane 2>/dev/null | head -1)
+          fi
+          if [ -z "$CRANE" ] || [ ! -e "$CRANE" ]; then
+            echo "ERROR: crane not found. Listing runfiles:"
+            find "$RUNFILES" -name crane 2>/dev/null || true
+            exit 1
+          fi
+          echo "Using crane: $CRANE"
+
+          # Push the cross-compiled image with SHA tag
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
+          IMAGE_TAG="registry.digitalocean.com/eagle0/shardok-server:${GIT_SHA}"
+          echo "Pushing shardok image: $IMAGE_TAG"
+          $CRANE push "$CROSS_IMAGE" "$IMAGE_TAG"
+
+          # Output the full image tag for deploy step
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+          # Also update :latest for convenience (but deploy won't use it)
+          echo "Copying to :latest tag"
+          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/shardok-server:latest"
+
+  build-admin:
+    runs-on: self-hosted
+    outputs:
+      image_tag: ${{ steps.push-admin.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Build Admin Server Docker image
+        id: build-admin
+        run: |
+          set -ex
+
+          # Build admin server image (Go binary has explicit goos/goarch in BUILD.bazel)
+          bazel build //ci:admin_server_image
+
+          # Save the resolved path before any other bazel command changes bazel-bin symlink
+          IMAGE_PATH=$(readlink -f bazel-bin/ci/admin_server_image)
+          echo "Image path: $IMAGE_PATH"
+          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
+
+      - name: Login to DigitalOcean Container Registry
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
+        run: |
+          mkdir -p ~/.docker
+          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
+          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
+
+      - name: Push Admin image to DO registry
+        id: push-admin
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
+        run: |
+          set -ex
+
+          ADMIN_IMAGE="${{ steps.build-admin.outputs.image_path }}"
+          echo "Using Admin image: $ADMIN_IMAGE"
+
+          if [ -z "$ADMIN_IMAGE" ] || [ ! -d "$ADMIN_IMAGE" ]; then
+            echo "ERROR: Admin image not found at: $ADMIN_IMAGE"
+            exit 1
+          fi
+
+          # Build the push target to get crane in runfiles
+          bazel build //ci:admin_server_push
+
+          # Use crane directly for push
+          CRANE="bazel-bin/ci/push_admin_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
+          echo "Using crane: $CRANE"
+
+          # Push with SHA tag
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
+          IMAGE_TAG="registry.digitalocean.com/eagle0/admin-server:${GIT_SHA}"
+          echo "Pushing admin image: $IMAGE_TAG"
+          $CRANE push "$ADMIN_IMAGE" "$IMAGE_TAG"
+
+          # Output the full image tag for deploy step
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+          # Also update :latest for convenience
+          echo "Copying to :latest tag"
+          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/admin-server:latest"
+
+  build-jfr-sidecar:
+    runs-on: self-hosted
+    outputs:
+      image_tag: ${{ steps.push-jfr-sidecar.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Build JFR Sidecar Docker image
+        id: build-jfr-sidecar
+        run: |
+          set -ex
+
+          # Build JFR sidecar image (Go binary has explicit goos/goarch in BUILD.bazel)
+          bazel build //ci:jfr_sidecar_image
+
+          # Save the resolved path before any other bazel command changes bazel-bin symlink
+          IMAGE_PATH=$(readlink -f bazel-bin/ci/jfr_sidecar_image)
+          echo "Image path: $IMAGE_PATH"
+          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
+
+      - name: Login to DigitalOcean Container Registry
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
+        run: |
+          mkdir -p ~/.docker
+          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
+          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
+
+      - name: Push JFR Sidecar image to DO registry
+        id: push-jfr-sidecar
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
+        run: |
+          set -ex
+
+          JFR_IMAGE="${{ steps.build-jfr-sidecar.outputs.image_path }}"
+          echo "Using JFR Sidecar image: $JFR_IMAGE"
+
+          if [ -z "$JFR_IMAGE" ] || [ ! -d "$JFR_IMAGE" ]; then
+            echo "ERROR: JFR Sidecar image not found at: $JFR_IMAGE"
+            exit 1
+          fi
+
+          # Build the push target to get crane in runfiles
+          bazel build //ci:jfr_sidecar_push
+
+          # Use crane directly for push
+          CRANE="bazel-bin/ci/push_jfr_sidecar_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
+          echo "Using crane: $CRANE"
+
+          # Push with SHA tag
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
+          IMAGE_TAG="registry.digitalocean.com/eagle0/jfr-sidecar:${GIT_SHA}"
+          echo "Pushing JFR sidecar image: $IMAGE_TAG"
+          $CRANE push "$JFR_IMAGE" "$IMAGE_TAG"
+
+          # Output the full image tag for deploy step
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+          # Also update :latest for convenience
+          echo "Copying to :latest tag"
+          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/jfr-sidecar:latest"
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [build-eagle, build-shardok, build-admin, build-jfr-sidecar]
+    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+    environment: production
+    env:
+      EAGLE_IMAGE: ${{ needs.build-eagle.outputs.image_tag }}
+      SHARDOK_IMAGE: ${{ needs.build-shardok.outputs.image_tag }}
+      ADMIN_IMAGE: ${{ needs.build-admin.outputs.image_tag }}
+      JFR_SIDECAR_IMAGE: ${{ needs.build-jfr-sidecar.outputs.image_tag }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      GPT_MODEL_NAME: ${{ secrets.GPT_MODEL_NAME }}
+      EAGLE_ENABLE_S3: ${{ secrets.EAGLE_ENABLE_S3 }}
+      DO_SPACES_ACCESS_KEY: ${{ secrets.DO_SPACES_ACCESS_KEY }}
+      DO_SPACES_SECRET_KEY: ${{ secrets.DO_SPACES_SECRET_KEY }}
+      JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
+      DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
+      DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Copy config files to droplet
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ secrets.DO_DROPLET_IP }}
+          username: deploy
+          key: ${{ secrets.DO_SSH_KEY }}
+          source: "docker-compose.prod.yml,nginx/nginx.conf"
+          target: "/opt/eagle0"
+
+      - name: Deploy to production droplet
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DO_DROPLET_IP }}
+          username: deploy
+          key: ${{ secrets.DO_SSH_KEY }}
+          script_stop: true
+          envs: EAGLE_IMAGE,SHARDOK_IMAGE,ADMIN_IMAGE,JFR_SIDECAR_IMAGE,OPENAI_API_KEY,GPT_MODEL_NAME,EAGLE_ENABLE_S3,DO_SPACES_ACCESS_KEY,DO_SPACES_SECRET_KEY,JWT_PRIVATE_KEY,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET
+          script: |
+            set -x
+            cd /opt/eagle0
+
+            # Write env vars to .env file for docker-compose
+            rm -f .env 2>/dev/null || true
+            cat > .env << EOF
+            EAGLE_IMAGE=${EAGLE_IMAGE}
+            SHARDOK_IMAGE=${SHARDOK_IMAGE}
+            ADMIN_IMAGE=${ADMIN_IMAGE}
+            JFR_SIDECAR_IMAGE=${JFR_SIDECAR_IMAGE}
+            OPENAI_API_KEY=${OPENAI_API_KEY:-}
+            GPT_MODEL_NAME=${GPT_MODEL_NAME:-gpt-4o}
+            EAGLE_ENABLE_S3=${EAGLE_ENABLE_S3:-false}
+            DO_SPACES_ACCESS_KEY=${DO_SPACES_ACCESS_KEY:-}
+            DO_SPACES_SECRET_KEY=${DO_SPACES_SECRET_KEY:-}
+            JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY:-}
+            DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID:-}
+            DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET:-}
+            EOF
+            chmod 600 .env
+
+            # Login to registry
+            echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "${{ secrets.DO_REGISTRY_TOKEN }}" --password-stdin
+
+            # Use exact image tags passed from build jobs (no :latest fallback)
+            echo "Using images: $EAGLE_IMAGE, $SHARDOK_IMAGE, $ADMIN_IMAGE, $JFR_SIDECAR_IMAGE"
+
+            # Use crane to pull images (handles OCI format correctly) then load into Docker
+            # This avoids digest mismatch from DO registry's OCI->Docker format conversion
+            echo "Installing crane..."
+            curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
+            chmod +x crane
+
+            # crane uses Docker config for auth
+            echo "Pulling Eagle image with crane..."
+            ./crane pull "${EAGLE_IMAGE}" eagle.tar || { echo "ERROR: Failed to pull eagle image"; exit 1; }
+            echo "Loading Eagle image into Docker..."
+            docker load -i eagle.tar
+            rm eagle.tar
+
+            echo "Pulling Shardok image with crane..."
+            ./crane pull "${SHARDOK_IMAGE}" shardok.tar || { echo "ERROR: Failed to pull shardok image"; exit 1; }
+            echo "Loading Shardok image into Docker..."
+            docker load -i shardok.tar
+            rm shardok.tar
+
+            echo "Pulling Admin image with crane..."
+            ./crane pull "${ADMIN_IMAGE}" admin.tar || { echo "ERROR: Failed to pull admin image"; exit 1; }
+            echo "Loading Admin image into Docker..."
+            docker load -i admin.tar
+            rm admin.tar
+
+            echo "Pulling JFR Sidecar image with crane..."
+            ./crane pull "${JFR_SIDECAR_IMAGE}" jfr-sidecar.tar || { echo "ERROR: Failed to pull jfr-sidecar image"; exit 1; }
+            echo "Loading JFR Sidecar image into Docker..."
+            docker load -i jfr-sidecar.tar
+            rm jfr-sidecar.tar
+
+            rm ./crane
+
+            # Also pull other compose images
+            docker pull nginx:alpine || true
+            docker pull certbot/certbot || true
+
+            echo "All images pulled successfully"
+
+            # Force recreate containers to ensure new image is used
+            docker compose -f docker-compose.prod.yml up -d --force-recreate --remove-orphans
+
+            # Restart nginx to pick up new container IPs
+            # (nginx caches DNS at startup, so it needs restart after eagle/shardok)
+            docker compose -f docker-compose.prod.yml restart nginx
+
+            # Wait for health checks
+            sleep 10
+            docker compose -f docker-compose.prod.yml ps
+
+            # Verify containers are using correct images
+            echo "=== Verifying container image tags ==="
+            docker compose -f docker-compose.prod.yml images
+
+            # Cleanup old images
+            docker image prune -f

.github/workflows/unity_build.yml

@@ -52,14 +52,14 @@ jobs:
       - name: Persist Library/
         run: ./ci/github_actions/persist_library.sh
       - name: Deploy Windows unity
-        if: success() #&& github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
         run: bazel run //src/main/go/net/eagle0/build/unity3d_windows_build_handler:unity3d_windows_build_handler -- "/tmp/eagle0/eagle0WIN" "/tmp/unity_manifest.txt"
 
       - name: Update unified manifest
-        if: success() #&& github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}

DEPROTO_PLAN.md

@@ -0,0 +1,128 @@
+# Deproto Migration Plan
+
+This document tracks the migration from protobuf types to native Scala models inside the Eagle game engine.
+
+## Architectural Decisions
+
+1. **Keep proto for persistence**: Yes - protobuf is used for persisting game state
+2. **Keep proto for Shardok communication**: Yes - protobuf is used for Eagle-Shardok gRPC communication
+3. **Use Scala views inside the library**: Yes - use native Scala types like `ProvinceView`, `FactionView`, `HeroView`, etc. within the library code
+
+## Recent Completed Work
+
+### GameState Round-Trip Elimination (PRs #4913, #4914, #4915)
+
+Eliminated wasteful Scala→proto→Scala conversions in the hot path:
+
+1. **LLM Pipeline** (#4913): `LlmRequestWithGameState` now uses Scala `GameState` instead of proto. All ~38 prompt generators updated to use Scala model types (`FactionT`, `HeroT`, `ProvinceT`).
+
+2. **ActionWithResultingState Caching** (#4914): Added `precomputedScalaState: Option[GameState]` to cache Scala state when available, avoiding `fromProto()` conversion in `stateAfter()`.
+
+3. **PostResults Simplification** (#4915): Changed `PostResults.gameState` from proto to `Option[GameState]` (Scala), eliminating `toProto()` calls when creating PostResults.
+
+## Migration Pattern
+
+The codebase follows a **Legacy* pattern** for separating proto-dependent and protoless code:
+
+- **Protoless utilities**: `FactionUtils`, `HeroUtils`, `ProvinceUtils`, `ProvinceDistances`, etc.
+- **Proto-dependent utilities**: `LegacyFactionUtils`, `LegacyHeroUtils`, `LegacyProvinceUtils`, `LegacyProvinceDistances`, etc.
+
+When migrating a file:
+1. Create a `Legacy*` version containing the proto-dependent methods
+2. Keep the original file name for protoless methods
+3. Update callers to use the appropriate version based on their context
+
+## Migration Status
+
+### Fully Protoless (no proto imports)
+
+**Utilities:**
+- [x] `FactionUtils` - has protoless `ownedNeighbors` method
+- [x] `ProvinceDistances` - split into protoless + `LegacyProvinceDistances`
+- [x] `SwornBrotherChooser` - fully protoless (removed `bestChoiceProto`)
+
+**Command Selectors (all use native GameState):**
+- [x] `AllianceOfferCommandSelector`
+- [x] `AlmsCommandSelector`
+- [x] `AttackCommandChooser`
+- [x] `ExpandCommandSelector`
+- [x] `HeroGiftCommandSelector`
+- [x] `ImproveCommandSelector`
+- [x] `MarchTowardProvinceCommandChooser` - in AI folder, uses native GameState (callers convert)
+- [x] `OrganizeCommandSelector`
+- [x] `RansomOfferHelpers`
+- [x] `SeekMoreLeadersCommandChooser` - in AI folder, uses native GameState
+- [x] `TruceOfferCommandSelector`
+- [x] `TrustForDiplomacy`
+
+**Quest Command Selectors (all protoless):**
+- [x] `AllianceQuestCommandChooser`
+- [x] `AlmsAcrossRealmQuestCommandChooser`
+- [x] `AlmsToProvinceQuestCommandChooser`
+- [x] `DismissSpecificVassalCommandChooser`
+- [x] `GiveToHeroesAcrossRealmQuestCommandChooser`
+- [x] `GiveToHeroesInProvinceQuestCommandChooser`
+- [x] `ImproveQuestCommandChooser`
+- [x] `QuestCommandChooser`
+- [x] `TruceCountQuestCommandChooser`
+- [x] `TruceWithFactionQuestCommandChooser`
+
+### Fully Protoless
+
+- [x] `AIClientUtils` - has protoless overloads (`takenHeroIdsForMarchTowardFocus`, `mostPowerfulHeroes`)
+- [x] `ProvinceGoldSurplusCalculator` - fully protoless (callers use converters)
+- [x] `HeroSelector` - fully protoless (removed dead `minimallyFatiguedHeroesProto`)
+
+### Blocked (still uses proto GameState)
+
+- [ ] `CommandChoiceHelpers` - main target, uses proto GameState extensively
+  - Depends on many Legacy* utils
+  - Central hub called by many command selectors
+- [ ] `AttackDecisionCommandChooser` - uses proto GameState, converts internally
+- [ ] `CommandChooser` - trait uses proto GameState in signature
+- [ ] `FulfillQuestsCommandSelector` - takes proto, converts to native immediately
+  - Called by `MidGameAIClient` which uses proto GameState
+
+## Next Steps
+
+### Phase 1: CommandChoiceHelpers Migration
+
+The main blocker is `CommandChoiceHelpers.scala` which uses proto `GameState` extensively. Strategy:
+
+1. **Add Scala overloads** to `CommandChoiceHelpers` methods that currently take proto GameState
+2. **Update internal helpers** to use Scala types where possible
+3. **Migrate callers incrementally** - command selectors that are already protoless can switch to Scala overloads
+
+### Phase 2: CommandChooser Trait
+
+Once CommandChoiceHelpers is protoless:
+
+1. Add Scala `GameState` overload to `CommandChooser.choose()` method
+2. Update implementations (`AttackDecisionCommandChooser`, etc.) to use Scala internally
+3. Eventually deprecate proto overloads
+
+### Phase 3: MidGameAIClient
+
+The top-level AI client still uses proto GameState. Once lower layers are protoless:
+
+1. Convert `MidGameAIClient` to use Scala GameState internally
+2. Only convert at the boundary when receiving from/sending to gRPC
+
+## Key Files
+
+### Protoless Model Types
+
+- `src/main/scala/net/eagle0/eagle/model/state/game_state/GameState.scala` - native Scala GameState
+- `src/main/scala/net/eagle0/eagle/model/state/province/ProvinceView.scala` - province view type
+- `src/main/scala/net/eagle0/eagle/model/state/faction/FactionView.scala` - faction view type
+- `src/main/scala/net/eagle0/eagle/model/state/hero/HeroView.scala` - hero view type
+
+### Proto Converters
+
+- `src/main/scala/net/eagle0/eagle/model/proto_converters/game_state/` - converts between proto and Scala types
+
+## Notes
+
+- The AI client code (`src/main/scala/net/eagle0/eagle/ai/`) currently uses proto types extensively
+- `PerformUnaffiliatedHeroesAction` already uses protoless `GameState`
+- Migration should proceed incrementally: utilities first, then higher-level selectors/choosers

MODULE.bazel

@@ -72,9 +72,8 @@ use_repo(llvm, "llvm_toolchain", "llvm_toolchain_linux")
 sysroot = use_repo_rule("@toolchains_llvm//toolchain:sysroot.bzl", "sysroot")
 sysroot(
     name = "linux_sysroot",
-    # TODO: Update sha256 after running sysroot build workflow with version v2
-    sha256 = "PLACEHOLDER_RUN_SYSROOT_WORKFLOW_FIRST",
-    urls = ["https://eagle0.sfo3.digitaloceanspaces.com/sysroot/v2/ubuntu_noble_amd64_sysroot.tar.xz"],
+    sha256 = "a06475004fe8003ae7ccb4fe1d5511feb9b27cce4a8826eb1dfd686ed83f3dba",
+    urls = ["https://eagle0-windows.sfo3.digitaloceanspaces.com/sysroot/v3/ubuntu_noble_amd64_sysroot.tar.xz"],
 )
 
 #
@@ -131,12 +130,12 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.16.0")
 
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 
-# Base image for Eagle (Java 17)
+# Base image for Eagle (Java 17 JDK - includes jcmd for JFR dumps)
 oci.pull(
     name = "eclipse_temurin_17",
-    digest = "sha256:d286b5352d98777bbf727f54038b04f0145cd9b76ca83f38a67aa111d4303748",
     image = "docker.io/library/eclipse-temurin",
     platforms = ["linux/amd64"],
+    tag = "17-jdk",
 )
 
 # Base image for Shardok (Ubuntu 24.04 for C++ runtime)
@@ -146,7 +145,15 @@ oci.pull(
     platforms = ["linux/amd64"],
     tag = "24.04",
 )
-use_repo(oci, "eclipse_temurin_17", "eclipse_temurin_17_linux_amd64", "ubuntu_24_04", "ubuntu_24_04_linux_amd64")
+
+# Base image for Admin Server (Alpine for lightweight Go binary)
+oci.pull(
+    name = "alpine_linux",
+    image = "docker.io/library/alpine",
+    platforms = ["linux/amd64"],
+    tag = "3.21",
+)
+use_repo(oci, "alpine_linux", "alpine_linux_linux_amd64", "eclipse_temurin_17", "eclipse_temurin_17_linux_amd64", "ubuntu_24_04", "ubuntu_24_04_linux_amd64")
 
 #
 # Java/Scala Dependencies
@@ -206,9 +213,12 @@ maven.install(
         "org.reactivestreams:reactive-streams:1.0.4",
         "javax.xml.bind:jaxb-api:2.3.1",
 
-        # OkHttp (for SSE with read timeout support)
+        # OkHttp (for SSE with read timeout support, OAuth HTTP calls)
         "com.squareup.okhttp3:okhttp:4.12.0",
         "com.squareup.okhttp3:okhttp-sse:4.12.0",
+
+        # JWT (for OAuth token handling)
+        "com.nimbusds:nimbus-jose-jwt:9.37.3",
     ],
     duplicate_version_warning = "error",
     fail_if_repin_required = True,
@@ -224,6 +234,7 @@ use_repo(maven, "maven", "unpinned_maven")
 #
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 
 # GTL (for parallel_hashmap)
 GTL_VERSION = "1.2.0"
@@ -252,6 +263,16 @@ http_archive(
     ],
 )
 
+# Busybox static binary for Docker health checks (provides nc, wget, etc.)
+# https://busybox.net/downloads/binaries/
+http_file(
+    name = "busybox_x86_64",
+    sha256 = "6e123e7f3202a8c1e9b1f94d8941580a25135382b99e8d3e34fb858bba311348",
+    urls = ["https://busybox.net/downloads/binaries/1.35.0-x86_64-linux-musl/busybox"],
+    downloaded_file_path = "busybox",
+    executable = True,
+)
+
 #
 # Toolchain Registration
 #

MODULE.bazel.lock

@@ -1293,7 +1293,7 @@
     "@@rules_oci~//oci:extensions.bzl%oci": {
       "general": {
         "bzlTransitiveDigest": "FaY+7xb13bB3hmxqwAWaGp3Tf3Q4Nfdlr+F38CP5mcg=",
-        "usagesDigest": "BuciKSozbpJMD9EP+j0RG5ZgrYMeDPsQyiOnLUni2V8=",
+        "usagesDigest": "uqsqMpE+yaVuTByR2rIA2v1Vkm1JwwuN6nbXOo1W9G0=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -1306,7 +1306,7 @@
               "scheme": "https",
               "registry": "index.docker.io",
               "repository": "library/eclipse-temurin",
-              "identifier": "sha256:d286b5352d98777bbf727f54038b04f0145cd9b76ca83f38a67aa111d4303748",
+              "identifier": "17-jdk",
               "platform": "linux/amd64",
               "target_name": "eclipse_temurin_17_linux_amd64",
               "bazel_tags": []
@@ -1321,7 +1321,7 @@
               "scheme": "https",
               "registry": "index.docker.io",
               "repository": "library/eclipse-temurin",
-              "identifier": "sha256:d286b5352d98777bbf727f54038b04f0145cd9b76ca83f38a67aa111d4303748",
+              "identifier": "17-jdk",
               "platforms": {
                 "@@platforms//cpu:x86_64": "@eclipse_temurin_17_linux_amd64"
               },
@@ -1360,6 +1360,37 @@
               "reproducible": true
             }
           },
+          "alpine_linux_linux_amd64": {
+            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
+            "ruleClassName": "oci_pull",
+            "attributes": {
+              "www_authenticate_challenges": {},
+              "scheme": "https",
+              "registry": "index.docker.io",
+              "repository": "library/alpine",
+              "identifier": "3.21",
+              "platform": "linux/amd64",
+              "target_name": "alpine_linux_linux_amd64",
+              "bazel_tags": []
+            }
+          },
+          "alpine_linux": {
+            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
+            "ruleClassName": "oci_alias",
+            "attributes": {
+              "target_name": "alpine_linux",
+              "www_authenticate_challenges": {},
+              "scheme": "https",
+              "registry": "index.docker.io",
+              "repository": "library/alpine",
+              "identifier": "3.21",
+              "platforms": {
+                "@@platforms//cpu:x86_64": "@alpine_linux_linux_amd64"
+              },
+              "bzlmod_repository": "alpine_linux",
+              "reproducible": true
+            }
+          },
           "oci_crane_darwin_amd64": {
             "bzlFile": "@@rules_oci~//oci:repositories.bzl",
             "ruleClassName": "crane_repositories",
@@ -1496,7 +1527,9 @@
             "eclipse_temurin_17",
             "eclipse_temurin_17_linux_amd64",
             "ubuntu_24_04",
-            "ubuntu_24_04_linux_amd64"
+            "ubuntu_24_04_linux_amd64",
+            "alpine_linux",
+            "alpine_linux_linux_amd64"
           ],
           "explicitRootModuleDirectDevDeps": [],
           "useAllRepos": "NO",

ci/BUILD.bazel

@@ -1,6 +1,22 @@
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load", "oci_push")
 load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
+#
+# Shared utilities layer (busybox for nc, wget, etc.)
+#
+
+pkg_tar(
+    name = "busybox_layer",
+    srcs = ["@busybox_x86_64//file"],
+    package_dir = "/usr/local/bin",
+    remap_paths = {
+        "file/busybox": "busybox",
+    },
+    symlinks = {
+        "/usr/local/bin/nc": "busybox",
+    },
+)
+
 #
 # Eagle Server Docker Image
 #
@@ -35,16 +51,21 @@ oci_image(
     base = "@eclipse_temurin_17_linux_amd64",
     entrypoint = [
         "java",
-        "-Xmx4g",
+        "-Xmx2g",
         "-XX:+UseG1GC",
+        # JFR profiling support
+        "-XX:+UnlockDiagnosticVMOptions",
+        "-XX:+DebugNonSafepoints",  # Required for JFR to see through inlined methods
+        "-XX:FlightRecorderOptions=stackdepth=256",
         "-jar",
         "/app/eagle_server_deploy.jar",
     ],
     env = {
-        "JAVA_OPTS": "-Xmx4g -XX:+UseG1GC",
+        "JAVA_OPTS": "-Xmx2g -XX:+UseG1GC",
     },
     exposed_ports = ["40032/tcp"],
     tars = [
+        ":busybox_layer",
         ":eagle_server_jar_layer",
         ":eagle_resources_layer",
     ],
@@ -59,6 +80,9 @@ oci_load(
 )
 
 # Push to DigitalOcean Container Registry
+# Note: No remote_tags here - DigitalOcean converts OCI to Docker format,
+# changing the digest and breaking oci_push's tag-by-digest logic.
+# Tagging is handled in the CI workflow using crane copy/tag.
 oci_push(
     name = "eagle_server_push",
     image = ":eagle_server_image",
@@ -106,6 +130,7 @@ oci_image(
         "40052/tcp",
     ],
     tars = [
+        ":busybox_layer",
         ":shardok_binary_layer",
         ":shardok_resources_layer",
         ":shardok_maps_layer",
@@ -121,8 +146,94 @@ oci_load(
 )
 
 # Push to DigitalOcean Container Registry
+# Note: No remote_tags here - DigitalOcean converts OCI to Docker format,
+# changing the digest and breaking oci_push's tag-by-digest logic.
+# Tagging is handled in the CI workflow using crane copy/tag.
 oci_push(
     name = "shardok_server_push",
     image = ":shardok_server_image",
     repository = "registry.digitalocean.com/eagle0/shardok-server",
 )
+
+#
+# Admin Server Docker Image (Go)
+#
+# Build: bazel build //ci:admin_server_image
+# Load:  bazel run //ci:admin_server_load
+# Push:  bazel run //ci:admin_server_push
+#
+
+# Package the Go admin binary (explicit Linux x86_64 target)
+pkg_tar(
+    name = "admin_binary_layer",
+    srcs = ["//src/main/go/net/eagle0/admin_server:admin_server_linux_amd64"],
+    package_dir = "/app",
+)
+
+oci_image(
+    name = "admin_server_image",
+    base = "@alpine_linux_linux_amd64",
+    entrypoint = ["/app/admin_server_linux_amd64"],
+    exposed_ports = ["8080/tcp"],
+    tars = [
+        ":busybox_layer",
+        ":admin_binary_layer",
+    ],
+    workdir = "/app",
+)
+
+# Load into Docker locally: bazel run //ci:admin_server_load
+oci_load(
+    name = "admin_server_load",
+    image = ":admin_server_image",
+    repo_tags = ["eagle0/admin-server:latest"],
+)
+
+# Push to DigitalOcean Container Registry
+oci_push(
+    name = "admin_server_push",
+    image = ":admin_server_image",
+    repository = "registry.digitalocean.com/eagle0/admin-server",
+)
+
+#
+# JFR Sidecar Docker Image (Go + JDK for jcmd)
+#
+# This sidecar runs with shared PID namespace to access the Eagle JVM.
+# Build: bazel build //ci:jfr_sidecar_image
+# Load:  bazel run //ci:jfr_sidecar_load
+# Push:  bazel run //ci:jfr_sidecar_push
+#
+
+# Package the Go JFR server binary
+pkg_tar(
+    name = "jfr_sidecar_binary_layer",
+    srcs = ["//src/main/go/net/eagle0/jfr_server:jfr_server_linux_amd64"],
+    package_dir = "/app",
+)
+
+oci_image(
+    name = "jfr_sidecar_image",
+    # Use JDK base image - we need jcmd to dump JFR recordings
+    base = "@eclipse_temurin_17_linux_amd64",
+    entrypoint = ["/app/jfr_server_linux_amd64"],
+    exposed_ports = ["8081/tcp"],
+    tars = [
+        ":jfr_sidecar_binary_layer",
+    ],
+    workdir = "/app",
+)
+
+# Load into Docker locally: bazel run //ci:jfr_sidecar_load
+oci_load(
+    name = "jfr_sidecar_load",
+    image = ":jfr_sidecar_image",
+    repo_tags = ["eagle0/jfr-sidecar:latest"],
+)
+
+# Push to DigitalOcean Container Registry
+oci_push(
+    name = "jfr_sidecar_push",
+    image = ":jfr_sidecar_image",
+    repository = "registry.digitalocean.com/eagle0/jfr-sidecar",
+)

cloudflare/oauth-relay/.gitignore

@@ -0,0 +1 @@
+node_modules/

cloudflare/oauth-relay/README.md

@@ -0,0 +1,46 @@
+# OAuth Relay Worker
+
+Cloudflare Worker that relays OAuth callbacks to the eagle0:// custom URL scheme.
+
+## Why?
+
+Discord (and some other OAuth providers) don't support custom URL schemes as redirect URIs. This worker acts as a relay:
+
+1. Discord redirects to `https://eagle0-oauth-relay.<account>.workers.dev/oauth/callback?code=xxx&state=yyy`
+2. Worker responds with 302 redirect to `eagle0://auth/callback?code=xxx&state=yyy`
+3. OS opens the Eagle0 app via deep link
+
+## Deploy
+
+1. Install wrangler: `npm install -g wrangler`
+2. Login: `wrangler login`
+3. Deploy: `wrangler deploy`
+
+The worker will be available at `https://eagle0-oauth-relay.<your-account>.workers.dev`
+
+## Test Locally
+
+```bash
+wrangler dev
+# Then in another terminal:
+curl -I "http://localhost:8787/oauth/callback?code=test&state=abc"
+```
+
+## Test Production
+
+```bash
+curl -I "https://eagle0-oauth-relay.<your-account>.workers.dev/oauth/callback?code=test&state=abc"
+```
+
+Should return:
+```
+HTTP/2 302
+location: eagle0://auth/callback?code=test&state=abc
+```
+
+## OAuth Provider Configuration
+
+In Discord Developer Portal / Google Cloud Console, set the redirect URI to:
+```
+https://eagle0-oauth-relay.<your-account>.workers.dev/oauth/callback
+```

cloudflare/oauth-relay/worker.js

@@ -0,0 +1,38 @@
+/**
+ * OAuth Relay Worker
+ *
+ * Receives OAuth callbacks from providers (Discord, Google) and redirects
+ * to the eagle0:// custom URL scheme for the native app to handle.
+ *
+ * Input:  GET /oauth/callback?code=xxx&state=yyy
+ * Output: 302 Redirect to eagle0://auth/callback?code=xxx&state=yyy
+ */
+
+export default {
+  async fetch(request) {
+    const url = new URL(request.url);
+
+    // Only handle /oauth/callback path
+    if (url.pathname !== '/oauth/callback') {
+      return new Response('Not Found', { status: 404 });
+    }
+
+    // Build the deep link URL
+    const deepLink = new URL('eagle0://auth/callback');
+
+    // Forward all query parameters
+    const code = url.searchParams.get('code');
+    const state = url.searchParams.get('state');
+    const error = url.searchParams.get('error');
+    const errorDescription = url.searchParams.get('error_description');
+
+    if (code) deepLink.searchParams.set('code', code);
+    if (state) deepLink.searchParams.set('state', state);
+    if (error) deepLink.searchParams.set('error', error);
+    if (errorDescription) deepLink.searchParams.set('error_description', errorDescription);
+
+    console.log(`OAuth relay: redirecting to ${deepLink.toString()}`);
+
+    return Response.redirect(deepLink.toString(), 302);
+  }
+}

cloudflare/oauth-relay/wrangler.toml

@@ -0,0 +1,4 @@
+name = "eagle0-oauth-relay"
+main = "worker.js"
+compatibility_date = "2024-01-01"
+workers_dev = true

docker-compose.prod.yml

@@ -1,47 +1,154 @@
-# Docker Compose for local testing of production images
-# Build images: bazel run //ci:eagle_server_load && bazel run //ci:shardok_server_load
-# Run: docker compose -f docker-compose.prod.yml up
+# Docker Compose for production deployment
+#
+# Local testing:
+#   Build images: bazel run //ci:eagle_server_load && bazel run //ci:shardok_server_load
+#   Run: docker compose -f docker-compose.prod.yml up
+#
+# Production deployment:
+#   Run: docker compose -f docker-compose.prod.yml up -d
 
 services:
   eagle:
-    image: eagle0/eagle-server:latest
+    image: ${EAGLE_IMAGE:-registry.digitalocean.com/eagle0/eagle-server:latest}
     container_name: eagle-server
+    command:
+      - "--gpt-model-name"
+      - "${GPT_MODEL_NAME:-gpt-5.1}"
+      - "--shardok-interface-remote-address"
+      - "shardok:40042"
     ports:
       - "40032:40032"
     environment:
-      # Eagle server configuration
-      EAGLE_GRPC_PORT: "40032"
-      SHARDOK_HOST: "shardok"
-      SHARDOK_PORT: "40042"
-      # Resource paths (relative to /app in container)
-      EAGLE_RESOURCES_PATH: "/app/resources"
+      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
+      EAGLE_ENABLE_S3: "${EAGLE_ENABLE_S3:-false}"
+      DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
+      DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
+      DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
+      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
+      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
+      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
     volumes:
-      # Mount saves directory for persistence
       - ./saves:/app/saves
+      - ./jfr:/app/jfr  # JFR recordings - dump with: docker exec eagle-server jcmd 1 JFR.dump filename=/app/jfr/profile.jfr
+      - jvm-tmp:/tmp  # Shared with jfr-sidecar for JVM attach socket files
     depends_on:
       - shardok
     restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
     healthcheck:
-      test: ["CMD", "nc", "-z", "localhost", "40032"]
+      test: ["CMD-SHELL", "nc -z localhost 40032 || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 30s
 
   shardok:
-    image: eagle0/shardok-server:latest
+    image: ${SHARDOK_IMAGE:-registry.digitalocean.com/eagle0/shardok-server:latest}
     container_name: shardok-server
+    mem_limit: 1g
+    memswap_limit: 1g  # Prevent swap, OOM-kill cleanly instead
     ports:
       - "40042:40042"
       - "40052:40052"
     environment:
-      # Shardok server configuration
       SHARDOK_RESOURCES_PATH: "/app/resources"
       SHARDOK_MAPS_PATH: "/app/resources/maps"
+      SHARDOK_EAGLE_INTERFACE_ADDRESS: "0.0.0.0:40042"
     restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
     healthcheck:
-      test: ["CMD", "nc", "-z", "localhost", "40042"]
+      test: ["CMD-SHELL", "nc -z localhost 40042 || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 10s
+
+  nginx:
+    image: nginx:alpine
+    container_name: nginx
+    ports:
+      - "443:443"
+      - "80:80"
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./certbot/conf:/etc/letsencrypt:ro
+      - ./certbot/www:/var/www/certbot:ro
+      - ./auth:/etc/nginx/auth:ro
+    depends_on:
+      - eagle
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  admin:
+    image: ${ADMIN_IMAGE:-registry.digitalocean.com/eagle0/admin-server:latest}
+    container_name: admin-server
+    command:
+      - "--eagle-addr"
+      - "eagle:40032"
+      - "--jfr-sidecar-addr"
+      - "jfr-sidecar:8081"
+      - "--http-port"
+      - "8080"
+    ports:
+      - "8080:8080"
+    depends_on:
+      - eagle
+      - jfr-sidecar
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  jfr-sidecar:
+    image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
+    container_name: jfr-sidecar
+    # Share PID namespace with Eagle to access its JVM via jcmd
+    pid: "service:eagle"
+    volumes:
+      - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
+    depends_on:
+      - eagle
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "2"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8081/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  certbot:
+    image: certbot/certbot
+    container_name: certbot
+    volumes:
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
+volumes:
+  jvm-tmp:
+    # Shared /tmp for JVM attach socket files between Eagle and jfr-sidecar

docs/ADMIN_SERVER_ENHANCEMENTS.md

@@ -0,0 +1,471 @@
+# Admin Server Enhancement Plan
+
+## Overview
+
+This document outlines enhancements to the Go admin server (`src/main/go/net/eagle0/admin_server/`) to provide a proper web UI for game administration.
+
+### Current State
+
+The admin server provides a full web UI with htmx interactivity:
+- `GET /` - Redirect to games list
+- `GET /games` - Game list page (HTML)
+- `GET /games/{id}` - Game detail with action history
+- `GET /games/{id}/history` - History rows (htmx partial, infinite scroll)
+- `GET /games/{id}/action/{index}` - Action detail (htmx partial)
+- `POST /games/{id}/rewind` - Rewind game to target action
+- `GET /settings` - Settings list with live search
+- `POST /settings/update` - Update setting value
+- `GET /health` - Health check (JSON)
+- `GET /api/games` - JSON API for programmatic access
+- `GET /api/games/{id}/history` - JSON API for history
+
+### Goals
+
+1. **Web UI**: Replace raw JSON with an interactive HTML interface
+2. **Settings Management**: View and modify the 275+ game settings at runtime
+3. **Game Rewind**: Restore a game to a previous action count
+
+---
+
+## Architecture
+
+### Technology Choice: Go Templates + htmx
+
+**Rationale:**
+- Single binary deployment (no separate frontend build)
+- htmx provides interactivity without JavaScript framework complexity
+- Familiar HTML/CSS, minimal learning curve
+- Excellent for admin tools where SEO and bundle size don't matter
+
+**Alternatives Considered:**
+- React/Vue SPA: Adds build complexity, separate deployment artifact
+- Server-side only: Less interactive, full page reloads
+
+### Directory Structure
+
+```
+src/main/go/net/eagle0/admin_server/
+├── admin_server.go         # Main entry point, HTTP routes
+├── handlers/
+│   ├── games.go            # Game list and detail handlers
+│   ├── settings.go         # Settings list and update handlers
+│   └── rewind.go           # Game rewind handlers
+├── templates/
+│   ├── layout.html         # Base layout with nav, htmx includes
+│   ├── games/
+│   │   ├── list.html       # Game list page
+│   │   ├── detail.html     # Single game view with history
+│   │   └── history.html    # Partial for history table (htmx)
+│   ├── settings/
+│   │   ├── list.html       # Settings list with search/filter
+│   │   └── edit.html       # Inline edit partial (htmx)
+│   └── rewind/
+│       └── confirm.html    # Rewind confirmation modal
+├── static/
+│   ├── style.css           # Minimal CSS (Pico CSS or similar)
+│   └── htmx.min.js         # htmx library
+└── BUILD.bazel
+```
+
+---
+
+## Feature 1: Web UI
+
+### Routes
+
+| Route | Method | Description |
+|-------|--------|-------------|
+| `/` | GET | Redirect to `/games` |
+| `/games` | GET | Game list page (HTML) |
+| `/games/{id}` | GET | Game detail page with history |
+| `/games/{id}/history` | GET | History partial (htmx, for infinite scroll) |
+| `/api/games` | GET | JSON API (existing, keep for programmatic access) |
+| `/api/games/{id}/history` | GET | JSON API (existing) |
+
+### Game List Page
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  Eagle Admin                          [Settings] [Health]   │
+├─────────────────────────────────────────────────────────────┤
+│                                                             │
+│  Running Games (3)                                          │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ Game abc123f                          Round 45       │   │
+│  │ Players: Liu Bei (Human), Cao Cao (AI), Sun Quan    │   │
+│  │ Actions: 1,234                        [View] [Rewind]│   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ Game def456a                          Round 12       │   │
+│  │ Players: Test Player (Human)                         │   │
+│  │ Actions: 456                          [View] [Rewind]│   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Game Detail Page
+
+Shows game info and scrollable action history:
+- **Reverse chronological order**: Most recent actions displayed first
+- Each action shows: index, type, round ID
+- **Clickable actions**: Clicking an action row expands to show JSON representation of the full action data
+- "Rewind to here" button on each action row
+- Infinite scroll loads more history via htmx (loading older actions as user scrolls down)
+
+### Implementation Notes
+
+1. **Embed static files**: Use `//go:embed` to bundle templates and static files
+2. **Template functions**: Add helpers for formatting (hex IDs, timestamps, action summaries)
+3. **CSS framework**: Use Pico CSS (~10KB) for clean defaults without classes
+
+---
+
+## Feature 2: Settings Management
+
+### New gRPC Endpoints (Eagle Server)
+
+Add to `eagle.proto`:
+
+```protobuf
+message Setting {
+  string name = 1;
+  string type = 2;           // "Int" or "Double"
+  string value = 3;          // Current value as string
+  string default_value = 4;  // Default from BUILD.bazel
+  string description = 5;    // Optional, for UI hints
+}
+
+message GetSettingsRequest {
+  string filter = 1;         // Optional name filter (substring match)
+}
+
+message GetSettingsResponse {
+  repeated Setting settings = 1;
+}
+
+message UpdateSettingRequest {
+  string name = 1;
+  string value = 2;
+}
+
+message UpdateSettingResponse {
+  Setting setting = 1;       // Updated setting
+  string error = 2;          // Empty on success
+}
+
+service Eagle {
+  // ... existing methods ...
+  rpc GetSettings(GetSettingsRequest) returns (GetSettingsResponse);
+  rpc UpdateSetting(UpdateSettingRequest) returns (UpdateSettingResponse);
+}
+```
+
+### Eagle Server Implementation
+
+Create a settings registry that:
+1. Discovers all `IntSetting` and `DoubleSetting` instances via reflection or explicit registration
+2. Provides get/set by name
+3. Validates types on update
+
+```scala
+// src/main/scala/net/eagle0/eagle/library/settings/SettingsRegistry.scala
+object SettingsRegistry {
+  private val settings: Map[String, Either[IntSetting, DoubleSetting]] = Map(
+    "ActionVigorCost" -> Left(ActionVigorCost),
+    "BaseFoodBuyPrice" -> Right(BaseFoodBuyPrice),
+    // ... register all 275 settings
+  )
+
+  def getAll(filter: Option[String]): Seq[Setting] = ...
+  def get(name: String): Option[Setting] = ...
+  def update(name: String, value: String): Either[String, Setting] = ...
+}
+```
+
+**Alternative: Code generation**
+
+Rather than manually registering 275 settings, modify `setting_rule.bzl` to generate a registry file during build.
+
+### Admin Server Routes
+
+| Route | Method | Description |
+|-------|--------|-------------|
+| `/settings` | GET | Settings list page with search |
+| `/settings/{name}` | GET | Single setting detail (htmx partial) |
+| `/settings/{name}` | PUT | Update setting value |
+| `/api/settings` | GET | JSON API |
+| `/api/settings/{name}` | PUT | JSON API |
+
+### Settings UI
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  Eagle Admin                          [Games] [Health]       │
+├─────────────────────────────────────────────────────────────┤
+│                                                             │
+│  Settings                    [Search: __________ ]          │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ ActionVigorCost (Int)                                │   │
+│  │ Current: [15    ] Default: 15              [Save]    │   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ BaseFoodBuyPrice (Double)                            │   │
+│  │ Current: [0.5   ] Default: 0.5             [Save]    │   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+│  ... (275 settings, virtualized/paginated) ...              │
+│                                                             │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Considerations
+
+1. **Persistence**: Settings changes are in-memory only. Document that restarts reset to defaults.
+2. **Validation**: Validate numeric ranges where applicable (e.g., percentages 0-100)
+3. **Categories**: Consider grouping settings by prefix (AI*, Combat*, Economy*, etc.)
+4. **Audit log**: Log setting changes with timestamp for debugging
+
+---
+
+## Feature 3: Game Rewind
+
+### Concept
+
+Restore a game to a previous point in its action history. This is useful for:
+- Debugging issues that occurred at a specific point
+- Testing "what if" scenarios
+- Recovering from bugs that corrupted state
+
+### New gRPC Endpoint
+
+Add to `eagle.proto`:
+
+```protobuf
+message RewindGameRequest {
+  int64 game_id = 1;
+  int32 target_action_count = 2;  // Rewind to state after this many actions
+}
+
+message RewindGameResponse {
+  bool success = 1;
+  string error = 2;
+  int32 new_action_count = 3;
+  int32 disconnected_clients = 4;  // Number of clients that were disconnected
+}
+
+service Eagle {
+  // ... existing methods ...
+  rpc RewindGame(RewindGameRequest) returns (RewindGameResponse);
+}
+```
+
+### Eagle Server Implementation
+
+The `GameHistory` already stores `ActionWithResultingState` for each action, which includes the `GameState` after that action. Rewinding means:
+
+1. **Validate**: Check that `target_action_count` is within valid range (0 to current count)
+2. **Get target state**: Retrieve `GameState` at target action count from history
+3. **Disconnect clients**: Close all human player connections (they'll need to reconnect)
+4. **Replace engine**: Create new `EngineImpl` with target state and truncated history
+5. **Reset AI state**: Clear any cached AI state that depends on current game state
+
+```scala
+// GameController.scala (pseudocode)
+def rewindTo(targetActionCount: Int): Either[String, RewindResult] = {
+  if (targetActionCount < 0 || targetActionCount > engine.history.count)
+    return Left(s"Invalid action count: $targetActionCount")
+
+  // Get state at target point
+  val targetState = engine.history.stateAt(targetActionCount)
+  val truncatedHistory = engine.history.truncateTo(targetActionCount)
+
+  // Disconnect all human clients
+  val disconnectedCount = humanClients.length
+  humanClients.foreach(_.disconnect("Game rewound by admin"))
+
+  // Create new engine at target state
+  val newEngine = EngineImpl(
+    gameId = engine.gameId,
+    currentState = targetState,
+    history = truncatedHistory,
+    // ... other fields
+  )
+
+  // Replace controller's engine
+  this.engine = newEngine
+
+  Right(RewindResult(targetActionCount, disconnectedCount))
+}
+```
+
+### GameHistory Enhancement
+
+Add method to get state at a specific action count:
+
+```scala
+trait GameHistory {
+  // ... existing methods ...
+
+  def stateAt(actionCount: Int): GameState = {
+    if (actionCount == 0) initialState
+    else all(actionCount - 1).resultingState
+  }
+
+  def truncateTo(actionCount: Int): GameHistory = {
+    GameHistoryImpl(
+      initialState = initialState,
+      actions = all.take(actionCount)
+    )
+  }
+}
+```
+
+### Admin Server Route
+
+| Route | Method | Description |
+|-------|--------|-------------|
+| `/games/{id}/rewind` | POST | Rewind game (form: `target_action_count`) |
+| `/games/{id}/rewind/confirm` | GET | Confirmation modal (htmx partial) |
+
+### Rewind UI Flow
+
+1. User views game history
+2. User clicks "Rewind to here" on an action row
+3. Confirmation modal appears via htmx:
+   ```
+   ┌─────────────────────────────────────────┐
+   │  Rewind Game abc123f?                   │
+   │                                         │
+   │  This will:                             │
+   │  • Restore to action 456 (Round 23)     │
+   │  • Discard 778 subsequent actions       │
+   │  • Disconnect 2 connected players       │
+   │                                         │
+   │  This cannot be undone.                 │
+   │                                         │
+   │            [Cancel]  [Rewind]           │
+   └─────────────────────────────────────────┘
+   ```
+4. On confirm, POST to `/games/{id}/rewind`
+5. Success: redirect to game detail showing new state
+6. Error: show error message
+
+### Safety Considerations
+
+1. **No undo**: Rewinding discards history. Consider optional backup before rewind.
+2. **Client disconnect**: All connected clients are forcibly disconnected.
+3. **AI state**: Ensure AI clients restart cleanly after rewind.
+4. **Concurrent access**: Lock game during rewind to prevent race conditions.
+5. **Authorization**: In production, require admin authentication.
+
+---
+
+## Implementation Phases
+
+### Phase 1: Web UI Foundation
+
+**Status: Complete**
+
+1. ✅ Set up Go templates with `embed`
+2. ✅ Add Pico CSS and htmx
+3. ✅ Create base layout with navigation
+4. ✅ Convert `/games` to HTML with styling
+5. ✅ Add game detail page with history table
+6. ✅ Implement htmx infinite scroll for history
+7. ✅ Reverse history order (most recent first)
+8. ✅ Clickable action rows that expand to show JSON representation
+9. ✅ Add `/games/{id}/action/{index}` endpoint for fetching action details
+
+**Deliverable**: Browsable game list and history in HTML with clickable action details
+
+### Phase 2: Settings Management
+
+**Status: Complete**
+
+1. ✅ Add `GetSettings` to `eagle.proto` (uses existing `AddSettings` for updates)
+2. ✅ Add `getAllSettings` method to auto-generated `SettingsLoader`
+3. ✅ Implement `getSettings` in `EagleServiceImpl`
+4. ✅ Create settings list page with live search
+5. ✅ Add inline editing with htmx
+6. ✅ Modified settings are highlighted
+
+**Deliverable**: View and edit settings via admin UI
+
+### Phase 3: Game Rewind
+
+**Status: Complete**
+
+1. ✅ Add `RewindGame` to `eagle.proto`
+2. ✅ Implement `stateAt` and `truncateTo` in `GameHistory`
+3. ✅ Implement rewind logic in `Engine` and `GameController`
+4. ✅ Add rewind confirmation (htmx `hx-confirm` dialog)
+5. ✅ Handle client disconnection gracefully
+6. ✅ Add rewind button to history rows
+7. ✅ Implement `rewindGame` in `GamesManager` and `EagleServiceImpl`
+8. ✅ Add admin server `/games/{id}/rewind` POST handler
+9. ✅ Add success/error feedback UI
+
+**Deliverable**: Rewind games to any previous action
+
+### Phase 4: Polish
+
+**Status: Not Started**
+
+#### High Priority
+1. **Add tests for rewind functionality**
+   - `PersistedHistory.truncateTo` (handles complex persisted vs recent logic)
+   - `InMemoryHistory.truncateTo`
+   - `EngineImpl.rewindTo`
+   - `GameController.rewindTo`
+   - `GamesManager.rewindGame`
+
+2. **Improve action history display**
+   - Human-readable action type names (e.g., "New Round" instead of "NewRoundAction")
+   - Show acting faction/province when available
+   - Action summaries from the `summary` field in `GameHistoryEntry`
+
+#### Medium Priority
+3. **Settings improvements**
+   - Group settings by category prefix (AI*, Combat*, Economy*, etc.)
+   - Show setting descriptions where available
+   - Pagination for large settings lists
+
+4. **Error handling improvements**
+   - Better error messages on failed operations
+   - Retry logic for transient gRPC failures
+
+#### Low Priority (Nice to Have)
+5. **Basic auth** - HTTP Basic Auth or OAuth for production use
+6. **Audit logging** - Log admin actions with timestamps
+7. **Documentation** - Usage guide, deployment notes
+
+#### Future Considerations
+- Game creation from admin UI
+- Player management (view connected players, force disconnect)
+- Export game history to file
+- Metrics/stats dashboard
+
+---
+
+## Security Notes
+
+The admin server is intended for local/trusted network use only. For production:
+
+1. **Do not expose to public internet** without authentication
+2. Consider adding HTTP Basic Auth or OAuth
+3. Run on internal network or behind VPN
+4. Log all admin actions for audit trail
+
+---
+
+## Open Questions
+
+1. **Settings persistence**: Should we add optional persistence to disk/database?
+2. **Game snapshots**: Should rewind create a backup first?
+3. **Multi-admin**: Need locking if multiple admins access simultaneously?
+4. **Shardok settings**: Are there Shardok (C++) settings to expose too?

docs/DEPROTO_PLAN.md

@@ -197,9 +197,9 @@ Change APIs to vend Scala `GameState` and `ActionResultT` instead of proto versi
 
 ### Remaining Proto Usage in Actions
 
-**Progress: 46 of 52 action files (88%) are fully protoless.**
+**Progress: 47 of 52 action files (90%) are fully protoless.**
 
-The following 6 actions still have proto usage:
+The following 5 actions still have proto usage:
 
 | Action | Proto Usages | Blocker | Effort |
 |--------|--------------|---------|--------|
@@ -208,7 +208,8 @@ The following 6 actions still have proto usage:
 | `EndHandleRiotsPhaseAction` | 2 | `CommandChoiceHelpers` takes proto GameState | Medium |
 | `PerformVassalDefenseDecisionsAction` | 2 | `CommandChoiceHelpers` takes proto GameState | Medium |
 | `EndVassalCommandsPhaseAction` | 1 | `CommandChoiceHelpers` takes proto GameState | Medium |
-| `NewRoundAction` | 1 | `ChronicleEventGenerator` returns proto | Medium |
+
+**Note:** `NewRoundAction` is now fully protoless after converting `ChronicleEventGenerator` to return Scala `ChronicleEvent` types directly.
 
 **Deleted Dead Code:**
 - `UnaffiliatedHeroMovedAction` - Was never called; `PerformUnaffiliatedHeroesAction.heroMovedResult` constructs `ActionResultC` directly
@@ -224,16 +225,47 @@ The following 6 actions still have proto usage:
 |-----------|-------|------------|--------|
 | `CommandChoiceHelpers` to Scala | ~2000 | High | 4 vassal actions |
 | `ResolveBattleAction` refactor | ~500 | High | 1 action (complex) |
-| `ChronicleEventGenerator` to Scala | ~400 | Medium | 1 action |
 | History API updates | ~100 | Low | - |
-| **Total Remaining** | **~3000** | | |
+| **Total Remaining** | **~2600** | | |
+
+**Completed:**
+- `ChronicleEventGenerator` converted to return Scala `ChronicleEvent` types directly
+
+### CommandChoiceHelpers Migration Status
+
+Several command selectors have already been converted to use Scala types:
+
+| File | Status | Notes |
+|------|--------|-------|
+| `AttackCommandChooser.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
+| `AlmsCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
+| `FoodConsumptionUtils.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `RoundPhase` |
+| `MarchSuppliesHelpers.scala` | ✅ **Protoless** | Uses `BattalionT` |
+| `CombatUnitSelector.scala` | ✅ **Protoless** | Uses `HeroT`, `BattalionT`, `BattalionType` |
+| `ExpandCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `FactionT` |
+| `ImproveCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `HeroT` |
+| `OrganizeCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `BattalionT`, `BattalionType` |
+| `RansomOfferHelpers.scala` | ✅ **Protoless** | Uses Scala `GameState`, `FactionT` |
+| `CommandChoiceHelpers.scala` | ❌ Proto | Main entry point, converts to Scala when calling converted selectors |
+| `ProvinceGoldSurplusCalculator.scala` | **Partial** | Has both Scala and proto overloads |
+| Other selectors | ❌ Proto | Various proto dependencies |
+
+**Pattern**: `CommandChoiceHelpers` currently uses `GameStateConverter.fromProto(gameState)` when calling already-converted selectors like `AlmsCommandSelector` and `AttackCommandChooser`. This allows incremental migration.
+
+**Next Steps**:
+1. ~~Convert `ExpandCommandSelector` to Scala types~~ ✅ Done
+2. ~~Convert `ImproveCommandSelector` to Scala types~~ ✅ Done
+3. ~~Convert `OrganizeCommandSelector` to Scala types~~ ✅ Done (PR #4812)
+4. ~~Convert `RansomOfferHelpers` to Scala types~~ ✅ Done (PR #4821)
+5. Convert remaining selectors one at a time
+6. Update `CommandChoiceHelpers` to accept Scala `GameState` once all selectors are converted
 
 ### Progress Summary
 
 | Metric | Value |
 |--------|-------|
-| Action files fully protoless | 46 / 52 (88%) |
-| Proto usages in remaining actions | 33 total |
+| Action files fully protoless | 47 / 52 (90%) |
+| Proto usages in remaining actions | 32 total |
 | Biggest blocker | `ResolveBattleAction` (24 usages) |
 | Second biggest blocker | `CommandChoiceHelpers` (blocks 4 actions) |
 

docs/OAUTH_IMPLEMENTATION_PLAN.md

@@ -0,0 +1,189 @@
+# Discord + Google OAuth Implementation Plan
+
+## Overview
+
+Replace HTTP Basic Auth with OAuth 2.0 (Discord + Google) for Eagle0. Users authenticate via system browser, receive JWT tokens, and choose their own display names.
+
+## Architecture
+
+```
+Unity Client                                          Eagle Server
+     |                                                      |
+     |  1. Click "Login with Discord/Google"                |
+     |  ------------------------------------------------->  |
+     |     GetOAuthUrl(provider) -> auth_url + state        |
+     |                                                      |
+     |  2. Open system browser -> OAuth consent             |
+     |  3. User authenticates with provider                 |
+     |  4. Redirect to eagle0://auth/callback?code=xxx      |
+     |                                                      |
+     |  5. ExchangeCode(code, state)                        |
+     |  ------------------------------------------------->  |
+     |     Exchange code with provider                      |
+     |     Fetch user info (id, email, avatar)              |
+     |     Create/update user record                        |
+     |     Issue JWT + refresh token                        |
+     |  <-------------------------------------------------  |
+     |     (jwt, refresh_token, user_info, is_new_user)     |
+     |                                                      |
+     |  6. [If new user] SetDisplayName(name)               |
+     |  ------------------------------------------------->  |
+     |                                                      |
+     |  7. Subsequent gRPC calls                            |
+     |     Authorization: Bearer <jwt>                      |
+     |  ------------------------------------------------->  |
+```
+
+## Key Design Decisions
+
+| Decision | Choice | Rationale |
+|----------|--------|-----------|
+| OAuth flow | System browser + deep link | Secure, supports password managers |
+| Code exchange | Eagle server directly | No separate auth service needed |
+| JWT signing | RS256 (asymmetric) | Future flexibility for token verification |
+| User storage | Protobuf file via Persister | Consistent with existing patterns |
+| Token expiry | 7-day access, 30-day refresh | Balance security and gaming UX |
+
+## Implementation Phases
+
+### Phase 1: Proto Definitions & Infrastructure
+
+**New files:**
+- `src/main/protobuf/net/eagle0/eagle/api/auth.proto` - Auth API messages
+- `src/main/protobuf/net/eagle0/eagle/internal/user.proto` - User storage schema
+
+**Key proto messages:**
+```protobuf
+// API
+GetOAuthUrlRequest/Response     // Get OAuth URL to open in browser
+ExchangeCodeRequest/Response    // Exchange auth code for JWT
+SetDisplayNameRequest/Response  // Set user's display name
+RefreshTokenRequest/Response    // Refresh expired access token
+
+// Internal storage
+User                           // user_id, display_name, oauth_identities
+UserDatabase                   // All users + indexes for lookup
+```
+
+### Phase 2: Eagle Server Auth Services
+
+**New Scala files:**
+- `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` - Discord/Google config from env vars
+- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - JWT creation/validation (RS256)
+- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD, display name validation
+- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth code exchange
+- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC service implementation
+
+**Modify:**
+- `src/main/scala/net/eagle0/eagle/service/AuthorizationInterceptor.scala`
+  - Replace Basic Auth parsing with JWT validation
+  - Skip auth for public endpoints (GetOAuthUrl, ExchangeCode, RefreshToken)
+- `src/main/scala/net/eagle0/eagle/service/AuthorizationUtils.scala`
+  - Change context keys from `userName` to `userId` + `displayName`
+- `src/main/scala/net/eagle0/eagle/service/Main.scala`
+  - Wire up new auth services and JWT key loading
+
+### Phase 3: Unity Client OAuth Flow
+
+**New C# files:**
+- `Assets/Auth/OAuthManager.cs` - OAuth flow + deep link handling
+- `Assets/Auth/TokenStorage.cs` - Secure token persistence
+- `Assets/Auth/AuthClient.cs` - gRPC client for auth service
+
+**Modify:**
+- `Assets/EagleConnection.cs`
+  - Replace `AuthInterceptor` (Basic Auth) with `JwtAuthInterceptor` (Bearer token)
+- `Assets/ConnectionHandler/ConnectionHandler.cs`
+  - Replace username/password UI with Discord/Google login buttons
+  - Add display name setup flow for new users
+
+### Phase 4: Platform Configuration
+
+**Deep link registration:**
+- iOS: Add `eagle0://` to CFBundleURLSchemes in Info.plist
+- Android: Add intent-filter for `eagle0://auth` in AndroidManifest.xml
+- Desktop: Register URL scheme (Windows registry / macOS plist)
+
+**OAuth provider setup:**
+1. Discord Developer Portal: Create app, add redirect URI `eagle0://auth/callback`
+2. Google Cloud Console: Create OAuth client, add redirect URI
+
+**Environment variables (server):**
+```
+DISCORD_CLIENT_ID
+DISCORD_CLIENT_SECRET
+GOOGLE_CLIENT_ID
+GOOGLE_CLIENT_SECRET
+JWT_PRIVATE_KEY_PATH
+JWT_PUBLIC_KEY_PATH
+```
+
+### Phase 5: Testing
+
+**Unit tests:**
+- `JwtServiceSpec.scala` - Token creation/validation
+- `UserServiceSpec.scala` - Display name validation, uniqueness
+- `OAuthServiceSpec.scala` - OAuth flow with mocked providers
+
+**Integration tests:**
+- Full OAuth flow with mock provider
+- JWT validation in AuthorizationInterceptor
+- gRPC calls with valid/invalid tokens
+
+**Manual testing:**
+- [ ] Discord login (Windows, macOS)
+- [ ] Google login (Windows, macOS)
+- [ ] Deep link callback works
+- [ ] Display name validation
+- [ ] Session persistence across restarts
+- [ ] Token refresh
+
+## Files Summary
+
+### Create
+| File | Purpose |
+|------|---------|
+| `src/main/protobuf/net/eagle0/eagle/api/auth.proto` | Auth API definitions |
+| `src/main/protobuf/net/eagle0/eagle/internal/user.proto` | User storage schema |
+| `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` | Provider config |
+| `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` | JWT handling |
+| `src/main/scala/net/eagle0/eagle/auth/UserService.scala` | User management |
+| `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` | OAuth flow |
+| `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` | gRPC service |
+| `Assets/Auth/OAuthManager.cs` | Unity OAuth manager |
+| `Assets/Auth/TokenStorage.cs` | Token storage |
+| `Assets/Auth/AuthClient.cs` | Auth gRPC client |
+
+### Modify
+| File | Changes |
+|------|---------|
+| `AuthorizationInterceptor.scala` | Basic Auth -> JWT validation |
+| `AuthorizationUtils.scala` | userName -> userId + displayName |
+| `Main.scala` | Wire auth services |
+| `EagleConnection.cs` | AuthInterceptor -> JwtAuthInterceptor |
+| `ConnectionHandler.cs` | Login UI -> OAuth buttons + display name |
+
+### Delete
+- nginx htpasswd configuration (no longer needed)
+
+## Security Considerations
+
+1. **State parameter** - CSRF protection in OAuth flow
+2. **PKCE** - Consider adding for mobile (enhancement)
+3. **Secure storage** - Use Keychain (iOS) / Keystore (Android) for tokens
+4. **Token refresh** - 7-day access tokens with 30-day refresh
+5. **Rate limiting** - Limit login attempts per IP
+
+## Dependencies to Add
+
+**Scala (MODULE.bazel):**
+- JWT library (e.g., `jwt-scala` or `nimbus-jose-jwt`)
+- HTTP client (e.g., `sttp` for OAuth requests)
+
+**Unity:**
+- Deep linking is built-in (Unity 2021+)
+- No additional packages required
+
+## Rollback Plan
+
+Keep Basic Auth code in a feature branch. Both auth methods can coexist during transition via feature flag if needed.

docs/PRODUCTIONIZATION.md

@@ -348,6 +348,68 @@ services:
 
 ---
 
+## Docker Networking & Resource Configuration
+
+### Container Network Binding
+
+In Docker, each container has its own network namespace. When a server binds to `localhost` (127.0.0.1), it only accepts connections from within the same container. Other containers on the Docker bridge network cannot connect, even if they can resolve the hostname.
+
+**Shardok must bind to `0.0.0.0:40042`** to accept connections from Eagle running in a separate container. This is configured in `ServerConfiguration.cpp`:
+
+```cpp
+// Default to 0.0.0.0 for container networking (accepts connections from any interface)
+{ServerConfiguration::kEagleInterfaceGrpcAddress, "0.0.0.0:40042"}
+```
+
+This still works on the local Mac because `0.0.0.0` means "all interfaces", which includes the loopback interface that localhost uses.
+
+### gRPC Plaintext for Internal Communication
+
+By default, gRPC's `ManagedChannelBuilder` attempts TLS connections. Since Shardok runs in plaintext mode, Eagle must use `.usePlaintext()` for internal container-to-container communication:
+
+```scala
+// ServerSetupHelpers.scala
+val channelBuilder = ManagedChannelBuilder
+  .forAddress(shardokInterfaceAddress, shardokInterfacePort)
+  .usePlaintext()  // Required for internal Docker communication
+```
+
+TLS termination happens at nginx for external clients. Internal traffic between Eagle and Shardok stays within the Docker network and doesn't need encryption.
+
+**Future consideration:** If Shardok moves to a separate droplet, traffic would traverse the network. Options:
+1. Enable TLS between Eagle and Shardok (configure Shardok with certificates)
+2. Use DigitalOcean VPC (private network, still unencrypted but isolated)
+3. Use WireGuard/VPN tunnel between hosts
+
+### Bazel Runfiles in Docker
+
+Bazel's runfiles system locates resources relative to the executable using a manifest or directory structure that Bazel sets up at runtime. This doesn't exist in Docker containers.
+
+**Solution:** Environment variable fallbacks in `FilesystemUtils.cpp`:
+
+```cpp
+// Check for Docker deployment env vars first
+const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
+if (resourcesPath != nullptr) {
+    return string(resourcesPath) + "/";
+}
+// Fall back to Bazel runfiles for local development
+return rLocation + "/src/main/resources/net/eagle0/shardok/";
+```
+
+The Docker Compose configuration sets these:
+```yaml
+environment:
+  SHARDOK_RESOURCES_PATH: "/app/resources"
+  SHARDOK_MAPS_PATH: "/app/resources/maps"
+```
+
+This allows the same binary to work in both environments:
+- **Local dev:** No env var → uses Bazel runfiles
+- **Docker:** Env var set → uses `/app/resources/` directly
+
+---
+
 ## Build Pipeline
 
 ### Build Artifacts

maven_install.json

@@ -1,7 +1,7 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": 289080209,
-  "__RESOLVED_ARTIFACTS_HASH": -131178107,
+  "__INPUT_ARTIFACTS_HASH": -1064460283,
+  "__RESOLVED_ARTIFACTS_HASH": -1574144850,
   "conflict_resolution": {
     "com.google.guava:failureaccess:1.0.1": "com.google.guava:failureaccess:1.0.2",
     "com.squareup.okio:okio:2.10.0": "com.squareup.okio:okio:3.6.0",
@@ -48,6 +48,12 @@
       },
       "version": "2.12.7"
     },
+    "com.github.stephenc.jcip:jcip-annotations": {
+      "shasums": {
+        "jar": "4fccff8382aafc589962c4edb262f6aa595e34f1e11e61057d1c6a96e8fc7323"
+      },
+      "version": "1.0-1"
+    },
     "com.google.android:annotations": {
       "shasums": {
         "jar": "ba734e1e84c09d615af6a09d33034b4f0442f8772dec120efb376d86a565ae15"
@@ -156,6 +162,12 @@
       },
       "version": "1.4.2"
     },
+    "com.nimbusds:nimbus-jose-jwt": {
+      "shasums": {
+        "jar": "12ae4a3a260095d7aeba2adea7ae396e8b9570db8b7b409e09a824c219cc0444"
+      },
+      "version": "9.37.3"
+    },
     "com.squareup.okhttp3:okhttp": {
       "shasums": {
         "jar": "b1050081b14bb7a3a7e55a4d3ef01b5dcfabc453b4573a4fc019767191d5f4e0"
@@ -810,6 +822,9 @@
       "org.checkerframework:checker-qual",
       "org.ow2.asm:asm"
     ],
+    "com.nimbusds:nimbus-jose-jwt": [
+      "com.github.stephenc.jcip:jcip-annotations"
+    ],
     "com.squareup.okhttp3:okhttp": [
       "com.squareup.okio:okio",
       "org.jetbrains.kotlin:kotlin-stdlib-jdk8"
@@ -1355,6 +1370,9 @@
       "com.fasterxml.jackson.databind.type",
       "com.fasterxml.jackson.databind.util"
     ],
+    "com.github.stephenc.jcip:jcip-annotations": [
+      "net.jcip.annotations"
+    ],
     "com.google.android:annotations": [
       "android.annotation"
     ],
@@ -1500,6 +1518,38 @@
     "com.google.truth:truth": [
       "com.google.common.truth"
     ],
+    "com.nimbusds:nimbus-jose-jwt": [
+      "com.nimbusds.jose",
+      "com.nimbusds.jose.crypto",
+      "com.nimbusds.jose.crypto.bc",
+      "com.nimbusds.jose.crypto.factories",
+      "com.nimbusds.jose.crypto.impl",
+      "com.nimbusds.jose.crypto.opts",
+      "com.nimbusds.jose.crypto.utils",
+      "com.nimbusds.jose.jca",
+      "com.nimbusds.jose.jwk",
+      "com.nimbusds.jose.jwk.gen",
+      "com.nimbusds.jose.jwk.source",
+      "com.nimbusds.jose.mint",
+      "com.nimbusds.jose.proc",
+      "com.nimbusds.jose.produce",
+      "com.nimbusds.jose.shaded.gson",
+      "com.nimbusds.jose.shaded.gson.annotations",
+      "com.nimbusds.jose.shaded.gson.internal",
+      "com.nimbusds.jose.shaded.gson.internal.bind",
+      "com.nimbusds.jose.shaded.gson.internal.bind.util",
+      "com.nimbusds.jose.shaded.gson.internal.reflect",
+      "com.nimbusds.jose.shaded.gson.internal.sql",
+      "com.nimbusds.jose.shaded.gson.reflect",
+      "com.nimbusds.jose.shaded.gson.stream",
+      "com.nimbusds.jose.util",
+      "com.nimbusds.jose.util.cache",
+      "com.nimbusds.jose.util.events",
+      "com.nimbusds.jose.util.health",
+      "com.nimbusds.jwt",
+      "com.nimbusds.jwt.proc",
+      "com.nimbusds.jwt.util"
+    ],
     "com.squareup.okhttp3:okhttp": [
       "okhttp3",
       "okhttp3.internal",
@@ -2337,6 +2387,7 @@
       "com.fasterxml.jackson.core:jackson-annotations",
       "com.fasterxml.jackson.core:jackson-core",
       "com.fasterxml.jackson.core:jackson-databind",
+      "com.github.stephenc.jcip:jcip-annotations",
       "com.google.android:annotations",
       "com.google.api.grpc:proto-google-common-protos",
       "com.google.auth:google-auth-library-credentials",
@@ -2355,6 +2406,7 @@
       "com.google.protobuf:protobuf-java",
       "com.google.re2j:re2j",
       "com.google.truth:truth",
+      "com.nimbusds:nimbus-jose-jwt",
       "com.squareup.okhttp3:okhttp",
       "com.squareup.okhttp3:okhttp-sse",
       "com.squareup.okhttp:okhttp",

nginx/nginx.conf

@@ -0,0 +1,132 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    # Logging
+    log_format grpc_json escape=json '{'
+        '"time":"$time_iso8601",'
+        '"client":"$remote_addr",'
+        '"uri":"$uri",'
+        '"status":$status,'
+        '"grpc_status":"$sent_http_grpc_status",'
+        '"request_time":$request_time,'
+        '"upstream_time":"$upstream_response_time"'
+    '}';
+
+    access_log /var/log/nginx/access.log grpc_json;
+    error_log /var/log/nginx/error.log warn;
+
+    # Rate limiting zone
+    limit_req_zone $binary_remote_addr zone=grpc_limit:10m rate=100r/s;
+
+    # Docker DNS resolver - re-resolve hostnames every 10s
+    # This prevents stale IP caching when containers restart
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
+    # Upstream for Eagle gRPC server
+    upstream eagle_grpc {
+        server eagle:40032;
+        keepalive 100;
+    }
+
+    # HTTP server for Let's Encrypt challenge and redirect
+    server {
+        listen 80;
+        server_name prod.eagle0.net;
+
+        # Let's Encrypt challenge
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        # Redirect all other HTTP to HTTPS
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    # HTTPS server for gRPC
+    server {
+        listen 443 ssl;
+        http2 on;
+        server_name prod.eagle0.net;
+
+        # SSL certificates (managed by certbot)
+        ssl_certificate /etc/letsencrypt/live/prod.eagle0.net/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/prod.eagle0.net/privkey.pem;
+
+        # SSL configuration
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+        ssl_prefer_server_ciphers off;
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_tickets off;
+
+        # gRPC proxy for Eagle service
+        location /net.eagle0.eagle.api.Eagle {
+            # Rate limiting
+            limit_req zone=grpc_limit burst=50 nodelay;
+
+            # gRPC proxy
+            grpc_pass grpc://eagle_grpc;
+
+            # Timeouts for long-running streams
+            grpc_read_timeout 1200s;
+            grpc_send_timeout 1200s;
+            grpc_socket_keepalive on;
+
+            # Error handling
+            error_page 502 = /error502grpc;
+        }
+
+        # gRPC proxy for Auth service
+        location /net.eagle0.eagle.api.auth.Auth {
+            # Rate limiting
+            limit_req zone=grpc_limit burst=50 nodelay;
+
+            # gRPC proxy
+            grpc_pass grpc://eagle_grpc;
+
+            # Timeouts
+            grpc_read_timeout 30s;
+            grpc_send_timeout 30s;
+
+            # Error handling
+            error_page 502 = /error502grpc;
+        }
+
+        # OAuth callback endpoint (proxied to Eagle's HTTP handler)
+        location /oauth/callback {
+            proxy_pass http://eagle:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # Admin server proxy
+        location /admin/ {
+            proxy_pass http://admin:8080/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        # Health check endpoint
+        location /health {
+            access_log off;
+            return 200 "OK\n";
+            add_header Content-Type text/plain;
+        }
+
+        # gRPC error handling
+        location = /error502grpc {
+            internal;
+            default_type application/grpc;
+            add_header grpc-status 14;
+            add_header grpc-message "unavailable";
+            return 204;
+        }
+    }
+}

scripts/setup_droplet.sh

@@ -0,0 +1,149 @@
+#!/bin/bash
+#
+# Setup script for Eagle0 production droplet
+# Run this on a fresh DigitalOcean droplet (Ubuntu 24.04)
+#
+# Usage: curl -sSL https://raw.githubusercontent.com/nolen777/eagle0/main/scripts/setup_droplet.sh | sudo bash
+#
+
+set -euo pipefail
+
+DOMAIN="${DOMAIN:-eagle0.net}"
+DEPLOY_USER="${DEPLOY_USER:-deploy}"
+APP_DIR="/opt/eagle0"
+
+echo "=== Eagle0 Production Server Setup ==="
+echo "Domain: ${DOMAIN}"
+echo "Deploy user: ${DEPLOY_USER}"
+echo ""
+
+# Check if running as root
+if [[ $EUID -ne 0 ]]; then
+   echo "This script must be run as root (use sudo)"
+   exit 1
+fi
+
+echo "=== Updating system ==="
+apt-get update
+apt-get upgrade -y
+
+echo "=== Installing Docker ==="
+if ! command -v docker &> /dev/null; then
+    curl -fsSL https://get.docker.com | sh
+    systemctl enable docker
+    systemctl start docker
+else
+    echo "Docker already installed"
+fi
+
+echo "=== Installing Docker Compose plugin ==="
+apt-get install -y docker-compose-plugin
+
+echo "=== Installing additional utilities ==="
+apt-get install -y \
+    curl \
+    wget \
+    git \
+    netcat-openbsd \
+    jq \
+    htop \
+    unattended-upgrades
+
+echo "=== Configuring automatic security updates ==="
+cat > /etc/apt/apt.conf.d/20auto-upgrades << 'EOF'
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::AutocleanInterval "7";
+EOF
+
+echo "=== Creating deploy user ==="
+if ! id "${DEPLOY_USER}" &>/dev/null; then
+    useradd -m -s /bin/bash -G docker "${DEPLOY_USER}"
+    mkdir -p "/home/${DEPLOY_USER}/.ssh"
+    chmod 700 "/home/${DEPLOY_USER}/.ssh"
+    chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "/home/${DEPLOY_USER}/.ssh"
+    echo ""
+    echo "*** IMPORTANT: Add your SSH public key to /home/${DEPLOY_USER}/.ssh/authorized_keys ***"
+    echo ""
+else
+    echo "User ${DEPLOY_USER} already exists"
+    # Ensure user is in docker group
+    usermod -aG docker "${DEPLOY_USER}"
+fi
+
+echo "=== Creating application directory ==="
+mkdir -p "${APP_DIR}"/{nginx,certbot/conf,certbot/www,saves}
+chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "${APP_DIR}"
+
+echo "=== Configuring Docker registry authentication ==="
+echo ""
+echo "*** IMPORTANT: Run the following command to authenticate with DigitalOcean Container Registry: ***"
+echo "  docker login registry.digitalocean.com"
+echo ""
+
+echo "=== Creating systemd service ==="
+cat > /etc/systemd/system/eagle0.service << EOF
+[Unit]
+Description=Eagle0 Game Servers
+Requires=docker.service
+After=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=${APP_DIR}
+ExecStart=/usr/bin/docker compose -f docker-compose.prod.yml up -d
+ExecStop=/usr/bin/docker compose -f docker-compose.prod.yml down
+User=${DEPLOY_USER}
+Group=${DEPLOY_USER}
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable eagle0
+
+echo "=== Configuring firewall (UFW) ==="
+if ! command -v ufw &> /dev/null; then
+    apt-get install -y ufw
+fi
+
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow ssh
+ufw allow 80/tcp
+ufw allow 443/tcp
+ufw --force enable
+
+echo "=== Setting up log rotation ==="
+cat > /etc/logrotate.d/eagle0 << EOF
+/var/log/eagle0/*.log {
+    daily
+    missingok
+    rotate 14
+    compress
+    delaycompress
+    notifempty
+    create 0640 ${DEPLOY_USER} ${DEPLOY_USER}
+    sharedscripts
+}
+EOF
+
+mkdir -p /var/log/eagle0
+chown "${DEPLOY_USER}:${DEPLOY_USER}" /var/log/eagle0
+
+echo ""
+echo "=== Setup Complete ==="
+echo ""
+echo "Next steps:"
+echo "1. Add SSH public key to /home/${DEPLOY_USER}/.ssh/authorized_keys"
+echo "2. Copy docker-compose.prod.yml to ${APP_DIR}/"
+echo "3. Copy nginx/nginx.conf to ${APP_DIR}/nginx/"
+echo "4. Create .env file in ${APP_DIR}/ with OPENAI_API_KEY"
+echo "5. Run: docker login registry.digitalocean.com"
+echo "6. Get SSL certificate: (see init_ssl.sh)"
+echo "7. Start services: systemctl start eagle0"
+echo ""
+echo "Server IP: $(curl -s ifconfig.me)"
+echo ""

src/main/cpp/net/eagle0/common/FilesystemUtils.cpp

@@ -26,6 +26,13 @@ namespace fs = std::filesystem;
 static string rLocation;
 
 auto rloc(const string& execPath) -> string {
+    // First check for environment variable override for Docker deployment
+    const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
+    if (resourcesPath != nullptr) {
+        return "";  // Return empty so StaticShardokFilesDirectory uses env var directly
+    }
+
+    // Fall back to Bazel runfiles for development
     string error;
     const std::unique_ptr<Runfiles> runfiles(Runfiles::Create(execPath, &error));
 
@@ -58,10 +65,14 @@ auto FilesystemUtils::FileExistsAtPath(const string& path) -> bool { return fs::
 auto FilesystemUtils::StaticEagle0FilesDirectory() -> string { return "/usr/local/share/eagle0/"; }
 
 auto FilesystemUtils::StaticShardokFilesDirectory() -> string {
+    const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
+    if (resourcesPath != nullptr) { return string(resourcesPath) + "/"; }
     return rLocation + "/src/main/resources/net/eagle0/shardok/";
 }
 
 auto FilesystemUtils::MapFilesDirectory() -> string {
+    const char* mapsPath = getenv("SHARDOK_MAPS_PATH");
+    if (mapsPath != nullptr) { return string(mapsPath) + "/"; }
     return StaticShardokFilesDirectory() + "maps/";
 }
 

src/main/cpp/net/eagle0/common/IterableBitset.hpp

@@ -7,6 +7,7 @@
 
 #include <algorithm>
 #include <bit>
+#include <cstdint>
 #include <cstdlib>
 
 #define ITERABLE_BITSET_INDEX_CHECKS false

src/main/cpp/net/eagle0/common/MapUtils.cpp

@@ -9,6 +9,7 @@
 #include "MapUtils.hpp"
 
 #include <algorithm>
+#include <stdexcept>
 
 static inline std::string StringForKey(
         const std::unordered_map<std::string, std::string>& map,

src/main/cpp/net/eagle0/common/byte_vector.hpp

@@ -9,6 +9,7 @@
 #ifndef byte_vector_h
 #define byte_vector_h
 
+#include <cstdint>
 #include <cstring>
 #include <fstream>
 #include <sstream>

src/main/cpp/net/eagle0/shardok/ai/AITimeBudget.cpp

@@ -25,7 +25,8 @@ auto CalculateTimeBudget(
         const PlayerId playerId,
         const GameSettingsSPtr &settings,
         const GameStateW &state,
-        const size_t numCommands) -> AITimeBudget {
+        const size_t numCommands,
+        const bool isAllAiBattle) -> AITimeBudget {
     const auto settingsGetter = settings->GetGetter();
     const auto castleCoords = AllCastleCoords(state->hex_map());
 
@@ -34,8 +35,10 @@ auto CalculateTimeBudget(
                               net::eagle0::shardok::storage::fb::GameStatus_::State_SET_UP;
 
     // Get maximum budget cap from settings (in seconds)
+    // For all-AI battles, use the faster budget limit
     const double maxBudgetSeconds =
-            settingsGetter.Backing().lookahead_time_budget_maximum_seconds();
+            isAllAiBattle ? settingsGetter.Backing().all_ai_battle_time_budget_maximum()
+                          : settingsGetter.Backing().lookahead_time_budget_maximum_seconds();
     const double maxBudgetMs = maxBudgetSeconds * 1000.0;
 
     // During setup, use the setup-specific time budget

src/main/cpp/net/eagle0/shardok/ai/AITimeBudget.hpp

@@ -38,11 +38,13 @@ struct AITimeBudget {
 // Calculate time budget based on proximity to enemies and castles
 // Time budget is calculated dynamically based on number of available commands:
 //   budget = msPerCommand × numCommands (clamped to 200-5000ms)
+// If isAllAiBattle is true, uses allAiBattleTimeBudgetMaximum instead of the normal maximum.
 auto CalculateTimeBudget(
         PlayerId playerId,
         const GameSettingsSPtr &settings,
         const GameStateW &state,
-        size_t numCommands) -> AITimeBudget;
+        size_t numCommands,
+        bool isAllAiBattle) -> AITimeBudget;
 
 }  // namespace shardok
 

src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.cpp

@@ -53,6 +53,7 @@ auto RoundsRemaining(const GameSettingsSPtr &settings, const GameStateView &gsv)
 ShardokAIClient::ShardokAIClient(
         const PlayerId playerId,
         const bool isDefender,
+        const bool isAllAiBattle,
         const HexMap *hexMap,
         const SettingsGetter &settings,
         const AIAlgorithmType aiAlgorithmType,
@@ -60,6 +61,7 @@ ShardokAIClient::ShardokAIClient(
         const mcts::MCTSConfig &mctsConfig)
     : playerId(playerId),
       isDefender(isDefender),
+      isAllAiBattle(isAllAiBattle),
       aiAlgorithmType(aiAlgorithmType),
       scoringCalculatorType(scoringCalculatorType),
       alCache(std::make_unique<AttackLocationsCache>(hexMap, settings)),
@@ -135,7 +137,8 @@ auto ShardokAIClient::StandardChooseCommandIndex(
     const auto commandCount = guessedCommands->size();
 
     // Calculate time budget based on game situation using new dynamic per-command settings
-    const auto timeBudget = CalculateTimeBudget(playerId, settings, guessedState, commandCount);
+    const auto timeBudget =
+            CalculateTimeBudget(playerId, settings, guessedState, commandCount, isAllAiBattle);
 
     // Configure MCTS based on proximity to enemy
     // When far from enemy: use AVERAGING with maxPlayerFlips=0 (single-player lookahead)

src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.hpp

@@ -41,6 +41,7 @@ class ShardokAIClient {
 private:
     const PlayerId playerId;
     const bool isDefender;
+    const bool isAllAiBattle;  // Whether this battle has only AI players (for faster time budgets)
     const AIAlgorithmType aiAlgorithmType;
     const ScoringCalculatorType scoringCalculatorType;
 
@@ -69,6 +70,7 @@ public:
     explicit ShardokAIClient(
             PlayerId playerId,
             bool isDefender,
+            bool isAllAiBattle,
             const HexMap* hexMap,
             const SettingsGetter& settings,
             AIAlgorithmType aiAlgorithmType,

src/main/cpp/net/eagle0/shardok/ai/TranspositionTable.cpp

@@ -4,6 +4,7 @@
 
 #include "TranspositionTable.hpp"
 
+#include <cinttypes>
 #include <cstdio>
 #include <cstring>
 
@@ -101,10 +102,10 @@ void TranspositionTable::clear() {
 
 void TranspositionTable::printStats() const {
     printf("TranspositionTable Stats:\n");
-    printf("  Probes: %llu\n", stats.probes.load());
-    printf("  Hits: %llu (%.1f%%)\n", stats.hits.load(), stats.hitRate());
-    printf("  Stores: %llu\n", stats.stores.load());
-    printf("  Collisions: %llu\n", stats.collisions.load());
+    printf("  Probes: %" PRIu64 "\n", stats.probes.load());
+    printf("  Hits: %" PRIu64 " (%.1f%%)\n", stats.hits.load(), stats.hitRate());
+    printf("  Stores: %" PRIu64 "\n", stats.stores.load());
+    printf("  Collisions: %" PRIu64 "\n", stats.collisions.load());
     printf("  Table size: %zu entries (%.1f MB)\n",
            TABLE_SIZE,
            (TABLE_SIZE * sizeof(TTEntry)) / (1024.0 * 1024.0));

src/main/cpp/net/eagle0/shardok/ai_battle_simulator/ai_battle_simulator_main.cpp

@@ -10,7 +10,6 @@
 #include "AiBattleConfig.hpp"
 #include "AiBattleSimulator.hpp"
 #include "src/main/cpp/net/eagle0/common/FilesystemUtils.hpp"
-#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 
 using shardok::ai_battle_simulator::AiBattleConfigLoader;
 using shardok::ai_battle_simulator::AiBattleSimulator;
@@ -109,10 +108,6 @@ int main(int argc, char* argv[]) {
     // Set exec path for FilesystemUtils
     FilesystemUtils::SetExecPath(argv[0]);
 
-    // Set cache directory for ActionPointDistances
-    shardok::FixedActionPointDistances::SetCacheDirectory(
-            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
-
     try {
         if (argc < 2) {
             PrintUsage(argv[0]);

src/main/cpp/net/eagle0/shardok/ai_performance_runner/AIPerformanceRunner.cpp

@@ -16,7 +16,6 @@
 #include "src/main/cpp/net/eagle0/shardok/ai_testing_common/AIClientFactory.hpp"
 #include "src/main/cpp/net/eagle0/shardok/ai_testing_common/GamePhaseRunner.hpp"
 #include "src/main/cpp/net/eagle0/shardok/library/ShardokEngine.hpp"
-#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 #include "src/main/protobuf/net/eagle0/shardok/common/command_type.pb.h"
 
 using namespace shardok;
@@ -84,10 +83,6 @@ int main(int argc, char* argv[]) {
     // Set exec path so FilesystemUtils can find resource files
     FilesystemUtils::SetExecPath(argv[0]);
 
-    // Set cache directory for ActionPointDistances
-    FixedActionPointDistances::SetCacheDirectory(
-            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
-
     try {
         std::cout << "Shardok AI Performance Runner\n";
         std::cout << "==============================\n";

src/main/cpp/net/eagle0/shardok/controller/ShardokGameController.cpp

@@ -24,9 +24,6 @@ using std::scoped_lock;
 using std::string;
 using std::unique_lock;
 using std::weak_ptr;
-using std::chrono::duration;
-
-static constexpr duration kWaitForUpdatesDuration = std::chrono::milliseconds(5000);
 
 using net::eagle0::shardok::common::GameStatus;
 
@@ -74,11 +71,17 @@ vector<shared_ptr<ShardokAIClient>> ShardokGameController::MakeAIClients(
     mctsConfig.maxSimulationFlips = 1;
     mctsConfig.simulationPolicy = mcts::MCTSSimulationPolicy::WEIGHTED_HEURISTIC;
 
-    for (const auto &pi : e->GetPlayerInfos()) {
+    // Check if all players are AI - if so, use faster time budgets
+    const auto &playerInfos = e->GetPlayerInfos();
+    const bool isAllAiBattle =
+            std::ranges::all_of(playerInfos, [](const auto &pi) { return pi.is_ai(); });
+
+    for (const auto &pi : playerInfos) {
         if (pi.is_ai()) {
             auto newClient = std::make_shared<ShardokAIClient>(
                     pi.player_id(),
                     pi.is_defender(),
+                    isAllAiBattle,
                     e->GetCurrentGameState()->hex_map(),
                     e->GetGameSettings()->GetGetter(),
                     AIAlgorithmType::ITERATIVE_DEEPENING,
@@ -278,15 +281,9 @@ auto ShardokGameController::GetUpdates(const int64_t startingActionId) -> AllUpd
         awrs = engine->GetGameHistory(startingActionId);
         incomingRegistrations--;
 
-        // If the current player is an AI, wait for some results to post. Otherwise go ahead and
-        // return, we might be telling the caller about available commands.
-        if (awrs.empty() && !engine->GameIsOver() &&
-            engine->GetPlayerInfos()[engine->GetCurrentPlayerId()].is_ai()) {
-            updateCondition.wait_for(guard, kWaitForUpdatesDuration);
-            incomingRegistrations++;
-            awrs = engine->GetGameHistory(startingActionId);
-            incomingRegistrations--;
-        }
+        // Note: Previously this had a 5-second wait for AI players to support long-polling.
+        // With streaming (WaitForUpdatesAndPush), the caller already waits for updates,
+        // so this wait is no longer needed. GetGameStatus is deprecated in favor of streaming.
 
         updates.mainResults.reserve(awrs.size());
         std::ranges::transform(
@@ -406,12 +403,10 @@ auto ShardokGameController::WaitForUpdatesAndPush(
         }
         // Lock released - GetUpdates will acquire its own lock
 
-        if (gameOver) {
-            subscriber->OnGameOver(gameOverInfo);
-            return true;
-        }
-
-        // Get updates outside the lock (GetUpdates acquires masterLock internally)
+        // IMPORTANT: Send any pending updates FIRST, including the final actions
+        // that caused the game to end. Previously, we returned early on gameOver
+        // without sending these final updates, causing the client to never see
+        // the last few battle actions.
         AllUpdates updates = GetUpdates(lastPushedActionId);
         lastPushedActionId = updates.newUnfilteredCount;
 
@@ -422,6 +417,12 @@ auto ShardokGameController::WaitForUpdatesAndPush(
                     updates.newUnfilteredCount,
                     updates.currentGameState);
         }
+
+        // Now send gameOver notification after all updates have been sent
+        if (gameOver) {
+            subscriber->OnGameOver(gameOverInfo);
+            return true;
+        }
     }
 
     return false;  // Subscriber disconnected

src/main/cpp/net/eagle0/shardok/library/action_point_distances/ActionPointDistancesCache.cpp

@@ -29,8 +29,6 @@ thread_local struct {
     int localMisses = 0;
     int sharedAccesses = 0;
     int evictionEvents = 0;
-    int apdLoadedFromFile = 0;
-    int apdGeneratedFresh = 0;
     std::chrono::steady_clock::time_point lastReportTime = std::chrono::steady_clock::now();
 } cacheStats;
 
@@ -40,16 +38,13 @@ static void MaybePrintCacheStats() {
     if (std::chrono::duration_cast<std::chrono::seconds>(now - cacheStats.lastReportTime).count() >=
         CACHE_STATS_FREQUENCY_SECONDS_) {
         printf("Thread cache stats: %d persistent hits, %d persistent misses, %d local hits, "
-               "%d local misses, %d shared accesses, %d eviction events, "
-               "%d APD loaded from file, %d APD generated fresh\n",
+               "%d local misses, %d shared accesses, %d eviction events\n",
                cacheStats.persistentHits,
                cacheStats.persistentMisses,
                cacheStats.localHits,
                cacheStats.localMisses,
                cacheStats.sharedAccesses,
-               cacheStats.evictionEvents,
-               cacheStats.apdLoadedFromFile,
-               cacheStats.apdGeneratedFresh);
+               cacheStats.evictionEvents);
         cacheStats.lastReportTime = now;
     }
 }
@@ -195,25 +190,12 @@ auto ActionPointDistancesCache::GetRaw(
     }
 
     // Create new pathfinding result using factory method
-    auto creationResult = FixedActionPointDistances::Create(
+    auto result = FixedActionPointDistances::Create(
             mapToUse,
-            mapId.terrainTypesId,
-            mapId.modifierId,
             battalionType,
             includeBravingWater,
             braveWaterActionPointCost);
 
-#if CACHE_STATS_LOGGING_
-    // Track whether this was loaded from file or generated fresh
-    if (creationResult.loadedFromFile) {
-        cacheStats.apdLoadedFromFile++;
-    } else {
-        cacheStats.apdGeneratedFresh++;
-    }
-#endif
-
-    auto result = creationResult.apd;
-
     // Store in shared cache
     sharedDistances.lazy_emplace_l(
             cacheKey,

src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.cpp

@@ -22,110 +22,56 @@ static const int ASYNC_COUNT = []() {
 
 namespace shardok {
 
-void FixedActionPointDistances::SetCacheDirectory(const string& newDir) {
-    cacheDirectory = newDir;
-    FilesystemUtils::MakeDirectoryIfNecessary(cacheDirectory);
-}
-
-static thread_local byte_vector _scratch;
-
 FixedActionPointDistances::FixedActionPointDistances(const HexMap* /*map*/, int columnCount)
     : ActionPointDistances(columnCount) {}
 
 auto FixedActionPointDistances::Create(
         const HexMap* map,
-        int64_t terrainTypesHash,
-        int64_t modifierHash,
         const BattalionTypeSPtr& battalionType,
         bool includeBravingWater,
-        int braveWaterActionPointCost) -> CreationResult {
+        int braveWaterActionPointCost) -> std::shared_ptr<FixedActionPointDistances> {
     // Create the object using private constructor
     auto apd = std::shared_ptr<FixedActionPointDistances>(
             new FixedActionPointDistances(map, map->column_count()));
 
-    CreationResult result;
-    result.apd = apd;
-    result.loadedFromFile = false;
-
-    string path = "";
-
-    if (!cacheDirectory.empty()) {
-        std::stringstream stream;
-        stream << cacheDirectory;
-        stream << std::hex << terrainTypesHash << '/';
-
-        if (auto directoryPath = stream.str(); !FilesystemUtils::FileExistsAtPath(directoryPath)) {
-            FilesystemUtils::MakeDirectoryIfNecessary(stream.str());
-        }
-
-        stream << std::hex << modifierHash;
-        stream << " " << battalionType->typeId;
-        if (includeBravingWater) { stream << " " << braveWaterActionPointCost; }
-        stream << ".apd";
-        path = stream.str();
-    }
-
     const int indexCount = map->row_count() * map->column_count();
 
-    if (!path.empty() && FilesystemUtils::FileExistsAtPath(path)) {
-        apd->distances.resize(indexCount);
-        // load from file
-        const auto& bytes = _scratch.ReplaceWithPath(path);
-        const auto* ptr = reinterpret_cast<const DIST_T*>(bytes.data());
+    vector<std::future<vector<vector<DIST_T>>>> futures(indexCount);
 
-        for (int fromIndex = 0; fromIndex < indexCount; fromIndex++) {
-            apd->distances[fromIndex].insert(
-                    apd->distances[fromIndex].end(),
-                    &(ptr[0]),
-                    &(ptr[indexCount]));
-            ptr += indexCount;
-        }
-        result.loadedFromFile = true;
-    } else {
-        _scratch.reserve(indexCount * indexCount * sizeof(DIST_T));
+    auto braveWaterPossibleCoords =
+            includeBravingWater ? apd->BraveWaterPossibleCoords(map) : nullptr;
 
-        vector<std::future<vector<vector<DIST_T>>>> futures(indexCount);
+    int chunkSize = (indexCount + ASYNC_COUNT - 1) / ASYNC_COUNT;
+    // Break into chunks for async
+    for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
+        futures[chunkIdx] = std::async(std::launch::async, [=]() -> vector<vector<DIST_T>> {
+            vector<vector<DIST_T>> chunkVec;
+            chunkVec.reserve(chunkSize);
+            const int chunkStartIndex = chunkIdx * chunkSize;
 
-        auto braveWaterPossibleCoords =
-                includeBravingWater ? apd->BraveWaterPossibleCoords(map) : nullptr;
-
-        int chunkSize = (indexCount + ASYNC_COUNT - 1) / ASYNC_COUNT;
-        // Break into chunks for async
-        for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
-            futures[chunkIdx] = std::async(std::launch::async, [=]() -> vector<vector<DIST_T>> {
-                vector<vector<DIST_T>> chunkVec;
-                chunkVec.reserve(chunkSize);
-                const int chunkStartIndex = chunkIdx * chunkSize;
-
-                for (int i = 0; i < chunkSize; i++) {
-                    const auto fromIndex = chunkStartIndex + i;
-                    if (fromIndex >= indexCount) { continue; }
-                    chunkVec.push_back(ActionPointDistances::GenerateDistances(
-                            fromIndex,
-                            map,
-                            includeBravingWater,
-                            braveWaterActionPointCost,
-                            battalionType,
-                            braveWaterPossibleCoords));
-                }
-                return chunkVec;
-            });
-        }
-
-        apd->distances.reserve(indexCount);
-        _scratch.clear();
-        _scratch.reserve(indexCount * indexCount * sizeof(DIST_T));
-
-        for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
-            auto resultsVec = futures[chunkIdx].get();
-            apd->distances.insert(apd->distances.end(), resultsVec.begin(), resultsVec.end());
-            for (const auto& r : resultsVec) { _scratch.append(r); }
-        }
-
-        if (!path.empty()) { FilesystemUtils::AtomicallySaveToPath(path, _scratch); }
+            for (int i = 0; i < chunkSize; i++) {
+                const auto fromIndex = chunkStartIndex + i;
+                if (fromIndex >= indexCount) { continue; }
+                chunkVec.push_back(ActionPointDistances::GenerateDistances(
+                        fromIndex,
+                        map,
+                        includeBravingWater,
+                        braveWaterActionPointCost,
+                        battalionType,
+                        braveWaterPossibleCoords));
+            }
+            return chunkVec;
+        });
     }
 
-    return result;
+    apd->distances.reserve(indexCount);
+
+    for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
+        auto resultsVec = futures[chunkIdx].get();
+        apd->distances.insert(apd->distances.end(), resultsVec.begin(), resultsVec.end());
+    }
+
+    return apd;
 }
 
 }  // namespace shardok

src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp

@@ -17,31 +17,19 @@ using std::vector;
 using BattalionTypeSPtr = std::shared_ptr<const BattalionType>;
 
 class FixedActionPointDistances final : public ActionPointDistances {
-public:
-    struct CreationResult {
-        std::shared_ptr<FixedActionPointDistances> apd;
-        bool loadedFromFile;
-    };
-
 private:
     vector<vector<DIST_T>> distances;
 
-    inline static string cacheDirectory = "";
-
     // Private constructor - use Create factory method instead
     explicit FixedActionPointDistances(const HexMap *map, int columnCount);
 
 public:
-    static void SetCacheDirectory(const string &newDir);
-
-    // Factory method to create FixedActionPointDistances with metadata
+    // Factory method to create FixedActionPointDistances
     static auto Create(
             const HexMap *map,
-            int64_t terrainTypesHash,
-            int64_t modifierHash,
             const BattalionTypeSPtr &battalionType,
             bool includeBravingWater,
-            int braveWaterActionPointCost = -1) -> CreationResult;
+            int braveWaterActionPointCost = -1) -> std::shared_ptr<FixedActionPointDistances>;
 
     ~FixedActionPointDistances() override = default;
 
@@ -52,8 +40,6 @@ public:
     [[nodiscard]] auto Distance(const Coords &from, const Coords &to) const -> DIST_T override {
         return Distance(ToIndex(from), ToIndex(to));
     }
-
-    friend struct CreationResult;
 };
 
 }  // namespace shardok

src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.cpp

@@ -322,23 +322,6 @@ void EagleInterfaceImpl::PopulateGameStatusResponse(
     }
 }
 
-auto EagleInterfaceImpl::GetGameStatus(
-        ServerContext * /*context*/,
-        const GameStatusRequest *request,
-        GameStatusResponse *response) -> Status {
-    shared_ptr<ShardokGameController> controller;
-    try {
-        controller = ControllerForGame(request->game_id(), request->game_setup_info());
-    } catch (NewGameException &e) { return e.GetStatus(); }
-
-    PopulateGameStatusResponse(
-            controller,
-            request->game_setup_info().known_result_count(),
-            response);
-
-    return Status::OK;
-}
-
 auto EagleInterfaceImpl::GetHexMap(
         ServerContext * /*context*/,
         const HexMapRequest *request,

src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.hpp

@@ -31,7 +31,6 @@ namespace shardok {
 using grpc::ServerContext;
 using grpc::Status;
 using net::eagle0::common::GameSetupInfo;
-using net::eagle0::common::GameStatusRequest;
 using net::eagle0::common::GameStatusResponse;
 using net::eagle0::common::GameSubscriptionRequest;
 using net::eagle0::common::HexMapNamesRequest;
@@ -68,10 +67,6 @@ public:
             ServerContext* context,
             const PlacementCommandsRequest* request,
             GameStatusResponse* response) -> Status override;
-    auto GetGameStatus(
-            ServerContext* context,
-            const GameStatusRequest* request,
-            GameStatusResponse* response) -> Status override;
 
     auto GetHexMap(ServerContext* context, const HexMapRequest* request, HexMapResponse* response)
             -> Status override;

src/main/cpp/net/eagle0/shardok/server/ServerConfiguration.cpp

@@ -8,6 +8,7 @@
 
 #include "ServerConfiguration.hpp"
 
+#include <cstdlib>
 #include <cstring>
 #include <fstream>
 #include <iostream>
@@ -30,9 +31,16 @@ using std::unordered_map;
 unordered_map<string, string> DefaultValues();
 
 unordered_map<string, string> DefaultValues() {
+    // Check environment variables for Docker deployment
+    // Docker containers should set SHARDOK_EAGLE_INTERFACE_ADDRESS=0.0.0.0:40042
+    // to listen on all interfaces for container networking
+    const char* eagleInterfaceAddr = getenv("SHARDOK_EAGLE_INTERFACE_ADDRESS");
+    const char* shardokAddr = getenv("SHARDOK_GRPC_ADDRESS");
+
     return unordered_map<string, string>{
-            {ServerConfiguration::kShardokGrpcAddress, "localhost"},
-            {ServerConfiguration::kEagleInterfaceGrpcAddress, "localhost"}};
+            {ServerConfiguration::kShardokGrpcAddress, shardokAddr ? shardokAddr : "localhost"},
+            {ServerConfiguration::kEagleInterfaceGrpcAddress,
+             eagleInterfaceAddr ? eagleInterfaceAddr : "localhost:40042"}};
 }
 
 ServerConfiguration::ServerConfiguration(const string& filePath) {

src/main/cpp/net/eagle0/shardok/server/ShardokGamesManager.cpp

@@ -15,7 +15,6 @@
 #include "ServerConfiguration.hpp"
 #include "src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.hpp"
 #include "src/main/cpp/net/eagle0/shardok/controller/ShardokGameController.hpp"
-#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 #include "src/main/cpp/net/eagle0/shardok/library/settings_loader/SettingsLoader.hpp"
 #include "src/main/cpp/net/eagle0/shardok/util/MapLoader.hpp"
 #include "src/main/flatbuffer/net/eagle0/shardok/storage/unit.hpp"
@@ -45,9 +44,6 @@ ShardokGamesManager::ShardokGamesManager(const std::vector<std::string> &extraSe
         std::cerr << "NOT SETTING" << std::endl;
         //        setter.SetRaw(key, value);
     }
-
-    FixedActionPointDistances::SetCacheDirectory(
-            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
 }
 
 auto ShardokGamesManager::GetController(const GameId &gameId)

src/main/csharp/net/eagle0/clients/unity/eagle0/Assembly-CSharp.csproj

@@ -68,6 +68,7 @@
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveInvitationCommandSelector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/SliderManager.cs" />
     <Compile Include="Assets/common/GUIUtils/TableRowHoverDetector.cs" />
+    <Compile Include="Assets/ConnectionHandler/DropGameConfirmationPanel.cs" />
     <Compile Include="Assets/Eagle/Table Rows/DynamicHeroTextUpdater.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/util/HeroDropdownController.cs" />
     <Compile Include="Assets/Eagle/Notifications/PrisonerReturnedNotificationGenerator.cs" />
@@ -125,6 +126,7 @@
     <Compile Include="Assets/Eagle/Notifications/Notification.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/QuestFailedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/QuestFulfilledDetailsNotificationGenerator.cs" />
+    <Compile Include="Assets/Auth/OAuthManager.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ProfessionGainedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/TextureList.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Modal Window/ModalWindowManager.cs" />
@@ -146,6 +148,7 @@
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ProvinceHeldDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Bluetooth/DieInfo.cs" />
     <Compile Include="Assets/common/ResourceFetcher.cs" />
+    <Compile Include="Assets/Auth/AuthClient.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/TruceRejectedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/RiotSuppressedNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Modal Window/ModalWindowManagerEditor.cs" />
@@ -153,6 +156,7 @@
     <Compile Include="Assets/Bluetooth/NativeDiceInterfaceImports.cs" />
     <Compile Include="Assets/Eagle/Notifications/ProvinceConqueredNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Table Rows/ExtraTroopsRowController.cs" />
+    <Compile Include="Assets/Auth/JwtAuthInterceptor.cs" />
     <Compile Include="Assets/Eagle/CommandPanelController.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ShatteredArmyDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/TurnHistoryPanelController.cs" />
@@ -258,6 +262,7 @@
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveTruceCommandSelector.cs" />
     <Compile Include="Assets/Eagle/ClientPregeneratedText.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/SwearBrotherhoodCommandSelector.cs" />
+    <Compile Include="Assets/Auth/TokenStorage.cs" />
     <Compile Include="Assets/Eagle/Table Rows/TableRowController.cs" />
     <Compile Include="Assets/Eagle/DisplayNames.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerSliderEditor.cs" />
@@ -363,6 +368,7 @@
     <Compile Include="Assets/Eagle/Table Rows/AvailableHeroTableRow.cs" />
     <Compile Include="Assets/Eagle/Table Rows/HeroRowController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerTooltip.cs" />
+    <Compile Include="Assets/Eagle/Notifications/ARNNotifications/NewFactionHeadDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/HexGrid.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Tooltip/TooltipManager.cs" />
     <None Include="Assets/TextMesh Pro/Resources/Shaders/TMPro.cginc" />

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth.meta

@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: 683e069fbc3074e35ac6fc3881a03f4a
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/AuthClient.cs

@@ -0,0 +1,161 @@
+using System;
+using System.Threading.Tasks;
+using Cysharp.Net.Http;
+using Grpc.Core;
+using Grpc.Core.Interceptors;
+using Grpc.Net.Client;
+using Net.Eagle0.Eagle.Api.Auth;
+using UnityEngine;
+using GrpcAuthClient = Net.Eagle0.Eagle.Api.Auth.Auth.AuthClient;
+
+namespace Auth {
+    /// <summary>
+    /// gRPC client for the Auth service.
+    /// Handles OAuth URL generation, status polling, and token refresh.
+    /// </summary>
+    public class AuthClient : IDisposable {
+        private const int PollIntervalMs = 2000;   // Poll every 2 seconds
+        private const int PollTimeoutMs = 300000;  // 5 minute timeout
+
+        private readonly GrpcAuthClient _client;
+        private readonly GrpcChannel _channel;
+
+        /// <summary>
+        /// Create auth client for the given server URL.
+        /// </summary>
+        /// <param name="serverUrl">Full URL with scheme, e.g. "http://localhost:40032" or
+        /// "https://prod.eagle0.net"</param>
+        public AuthClient(string serverUrl) {
+            _channel = GrpcChannel.ForAddress(
+                    serverUrl,
+                    new GrpcChannelOptions {
+                        HttpHandler = new YetAnotherHttpHandler { Http2Only = true },
+                        DisposeHttpClient = true
+                    });
+
+            // Create invoker with JWT interceptor for authenticated requests
+            CallInvoker invoker = _channel.Intercept(new JwtAuthInterceptor());
+            _client = new GrpcAuthClient(invoker);
+        }
+
+        /// <summary>
+        /// Get OAuth URL to open in system browser.
+        /// Returns both the URL and the state token for polling.
+        /// </summary>
+        /// <param name="provider">Discord or Google</param>
+        /// <returns>Tuple of (URL to open in browser, state token for polling)</returns>
+        public async Task<(string authUrl, string state)> GetOAuthUrlAsync(OAuthProvider provider) {
+            var request = new GetOAuthUrlRequest { Provider = provider };
+
+            var response = await _client.GetOAuthUrlAsync(request);
+
+            Debug.Log($"[AuthClient] Got OAuth URL for {provider}, state={response.State}");
+            return (response.AuthUrl, response.State);
+        }
+
+        /// <summary>
+        /// Poll for OAuth completion. Blocks until success, failure, or timeout.
+        /// The server handles the OAuth callback and token exchange.
+        /// </summary>
+        /// <param name="state">State token from GetOAuthUrlAsync</param>
+        /// <returns>Response with tokens and user info on success</returns>
+        public async Task<CheckOAuthStatusResponse> PollForOAuthCompletionAsync(string state) {
+            var startTime = DateTime.UtcNow;
+
+            while (true) {
+                var request = new CheckOAuthStatusRequest { State = state };
+                var response = await _client.CheckOAuthStatusAsync(request);
+
+                switch (response.Status) {
+                    case OAuthStatus.Success:
+                        Debug.Log(
+                                $"[AuthClient] OAuth successful, user={response.User?.DisplayName}, isNew={response.IsNewUser}");
+                        return response;
+
+                    case OAuthStatus.Failed:
+                        throw new Exception($"OAuth failed: {response.ErrorMessage}");
+
+                    case OAuthStatus.Expired:
+                        throw new Exception("OAuth session expired. Please try again.");
+
+                    case OAuthStatus.Pending:
+                        // Check timeout
+                        if ((DateTime.UtcNow - startTime).TotalMilliseconds > PollTimeoutMs) {
+                            throw new TimeoutException("OAuth login timed out. Please try again.");
+                        }
+                        // Wait before polling again
+                        await Task.Delay(PollIntervalMs);
+                        break;
+
+                    default: throw new Exception($"Unknown OAuth status: {response.Status}");
+                }
+            }
+        }
+
+        /// <summary>
+        /// Refresh access token using stored refresh token.
+        /// </summary>
+        /// <returns>New access token and expiry, or null if refresh failed</returns>
+        public async Task<RefreshTokenResponse> RefreshTokenAsync() {
+            var refreshToken = TokenStorage.RefreshToken;
+            if (string.IsNullOrEmpty(refreshToken)) {
+                throw new InvalidOperationException("No refresh token available");
+            }
+
+            var request = new RefreshTokenRequest { RefreshToken = refreshToken };
+
+            var response = await _client.RefreshTokenAsync(request);
+
+            // Update stored access token
+            TokenStorage.UpdateAccessToken(response.AccessToken, response.ExpiresAt);
+
+            Debug.Log($"[AuthClient] Token refreshed, expires at {response.ExpiresAt}");
+            return response;
+        }
+
+        /// <summary>
+        /// Set display name for new users.
+        /// Requires valid JWT in interceptor.
+        /// </summary>
+        public async Task<SetDisplayNameResponse> SetDisplayNameAsync(string displayName) {
+            var request = new SetDisplayNameRequest { DisplayName = displayName };
+            var response = await _client.SetDisplayNameAsync(request);
+
+            if (response.Success) {
+                TokenStorage.UpdateDisplayName(displayName);
+                Debug.Log($"[AuthClient] Display name set to: {displayName}");
+            } else {
+                Debug.LogWarning(
+                        $"[AuthClient] Failed to set display name: {response.ErrorMessage}");
+            }
+
+            return response;
+        }
+
+        /// <summary>
+        /// Get current user info. Validates the stored JWT.
+        /// </summary>
+        public async Task<GetCurrentUserResponse> GetCurrentUserAsync() {
+            var response = await _client.GetCurrentUserAsync(new GetCurrentUserRequest());
+            Debug.Log($"[AuthClient] Current user: {response.User?.DisplayName}");
+            return response;
+        }
+
+        /// <summary>
+        /// Logout - invalidates refresh token on server.
+        /// </summary>
+        public async Task LogoutAsync() {
+            try {
+                await _client.LogoutAsync(new LogoutRequest());
+            } catch (Exception ex) {
+                Debug.LogWarning($"[AuthClient] Logout RPC failed (may be expected): {ex.Message}");
+            }
+
+            // Clear local tokens regardless of server response
+            TokenStorage.Clear();
+            Debug.Log("[AuthClient] Logged out, tokens cleared");
+        }
+
+        public void Dispose() { _channel?.Dispose(); }
+    }
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/AuthClient.cs.meta

@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 4ba94126c2d2145b8875612eaf5bc371

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/JwtAuthInterceptor.cs

@@ -0,0 +1,75 @@
+using System;
+using Grpc.Core;
+using Grpc.Core.Interceptors;
+
+namespace Auth {
+    /// <summary>
+    /// gRPC interceptor that attaches JWT Bearer token to requests.
+    /// Reads token from TokenStorage on each request.
+    /// </summary>
+    public class JwtAuthInterceptor : Interceptor {
+        private const string HeaderName = "Authorization";
+
+        private string GetBearerHeader() {
+            var token = TokenStorage.AccessToken;
+            return string.IsNullOrEmpty(token) ? null : $"Bearer {token}";
+        }
+
+        public override TResponse BlockingUnaryCall<TRequest, TResponse>(
+                TRequest request,
+                ClientInterceptorContext<TRequest, TResponse> context,
+                BlockingUnaryCallContinuation<TRequest, TResponse> continuation) {
+            return continuation(request, ContextWithHeaders(context));
+        }
+
+        public override AsyncUnaryCall<TResponse> AsyncUnaryCall<TRequest, TResponse>(
+                TRequest request,
+                ClientInterceptorContext<TRequest, TResponse> context,
+                AsyncUnaryCallContinuation<TRequest, TResponse> continuation) {
+            return continuation(request, ContextWithHeaders(context));
+        }
+
+        public override AsyncServerStreamingCall<TResponse>
+        AsyncServerStreamingCall<TRequest, TResponse>(
+                TRequest request,
+                ClientInterceptorContext<TRequest, TResponse> context,
+                AsyncServerStreamingCallContinuation<TRequest, TResponse> continuation) {
+            return continuation(request, ContextWithHeaders(context));
+        }
+
+        public override AsyncClientStreamingCall<TRequest, TResponse>
+        AsyncClientStreamingCall<TRequest, TResponse>(
+                ClientInterceptorContext<TRequest, TResponse> context,
+                AsyncClientStreamingCallContinuation<TRequest, TResponse> continuation) {
+            return continuation(ContextWithHeaders(context));
+        }
+
+        public override AsyncDuplexStreamingCall<TRequest, TResponse>
+        AsyncDuplexStreamingCall<TRequest, TResponse>(
+                ClientInterceptorContext<TRequest, TResponse> context,
+                AsyncDuplexStreamingCallContinuation<TRequest, TResponse> continuation) {
+            return continuation(ContextWithHeaders(context));
+        }
+
+        private ClientInterceptorContext<TRequest, TResponse>
+        ContextWithHeaders<TRequest, TResponse>(
+                ClientInterceptorContext<TRequest, TResponse> original)
+                where TRequest : class
+                where TResponse : class {
+            var bearerHeader = GetBearerHeader();
+            if (string.IsNullOrEmpty(bearerHeader)) {
+                // No token available - return original context
+                // Auth service endpoints don't require token
+                return original;
+            }
+
+            var headers = new Metadata();
+            headers.Add(HeaderName, bearerHeader);
+
+            return new ClientInterceptorContext<TRequest, TResponse>(
+                    original.Method,
+                    original.Host,
+                    original.Options.WithHeaders(headers));
+        }
+    }
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/JwtAuthInterceptor.cs.meta

@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 8528d8ee967e042ecb2a5e8285c425e0

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/OAuthManager.cs

@@ -0,0 +1,183 @@
+using System;
+using System.Threading.Tasks;
+using Net.Eagle0.Eagle.Api.Auth;
+using UnityEngine;
+
+namespace Auth {
+    /// <summary>
+    /// Manages OAuth authentication flow using server-mediated polling:
+    /// - Opens system browser for OAuth consent
+    /// - Polls server for OAuth completion (no deep links needed)
+    /// - Token storage and refresh
+    /// </summary>
+    public class OAuthManager : MonoBehaviour {
+        public static OAuthManager Instance { get; private set; }
+
+        private AuthClient _authClient;
+        private string _currentServerUrl;
+
+        // Events for UI updates
+        public event Action<UserInfo> OnLoginSuccess;
+        public event Action<string> OnLoginFailed;
+        public event Action OnLogout;
+        public event Action<bool> OnNewUserNeedsDisplayName;  // true if new user
+
+        public bool IsAuthenticated => TokenStorage.HasValidToken;
+        public string DisplayName => TokenStorage.DisplayName;
+        public string UserId => TokenStorage.UserId;
+
+        private void Awake() {
+            if (Instance != null && Instance != this) {
+                Destroy(gameObject);
+                return;
+            }
+
+            Instance = this;
+            DontDestroyOnLoad(gameObject);
+            // AuthClient is created lazily when SetServerUrl is called
+        }
+
+        /// <summary>
+        /// Set the server URL for OAuth requests. Call this before any OAuth operations.
+        /// </summary>
+        /// <param name="serverUrl">Full URL with scheme, e.g. "https://prod.eagle0.net"</param>
+        public void SetServerUrl(string serverUrl) {
+            if (_currentServerUrl == serverUrl && _authClient != null) {
+                return;  // Already configured for this URL
+            }
+
+            _authClient?.Dispose();
+            _currentServerUrl = serverUrl;
+            _authClient = new AuthClient(serverUrl);
+            Debug.Log($"[OAuthManager] Configured for server: {serverUrl}");
+        }
+
+        private void OnDestroy() {
+            _authClient?.Dispose();
+            if (Instance == this) { Instance = null; }
+        }
+
+        private void EnsureConfigured() {
+            if (_authClient == null) {
+                throw new InvalidOperationException(
+                        "OAuthManager not configured. Call SetServerUrl() first.");
+            }
+        }
+
+        /// <summary>
+        /// Start OAuth login with specified provider.
+        /// Opens system browser for user consent, then polls for completion.
+        /// </summary>
+        public async Task<CheckOAuthStatusResponse> LoginAsync(OAuthProvider provider) {
+            EnsureConfigured();
+            try {
+                // Get OAuth URL and state from server
+                var (authUrl, state) = await _authClient.GetOAuthUrlAsync(provider);
+
+                // Open system browser
+                Debug.Log($"[OAuthManager] Opening browser: {authUrl}");
+                Application.OpenURL(authUrl);
+
+                // Poll for OAuth completion (server handles the callback)
+                var response = await _authClient.PollForOAuthCompletionAsync(state);
+
+                // Store tokens
+                TokenStorage.StoreTokens(
+                        response.AccessToken,
+                        response.RefreshToken,
+                        response.ExpiresAt,
+                        response.User.UserId,
+                        response.User.DisplayName ?? "");
+
+                // Notify listeners
+                if (response.IsNewUser) {
+                    OnNewUserNeedsDisplayName?.Invoke(true);
+                } else {
+                    OnLoginSuccess?.Invoke(response.User);
+                }
+
+                return response;
+            } catch (Exception ex) {
+                Debug.LogError($"[OAuthManager] Login failed: {ex.Message}");
+                OnLoginFailed?.Invoke(ex.Message);
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// Set display name for new user after OAuth.
+        /// </summary>
+        public async Task<bool> SetDisplayNameAsync(string displayName) {
+            EnsureConfigured();
+            var response = await _authClient.SetDisplayNameAsync(displayName);
+
+            if (response.Success) { OnLoginSuccess?.Invoke(response.User); }
+
+            return response.Success;
+        }
+
+        /// <summary>
+        /// Try to restore session from stored tokens.
+        /// Returns true if valid session exists.
+        /// Must call SetServerUrl() before this method.
+        /// </summary>
+        public async Task<bool> TryRestoreSessionAsync() {
+            if (_authClient == null) {
+                Debug.Log("[OAuthManager] Not configured yet, skipping session restore");
+                return false;
+            }
+
+            if (!TokenStorage.HasValidToken && !TokenStorage.HasRefreshToken) {
+                Debug.Log("[OAuthManager] No stored session");
+                return false;
+            }
+
+            // If token is expired but we have refresh token, try to refresh
+            if (!TokenStorage.HasValidToken && TokenStorage.HasRefreshToken) {
+                try {
+                    await _authClient.RefreshTokenAsync();
+                } catch (Exception ex) {
+                    Debug.LogWarning($"[OAuthManager] Token refresh failed: {ex.Message}");
+                    TokenStorage.Clear();
+                    return false;
+                }
+            }
+
+            // Validate session with server
+            try {
+                var response = await _authClient.GetCurrentUserAsync();
+                Debug.Log($"[OAuthManager] Session restored for {response.User.DisplayName}");
+                OnLoginSuccess?.Invoke(response.User);
+                return true;
+            } catch (Exception ex) {
+                Debug.LogWarning($"[OAuthManager] Session validation failed: {ex.Message}");
+                TokenStorage.Clear();
+                return false;
+            }
+        }
+
+        /// <summary>
+        /// Refresh access token if needed.
+        /// Call this before making API requests.
+        /// </summary>
+        public async Task EnsureValidTokenAsync() {
+            EnsureConfigured();
+            if (TokenStorage.NeedsRefresh && TokenStorage.HasRefreshToken) {
+                await _authClient.RefreshTokenAsync();
+            }
+        }
+
+        /// <summary>
+        /// Logout and clear stored tokens.
+        /// </summary>
+        public async Task LogoutAsync() {
+            // LogoutAsync can work even without server connection - just clear local tokens
+            if (_authClient != null) {
+                await _authClient.LogoutAsync();
+            } else {
+                TokenStorage.Clear();
+            }
+            OnLogout?.Invoke();
+        }
+    }
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/OAuthManager.cs.meta

@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 0e9d5b0cb9f26477eaf26e8a09c41707

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/TokenStorage.cs

@@ -0,0 +1,122 @@
+using System;
+using UnityEngine;
+
+namespace Auth {
+    /// <summary>
+    /// Secure storage for OAuth tokens using Unity's PlayerPrefs.
+    /// In production, consider using platform-specific secure storage
+    /// (Keychain on iOS, Keystore on Android).
+    /// </summary>
+    public static class TokenStorage {
+        private const string AccessTokenKey = "eagle0_access_token";
+        private const string RefreshTokenKey = "eagle0_refresh_token";
+        private const string ExpiresAtKey = "eagle0_expires_at";
+        private const string UserIdKey = "eagle0_user_id";
+        private const string DisplayNameKey = "eagle0_display_name";
+
+        public static bool HasValidToken {
+            get {
+                var token = AccessToken;
+                var expiresAt = ExpiresAt;
+                return !string.IsNullOrEmpty(token) &&
+                       expiresAt > DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+            }
+        }
+
+        public static bool HasRefreshToken => !string.IsNullOrEmpty(RefreshToken);
+
+        public static string AccessToken {
+            get => PlayerPrefs.GetString(AccessTokenKey, null);
+        private
+            set => PlayerPrefs.SetString(AccessTokenKey, value ?? "");
+        }
+
+        public static string RefreshToken {
+            get => PlayerPrefs.GetString(RefreshTokenKey, null);
+        private
+            set => PlayerPrefs.SetString(RefreshTokenKey, value ?? "");
+        }
+
+        public static long ExpiresAt {
+            get => long.TryParse(PlayerPrefs.GetString(ExpiresAtKey, "0"), out var val) ? val : 0;
+        private
+            set => PlayerPrefs.SetString(ExpiresAtKey, value.ToString());
+        }
+
+        public static string UserId {
+            get => PlayerPrefs.GetString(UserIdKey, null);
+        private
+            set => PlayerPrefs.SetString(UserIdKey, value ?? "");
+        }
+
+        public static string DisplayName {
+            get => PlayerPrefs.GetString(DisplayNameKey, null);
+        private
+            set => PlayerPrefs.SetString(DisplayNameKey, value ?? "");
+        }
+
+        /// <summary>
+        /// Store tokens received from OAuth exchange.
+        /// </summary>
+        public static void StoreTokens(
+                string accessToken,
+                string refreshToken,
+                long expiresAt,
+                string userId,
+                string displayName) {
+            AccessToken = accessToken;
+            RefreshToken = refreshToken;
+            ExpiresAt = expiresAt;
+            UserId = userId;
+            DisplayName = displayName;
+            PlayerPrefs.Save();
+
+            Debug.Log(
+                    $"[TokenStorage] Stored tokens for user {displayName} (expires at {expiresAt})");
+        }
+
+        /// <summary>
+        /// Update access token after refresh.
+        /// </summary>
+        public static void UpdateAccessToken(string accessToken, long expiresAt) {
+            AccessToken = accessToken;
+            ExpiresAt = expiresAt;
+            PlayerPrefs.Save();
+
+            Debug.Log($"[TokenStorage] Updated access token (expires at {expiresAt})");
+        }
+
+        /// <summary>
+        /// Update display name after user sets it.
+        /// </summary>
+        public static void UpdateDisplayName(string displayName) {
+            DisplayName = displayName;
+            PlayerPrefs.Save();
+        }
+
+        /// <summary>
+        /// Clear all stored tokens (logout).
+        /// </summary>
+        public static void Clear() {
+            PlayerPrefs.DeleteKey(AccessTokenKey);
+            PlayerPrefs.DeleteKey(RefreshTokenKey);
+            PlayerPrefs.DeleteKey(ExpiresAtKey);
+            PlayerPrefs.DeleteKey(UserIdKey);
+            PlayerPrefs.DeleteKey(DisplayNameKey);
+            PlayerPrefs.Save();
+
+            Debug.Log("[TokenStorage] Cleared all tokens");
+        }
+
+        /// <summary>
+        /// Check if token needs refresh (expires within 5 minutes).
+        /// </summary>
+        public static bool NeedsRefresh {
+            get {
+                var expiresAt = ExpiresAt;
+                var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+                return expiresAt > 0 && expiresAt - now < 300;  // 5 minutes
+            }
+        }
+    }
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Auth/TokenStorage.cs.meta

@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 4b1f130cec656466893fa04ba789d34f

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/AvailableGame item prefab.prefab

@@ -29,9 +29,9 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 616210323856016607}
-  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -105,20 +105,23 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
+  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_enableWordWrapping: 1
+  m_TextWrappingMode: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
+  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
+  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -185,9 +188,9 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 616210323856016607}
-  m_RootOrder: 2
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -261,20 +264,23 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
+  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_enableWordWrapping: 1
+  m_TextWrappingMode: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
+  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
+  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -344,10 +350,10 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children:
   - {fileID: 1806945232979884877}
   m_Father: {fileID: 616210323856016607}
-  m_RootOrder: 3
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -425,6 +431,7 @@ MonoBehaviour:
     atime6: 0
     atime7: 0
     m_Mode: 0
+    m_ColorSpace: -1
     m_NumColorKeys: 2
     m_NumAlphaKeys: 2
   _gradientType: 0
@@ -564,9 +571,9 @@ RectTransform:
   m_LocalRotation: {x: -0, y: -0, z: -0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 7057983938046569337}
-  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 1, y: 1}
@@ -640,20 +647,23 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
+  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_enableWordWrapping: 1
+  m_TextWrappingMode: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
+  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
+  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -701,13 +711,15 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children:
   - {fileID: 2291298599107070085}
   - {fileID: 8906549728612534620}
   - {fileID: 6686534948942979506}
+  - {fileID: 6700597635350808166}
+  - {fileID: 8218751192785770547}
   - {fileID: 7057983938046569337}
   m_Father: {fileID: 0}
-  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 1, y: 1}
@@ -796,31 +808,295 @@ MonoBehaviour:
   playerCountField: {fileID: 8350902200036365361}
   joinButton: {fileID: 437043893514773017}
   buttonText: {fileID: 2170549136187147757}
---- !u!114 &2580770409874757745
+  dropButton: {fileID: 19903828017934214}
+--- !u!1 &7127645211350815762
+GameObject:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  serializedVersion: 6
+  m_Component:
+  - component: {fileID: 8218751192785770547}
+  - component: {fileID: 3533697289353260343}
+  m_Layer: 5
+  m_Name: spacer
+  m_TagString: Untagged
+  m_Icon: {fileID: 0}
+  m_NavMeshLayer: 0
+  m_StaticEditorFlags: 0
+  m_IsActive: 1
+--- !u!224 &8218751192785770547
+RectTransform:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7127645211350815762}
+  m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
+  m_LocalPosition: {x: 0, y: 0, z: 0}
+  m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
+  m_Children: []
+  m_Father: {fileID: 616210323856016607}
+  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
+  m_AnchorMin: {x: 0, y: 0}
+  m_AnchorMax: {x: 0, y: 0}
+  m_AnchoredPosition: {x: 0, y: 0}
+  m_SizeDelta: {x: 0, y: 0}
+  m_Pivot: {x: 0.5, y: 0.5}
+--- !u!114 &3533697289353260343
 MonoBehaviour:
   m_ObjectHideFlags: 0
   m_CorrespondingSourceObject: {fileID: 0}
   m_PrefabInstance: {fileID: 0}
   m_PrefabAsset: {fileID: 0}
-  m_GameObject: {fileID: 8906549728612534621}
+  m_GameObject: {fileID: 7127645211350815762}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: UnityEngine.UI::UnityEngine.UI.LayoutElement
+  m_IgnoreLayout: 0
+  m_MinWidth: 10
+  m_MinHeight: -1
+  m_PreferredWidth: 10
+  m_PreferredHeight: -1
+  m_FlexibleWidth: -1
+  m_FlexibleHeight: -1
+  m_LayoutPriority: 1
+--- !u!1 &7934454793097069971
+GameObject:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  serializedVersion: 6
+  m_Component:
+  - component: {fileID: 6700597635350808166}
+  - component: {fileID: 5023923008883954850}
+  - component: {fileID: 19903828017934214}
+  - component: {fileID: 2151248441631091217}
+  - component: {fileID: 7406323257372084547}
+  m_Layer: 5
+  m_Name: Drop Game Button
+  m_TagString: Untagged
+  m_Icon: {fileID: 0}
+  m_NavMeshLayer: 0
+  m_StaticEditorFlags: 0
+  m_IsActive: 1
+--- !u!224 &6700597635350808166
+RectTransform:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7934454793097069971}
+  m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
+  m_LocalPosition: {x: 0, y: 0, z: 0}
+  m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
+  m_Children:
+  - {fileID: 1846732971937087380}
+  m_Father: {fileID: 616210323856016607}
+  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
+  m_AnchorMin: {x: 0, y: 0}
+  m_AnchorMax: {x: 0, y: 0}
+  m_AnchoredPosition: {x: 0, y: 0}
+  m_SizeDelta: {x: 0, y: 0}
+  m_Pivot: {x: 0.5, y: 0.5}
+--- !u!222 &5023923008883954850
+CanvasRenderer:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7934454793097069971}
+  m_CullTransparentMesh: 0
+--- !u!114 &19903828017934214
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7934454793097069971}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 4e29b1a8efbd4b44bb3f3716e73f07ff, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: 
+  m_Navigation:
+    m_Mode: 0
+    m_WrapAround: 0
+    m_SelectOnUp: {fileID: 0}
+    m_SelectOnDown: {fileID: 0}
+    m_SelectOnLeft: {fileID: 0}
+    m_SelectOnRight: {fileID: 0}
+  m_Transition: 1
+  m_Colors:
+    m_NormalColor: {r: 1, g: 0.42745098, b: 0.42745098, a: 1}
+    m_HighlightedColor: {r: 0.84313726, g: 0.84313726, b: 0.84313726, a: 1}
+    m_PressedColor: {r: 0, g: 0, b: 0, a: 1}
+    m_SelectedColor: {r: 0.84313726, g: 0.84313726, b: 0.84313726, a: 1}
+    m_DisabledColor: {r: 1, g: 1, b: 1, a: 0.39215687}
+    m_ColorMultiplier: 1
+    m_FadeDuration: 0.1
+  m_SpriteState:
+    m_HighlightedSprite: {fileID: 0}
+    m_PressedSprite: {fileID: 0}
+    m_SelectedSprite: {fileID: 0}
+    m_DisabledSprite: {fileID: 0}
+  m_AnimationTriggers:
+    m_NormalTrigger: Normal
+    m_HighlightedTrigger: Highlighted
+    m_PressedTrigger: Pressed
+    m_SelectedTrigger: Highlighted
+    m_DisabledTrigger: Disabled
+  m_Interactable: 1
+  m_TargetGraphic: {fileID: 2151248441631091217}
+  m_OnClick:
+    m_PersistentCalls:
+      m_Calls:
+      - m_Target: {fileID: 7332722509251528870}
+        m_TargetAssemblyTypeName: AvailableGameItem, Assembly-CSharp
+        m_MethodName: DropClicked
+        m_Mode: 1
+        m_Arguments:
+          m_ObjectArgument: {fileID: 0}
+          m_ObjectArgumentAssemblyTypeName: UnityEngine.Object, UnityEngine
+          m_IntArgument: 0
+          m_FloatArgument: 0
+          m_StringArgument: 
+          m_BoolArgument: 0
+        m_CallState: 2
+--- !u!114 &2151248441631091217
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7934454793097069971}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: fe87c0e1cc204ed48ad3b37840f39efc, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: 
+  m_Material: {fileID: 0}
+  m_Color: {r: 1, g: 1, b: 1, a: 1}
+  m_RaycastTarget: 1
+  m_RaycastPadding: {x: 0, y: 0, z: 0, w: 0}
+  m_Maskable: 1
+  m_OnCullStateChanged:
+    m_PersistentCalls:
+      m_Calls: []
+  m_Sprite: {fileID: 21300000, guid: f03f625cc7127f244a2f4da835b92720, type: 3}
+  m_Type: 1
+  m_PreserveAspect: 0
+  m_FillCenter: 1
+  m_FillMethod: 4
+  m_FillAmount: 1
+  m_FillClockwise: 1
+  m_FillOrigin: 0
+  m_UseSpriteMesh: 0
+  m_PixelsPerUnitMultiplier: 1
+--- !u!114 &7406323257372084547
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7934454793097069971}
   m_Enabled: 1
   m_EditorHideFlags: 0
   m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
   m_Name: 
   m_EditorClassIdentifier: 
   m_IgnoreLayout: 0
-  m_MinWidth: 700
+  m_MinWidth: 50
   m_MinHeight: -1
-  m_PreferredWidth: 700
+  m_PreferredWidth: 50
   m_PreferredHeight: -1
-  m_FlexibleWidth: 1
+  m_FlexibleWidth: -1
   m_FlexibleHeight: -1
   m_LayoutPriority: 1
+--- !u!1 &8839297347726735035
+GameObject:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  serializedVersion: 6
+  m_Component:
+  - component: {fileID: 1846732971937087380}
+  - component: {fileID: 2464975641276684442}
+  - component: {fileID: 4051352560264867900}
+  m_Layer: 5
+  m_Name: Icon
+  m_TagString: Untagged
+  m_Icon: {fileID: 0}
+  m_NavMeshLayer: 0
+  m_StaticEditorFlags: 0
+  m_IsActive: 1
+--- !u!224 &1846732971937087380
+RectTransform:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 8839297347726735035}
+  m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
+  m_LocalPosition: {x: 0, y: 0, z: 0}
+  m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
+  m_Children: []
+  m_Father: {fileID: 6700597635350808166}
+  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
+  m_AnchorMin: {x: 0, y: 0}
+  m_AnchorMax: {x: 1, y: 1}
+  m_AnchoredPosition: {x: 0, y: 0}
+  m_SizeDelta: {x: 0, y: 0}
+  m_Pivot: {x: 0.5, y: 0.5}
+--- !u!222 &2464975641276684442
+CanvasRenderer:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 8839297347726735035}
+  m_CullTransparentMesh: 1
+--- !u!114 &4051352560264867900
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 8839297347726735035}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 1344c3c82d62a2a41a3576d8abb8e3ea, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: UnityEngine.UI::UnityEngine.UI.RawImage
+  m_Material: {fileID: 0}
+  m_Color: {r: 0, g: 0, b: 0, a: 1}
+  m_RaycastTarget: 1
+  m_RaycastPadding: {x: 0, y: 0, z: 0, w: 0}
+  m_Maskable: 1
+  m_OnCullStateChanged:
+    m_PersistentCalls:
+      m_Calls: []
+  m_Texture: {fileID: 2800000, guid: 8c998213d53883d4b8fdf7a3eb3c2909, type: 3}
+  m_UVRect:
+    serializedVersion: 2
+    x: 0
+    y: 0
+    width: 1
+    height: 1
 --- !u!1001 &3324269289066796519
 PrefabInstance:
   m_ObjectHideFlags: 0
   serializedVersion: 2
   m_Modification:
+    serializedVersion: 3
     m_TransformParent: {fileID: 616210323856016607}
     m_Modifications:
     - target: {fileID: 6176764421848850767, guid: 59599ef87ad824f52ada88f126d58c5f,
@@ -833,6 +1109,11 @@ PrefabInstance:
       propertyPath: m_fontSizeBase
       value: 24
       objectReference: {fileID: 0}
+    - target: {fileID: 6176764421848850767, guid: 59599ef87ad824f52ada88f126d58c5f,
+        type: 3}
+      propertyPath: 'm_ActiveFontFeatures.Array.data[0]'
+      value: 1801810542
+      objectReference: {fileID: 0}
     - target: {fileID: 6176764421927073094, guid: 59599ef87ad824f52ada88f126d58c5f,
         type: 3}
       propertyPath: m_fontSize
@@ -959,6 +1240,13 @@ PrefabInstance:
       value: 0
       objectReference: {fileID: 0}
     m_RemovedComponents: []
+    m_RemovedGameObjects: []
+    m_AddedGameObjects: []
+    m_AddedComponents:
+    - targetCorrespondingSourceObject: {fileID: 6176764422977772730, guid: 59599ef87ad824f52ada88f126d58c5f,
+        type: 3}
+      insertIndex: -1
+      addedObject: {fileID: 2580770409874757745}
   m_SourcePrefab: {fileID: 100100000, guid: 59599ef87ad824f52ada88f126d58c5f, type: 3}
 --- !u!114 &8906549728612534595 stripped
 MonoBehaviour:
@@ -984,3 +1272,23 @@ GameObject:
     type: 3}
   m_PrefabInstance: {fileID: 3324269289066796519}
   m_PrefabAsset: {fileID: 0}
+--- !u!114 &2580770409874757745
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 8906549728612534621}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: 
+  m_IgnoreLayout: 0
+  m_MinWidth: 700
+  m_MinHeight: -1
+  m_PreferredWidth: 700
+  m_PreferredHeight: -1
+  m_FlexibleWidth: 1
+  m_FlexibleHeight: -1
+  m_LayoutPriority: 1

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/AvailableGameItem.cs

@@ -16,8 +16,10 @@ public class AvailableGameItem : MonoBehaviour {
     public TextMeshProUGUI playerCountField;
     public Button joinButton;
     public TextMeshProUGUI buttonText;
+    public Button dropButton;
 
     public Action<long, string> JoinCallback;
+    public Action<long> DropCallback;
 
     private List<AvailableLeader> availableLeaders;
     private long gameId;
@@ -38,6 +40,8 @@ public class AvailableGameItem : MonoBehaviour {
 
     public void JoinClicked() { JoinCallback(gameId, SelectedLeaderTextId); }
 
+    public void DropClicked() { DropCallback?.Invoke(gameId); }
+
     public void
     SetAvailableNewGame(long gameId, string playersString, List<AvailableLeader> leaders) {
         availableLeaders = leaders;

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/ConnectionHandler.cs

@@ -7,15 +7,18 @@ using System.Net.Http.Headers;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
+using Auth;
 using common;
 using common.GUIUtils;
 using eagle;
 using Grpc.Core;
 using Grpc.Core.Interceptors;
 using Net.Eagle0.Eagle.Api;
+using Net.Eagle0.Eagle.Api.Auth;
 using TMPro;
 using UnityEngine;
 using UnityEngine.SceneManagement;
+using UnityEngine.UI;
 using Object = System.Object;
 
 public class AuthInterceptor : Interceptor {
@@ -77,11 +80,31 @@ public class AuthInterceptor : Interceptor {
 };
 
 public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
-    public TMP_InputField urlField;
+    public TMP_Dropdown environmentDropdown;
     public TMP_InputField nameField;
     public TMP_InputField passwordField;
     public TMP_Dropdown resolutionDropdown;
 
+    [Header("OAuth UI")]
+    public GameObject oauthPanel;
+    public Button discordLoginButton;
+    public Button googleLoginButton;
+    public TextMeshProUGUI oauthStatusText;
+
+    [Header("Display Name Setup")]
+    public GameObject displayNamePanel;
+    public TMP_InputField displayNameField;
+    public Button setDisplayNameButton;
+    public TextMeshProUGUI displayNameErrorText;
+
+    [Header("Legacy Auth (for testing)")]
+    public GameObject legacyAuthPanel;
+    public Button useLegacyAuthButton;
+    public TextMeshProUGUI useLegacyAuthButtonText;
+
+    [Header("Status Display")]
+    public TextMeshProUGUI connectionStatusText;
+
     public GameObject connectionPanel;
     public GameObject gameSelectionPanel;
     public GameObject customBattlePanel;
@@ -95,6 +118,8 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
     public GameObject waitingGamesListItemPrefab;
     public GameObject createGameListItemPrefab;
 
+    public DropGameConfirmationPanel dropGameConfirmationPanel;
+
     public Canvas connectionCanvas;
     public Canvas eagleCanvas;
     public Canvas shardokCanvas;
@@ -109,14 +134,42 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
     private bool listen = false;
     private CancellationTokenSource _cancellationTokenSource;
     private readonly Object pendingReplyLock = new Object();
+    private int _connectedEnvironmentIndex = -1;  // -1 means not connected
+    private bool _useOAuth = false;  // Default to legacy until server-side OAuth is ready
 
     public ClientPregeneratedText clientPregeneratedText;
 
-    const String DefaultUrl = "eagle0.net";
-    const String URLKey = "urlKey";
+    const String BaseDomain = "eagle0.net";
+    const String EnvironmentKey = "environmentKey";
     const String NameKey = "nameKey";
     const String PasswordKey = "passwordKey";
 
+    // Environment options: index 0 = prod., index 1 = qa., index 2 = (none)
+    private static readonly List<string> EnvironmentOptions = new() { "prod.", "qa.", "" };
+    private static readonly List<string> EnvironmentDisplayNames =
+            new() { "prod.", "qa.", "(none)" };
+
+    /// <summary>
+    /// Returns the connected environment name ("prod." or "qa.") or null if not connected.
+    /// </summary>
+    public string ConnectedEnvironmentName =>
+            _connectedEnvironmentIndex >= 0 &&
+                            _connectedEnvironmentIndex < EnvironmentDisplayNames.Count
+                    ? EnvironmentDisplayNames[_connectedEnvironmentIndex]
+                    : null;
+
+    private string GetUrlFromEnvironment() {
+        int envIndex = environmentDropdown.value;
+        string prefix = EnvironmentOptions[envIndex];
+        return prefix + BaseDomain;
+    }
+
+    /// <summary>
+    /// Get full URL with scheme for the selected environment.
+    /// Remote servers use HTTPS, could be extended for local HTTP.
+    /// </summary>
+    private string GetFullUrlFromEnvironment() { return "https://" + GetUrlFromEnvironment(); }
+
     public void ReceiveLobbyUpdate(LobbyResponse lobbyResponse) {
         _handleLobbyResponse(lobbyResponse);
     }
@@ -133,7 +186,11 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         resolutionDropdown.AddOptions(resolutions.Select(r => $"{r.width} x {r.height}").ToList());
         resolutionDropdown.value = resolutions.ToList().IndexOf(currentResolution);
 
-        urlField.text = PlayerPrefs.GetString(URLKey, DefaultUrl);
+        // Set up environment dropdown
+        environmentDropdown.ClearOptions();
+        environmentDropdown.AddOptions(EnvironmentDisplayNames);
+        environmentDropdown.value = PlayerPrefs.GetInt(EnvironmentKey, 0);
+
         nameField.text = PlayerPrefs.GetString(NameKey, "sample_name");
         passwordField.text = PlayerPrefs.GetString(PasswordKey, "sample_password");
 
@@ -147,6 +204,234 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         customBattlePanel.gameObject.SetActive(false);
 
         errorHandler.gameObject.SetActive(true);
+
+        // Initialize OAuth UI
+        SetupOAuthUI();
+
+        // Initialize status text
+        UpdateConnectionStatus();
+
+        // Try to restore existing OAuth session
+        TryRestoreSession();
+    }
+
+    private void SetupOAuthUI() {
+        // Set up OAuth button click handlers
+        if (discordLoginButton != null) {
+            discordLoginButton.onClick.AddListener(
+                    () => OnOAuthLoginClicked(OAuthProvider.Discord));
+        }
+        if (googleLoginButton != null) {
+            googleLoginButton.onClick.AddListener(() => OnOAuthLoginClicked(OAuthProvider.Google));
+        }
+        if (setDisplayNameButton != null) {
+            setDisplayNameButton.onClick.AddListener(OnSetDisplayNameClicked);
+        }
+        if (useLegacyAuthButton != null) {
+            useLegacyAuthButton.onClick.AddListener(OnUseLegacyAuthClicked);
+        }
+
+        // Subscribe to OAuthManager events
+        if (OAuthManager.Instance != null) {
+            OAuthManager.Instance.OnLoginSuccess += OnOAuthLoginSuccess;
+            OAuthManager.Instance.OnLoginFailed += OnOAuthLoginFailed;
+            OAuthManager.Instance.OnNewUserNeedsDisplayName += OnNewUserNeedsDisplayName;
+            OAuthManager.Instance.OnLogout += OnOAuthLogout;
+        }
+
+        // Show appropriate panel based on auth state
+        ShowAuthPanel();
+    }
+
+    private void ShowAuthPanel() {
+        // Hide all auth panels first
+        if (oauthPanel != null) oauthPanel.SetActive(false);
+        if (displayNamePanel != null) displayNamePanel.SetActive(false);
+        if (legacyAuthPanel != null) legacyAuthPanel.SetActive(false);
+
+        // Show appropriate panel based on _useOAuth
+        if (_useOAuth) {
+            if (oauthPanel != null) oauthPanel.SetActive(true);
+            if (useLegacyAuthButtonText != null)
+                useLegacyAuthButtonText.text = "Use Classic Sign-in";
+        } else {
+            if (legacyAuthPanel != null) legacyAuthPanel.SetActive(true);
+            if (useLegacyAuthButtonText != null) useLegacyAuthButtonText.text = "Use OAuth Sign-in";
+        }
+    }
+
+    private async void TryRestoreSession() {
+        if (OAuthManager.Instance == null) return;
+
+        // Configure OAuthManager with current environment URL
+        OAuthManager.Instance.SetServerUrl(GetFullUrlFromEnvironment());
+
+        if (oauthStatusText != null) { oauthStatusText.text = "Checking for existing session..."; }
+
+        var restored = await OAuthManager.Instance.TryRestoreSessionAsync();
+        if (restored) {
+            // Session restored, connect to lobby
+            ConnectWithOAuth();
+        } else if (oauthStatusText != null) {
+            oauthStatusText.text = "";
+        }
+    }
+
+    private async void OnOAuthLoginClicked(OAuthProvider provider) {
+        // Configure OAuthManager with current environment URL (user may have changed dropdown)
+        OAuthManager.Instance.SetServerUrl(GetFullUrlFromEnvironment());
+
+        if (oauthStatusText != null) {
+            oauthStatusText.text = $"Opening browser for {provider} login...";
+        }
+
+        try {
+            await OAuthManager.Instance.LoginAsync(provider);
+            // OnLoginSuccess or OnNewUserNeedsDisplayName will be called
+        } catch (Exception ex) {
+            Debug.LogError($"OAuth login failed: {ex.Message}");
+            if (oauthStatusText != null) { oauthStatusText.text = $"Login failed: {ex.Message}"; }
+        }
+    }
+
+    private void OnOAuthLoginSuccess(UserInfo user) {
+        MainQueue.Q.Enqueue(() => {
+            if (oauthStatusText != null) { oauthStatusText.text = $"Welcome, {user.DisplayName}!"; }
+            ConnectWithOAuth();
+        });
+    }
+
+    private void OnOAuthLoginFailed(string error) {
+        MainQueue.Q.Enqueue(() => {
+            if (oauthStatusText != null) { oauthStatusText.text = $"Login failed: {error}"; }
+        });
+    }
+
+    private void OnNewUserNeedsDisplayName(bool isNewUser) {
+        MainQueue.Q.Enqueue(() => {
+            // Show display name panel
+            if (oauthPanel != null) oauthPanel.SetActive(false);
+            if (displayNamePanel != null) displayNamePanel.SetActive(true);
+            if (displayNameErrorText != null) displayNameErrorText.text = "";
+        });
+    }
+
+    private async void OnSetDisplayNameClicked() {
+        if (displayNameField == null || OAuthManager.Instance == null) return;
+
+        var displayName = displayNameField.text.Trim();
+        if (string.IsNullOrEmpty(displayName)) {
+            if (displayNameErrorText != null) {
+                displayNameErrorText.text = "Please enter a display name";
+            }
+            return;
+        }
+
+        if (displayNameErrorText != null) { displayNameErrorText.text = "Setting display name..."; }
+
+        var success = await OAuthManager.Instance.SetDisplayNameAsync(displayName);
+        if (!success && displayNameErrorText != null) {
+            displayNameErrorText.text = "Name already taken or invalid. Try another.";
+        }
+        // OnLoginSuccess will be called if successful
+    }
+
+    private void OnOAuthLogout() {
+        MainQueue.Q.Enqueue(() => {
+            ShowAuthPanel();
+            if (oauthStatusText != null) { oauthStatusText.text = ""; }
+        });
+    }
+
+    private void OnUseLegacyAuthClicked() {
+        _useOAuth = !_useOAuth;  // Toggle instead of just setting false
+
+        if (_useOAuth) {
+            // Show OAuth panel
+            if (oauthPanel != null) oauthPanel.SetActive(true);
+            if (legacyAuthPanel != null) legacyAuthPanel.SetActive(false);
+            if (useLegacyAuthButtonText != null)
+                useLegacyAuthButtonText.text = "Use Classic Sign-in";
+        } else {
+            // Show legacy panel
+            if (oauthPanel != null) oauthPanel.SetActive(false);
+            if (legacyAuthPanel != null) legacyAuthPanel.SetActive(true);
+            if (useLegacyAuthButtonText != null) useLegacyAuthButtonText.text = "Use OAuth Sign-in";
+        }
+    }
+
+    private void ConnectWithOAuth() {
+        _useOAuth = true;
+        _internalConnectEagle();
+    }
+
+    private float _statusUpdateTimer = 0f;
+    private const float StatusUpdateInterval = 0.5f;
+
+    void Update() {
+        // Only update status periodically and when connection panel is visible
+        if (!connectionPanel.activeInHierarchy) return;
+
+        _statusUpdateTimer += Time.deltaTime;
+        if (_statusUpdateTimer >= StatusUpdateInterval) {
+            _statusUpdateTimer = 0f;
+            UpdateConnectionStatus();
+        }
+    }
+
+    private void UpdateConnectionStatus() {
+        if (connectionStatusText == null) return;
+
+        // No connection yet - show nothing
+        if (_persistentClientConnection == null) {
+            connectionStatusText.text = "";
+            return;
+        }
+
+        var circuitState = _persistentClientConnection.CircuitBreaker.CurrentState;
+        var connState = _persistentClientConnection.CurrentState;
+
+        // Circuit breaker takes precedence
+        if (circuitState == eagle.ConnectionCircuitBreaker.State.Open) {
+            var nextTest = _persistentClientConnection.CircuitBreaker.NextTestAttempt;
+            if (nextTest.HasValue) {
+                var timeUntilTest = nextTest.Value - DateTime.UtcNow;
+                if (timeUntilTest.TotalSeconds > 0) {
+                    int seconds = Math.Min(10, (int)Math.Ceiling(timeUntilTest.TotalSeconds));
+                    connectionStatusText.text =
+                            $"<color=red>●</color> Server unavailable. Retry in {seconds}s";
+                    return;
+                }
+            }
+            connectionStatusText.text = "<color=red>●</color> Server unavailable";
+            return;
+        }
+
+        if (circuitState == eagle.ConnectionCircuitBreaker.State.HalfOpen) {
+            connectionStatusText.text = "<color=yellow>●</color> Testing connection...";
+            return;
+        }
+
+        // Normal connection states
+        connectionStatusText.text = connState switch {
+            eagle.ConnectionState.Connected => "<color=green>●</color> Connected",
+            eagle.ConnectionState.Connecting => "<color=yellow>●</color> Connecting...",
+            eagle.ConnectionState.Disconnected => "<color=red>●</color> Disconnected",
+            eagle.ConnectionState.Reconnecting => GetReconnectingText(),
+            eagle.ConnectionState.SubscriptionPending => "<color=yellow>●</color> Subscribing...",
+            _ => ""
+        };
+    }
+
+    private string GetReconnectingText() {
+        var nextAttempt = _persistentClientConnection?.NextReconnectAttempt;
+        if (!nextAttempt.HasValue) return "<color=yellow>●</color> Reconnecting...";
+
+        var timeUntilRetry = nextAttempt.Value - DateTime.UtcNow;
+        if (timeUntilRetry.TotalSeconds <= 0) { return "<color=yellow>●</color> Reconnecting..."; }
+
+        int seconds = Math.Min(10, (int)Math.Ceiling(timeUntilRetry.TotalSeconds));
+        return $"<color=orange>●</color> Retry in {seconds}s";
     }
 
     public void EditorButtonClicked() { SceneManager.LoadScene("Map Editor"); }
@@ -172,6 +457,8 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         _persistentClientConnection = null;
         eagleConnection?.Dispose();
         eagleConnection = null;
+
+        _connectedEnvironmentIndex = -1;
     }
 
     public void OnResolutionChanged(int dropdownIndex) {
@@ -207,10 +494,10 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
                         runningGamesListArea.transform,
                         true);
                 listItem.transform.localScale = new Vector3 { x = 1.0f, y = 1.0f, z = 1.0f };
-                listItem.GetComponent<RunningGameItem>().SetRunningGame(
-                        runningGame.GameId,
-                        runningGame.Leader);
-                listItem.GetComponent<RunningGameItem>().GoCallback = this.SelectEagleGame;
+                var runningGameItem = listItem.GetComponent<RunningGameItem>();
+                runningGameItem.SetRunningGame(runningGame.GameId, runningGame.Leader);
+                runningGameItem.GoCallback = this.SelectEagleGame;
+                runningGameItem.DropCallback = this.DropGame;
             }
 
             // Set up available/waiting games table
@@ -246,14 +533,16 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
                         availableGamesListArea.transform,
                         true);
                 listItem.transform.localScale = new Vector3 { x = 1.0f, y = 1.0f, z = 1.0f };
-                listItem.GetComponent<AvailableGameItem>().SetAvailableNewGame(
+                var availableGameItem = listItem.GetComponent<AvailableGameItem>();
+                availableGameItem.SetAvailableNewGame(
                         availableGame.GameId,
                         string.Format(
                                 "{0} / {1}",
                                 availableGame.CurrentHumanPlayerCount,
                                 availableGame.MaxHumanPlayerCount),
                         availableGame.AvailableLeaders.ToList());
-                listItem.GetComponent<AvailableGameItem>().JoinCallback = this.JoinGame;
+                availableGameItem.JoinCallback = this.JoinGame;
+                availableGameItem.DropCallback = this.DropGame;
             }
         });
     }
@@ -267,7 +556,8 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
     }
 
     private void _createConnection() {
-        PlayerPrefs.SetString(URLKey, urlField.text);
+        _connectedEnvironmentIndex = environmentDropdown.value;
+        PlayerPrefs.SetInt(EnvironmentKey, _connectedEnvironmentIndex);
         PlayerPrefs.SetString(NameKey, nameField.text);
         PlayerPrefs.SetString(PasswordKey, passwordField.text);
 
@@ -280,7 +570,27 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         // Initialize cancellation token for thread management
         _cancellationTokenSource = new CancellationTokenSource();
 
-        eagleConnection = new EagleConnection(nameField.text, passwordField.text, urlField.text);
+        string url = GetUrlFromEnvironment();
+
+        if (_useOAuth && TokenStorage.HasValidToken) {
+            // Use JWT-based connection
+            eagleConnection = EagleConnection.CreateWithJwt(url);
+
+            _httpClient = new HttpClient();
+            _httpClient.DefaultRequestHeaders.Authorization =
+                    new AuthenticationHeaderValue("Bearer", TokenStorage.AccessToken);
+        } else {
+            // Legacy Basic Auth connection
+            PlayerPrefs.SetString(NameKey, nameField.text);
+            PlayerPrefs.SetString(PasswordKey, passwordField.text);
+
+            eagleConnection = new EagleConnection(nameField.text, passwordField.text, url);
+
+            _httpClient = new HttpClient();
+            _httpClient.DefaultRequestHeaders.Authorization =
+                    new AuthenticationHeaderValue("Basic", eagleConnection.authHeader);
+        }
+
         _persistentClientConnection = new PersistentClientConnection(
                 eagleConnection.EagleGrpcClient,
                 eagleConnection.credentials,
@@ -288,10 +598,6 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         _persistentClientConnection.Connect();
 
         errorHandler.PersistentClientConnection = _persistentClientConnection;
-
-        _httpClient = new HttpClient();
-        _httpClient.DefaultRequestHeaders.Authorization =
-                new AuthenticationHeaderValue("Basic", eagleConnection.authHeader);
         ResourceFetcher.SetUpConnection(_httpClient);
     }
 
@@ -349,6 +655,18 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         var game = _internalJoinEagleGame(gameId, leaderName);
     }
 
+    private void DropGame(long gameId) {
+        if (dropGameConfirmationPanel != null) {
+            dropGameConfirmationPanel.OnConfirm = ConfirmDropGame;
+            dropGameConfirmationPanel.Show(gameId, "Are you sure you want to leave this game?");
+        } else {
+            // Fallback if no confirmation panel is configured
+            ConfirmDropGame(gameId);
+        }
+    }
+
+    private void ConfirmDropGame(long gameId) { _internalDropGame(gameId); }
+
     private void CreateGame(string leaderNameTextId, int humanPlayerCount, int totalPlayerCount) {
         var game = _internalCreateGame(leaderNameTextId, humanPlayerCount, totalPlayerCount);
     }
@@ -425,6 +743,18 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
         }
     }
 
+    private async Task<bool> _internalDropGame(long gameId) {
+        try {
+            return await _persistentClientConnection.SendUpdateStreamRequestAsync(
+                    new UpdateStreamRequest {
+                        DropGameRequest = new DropGameRequest { GameId = gameId }
+                    });
+        } catch (WebException e) {
+            Debug.Log(String.Format("Caught exception in DropGame {0}", e.Message));
+            return false;
+        }
+    }
+
     private void SetLobbyActive(bool active) {
         runningGamesListArea.SetActive(active);
         availableGamesListArea.SetActive(active);
@@ -442,7 +772,8 @@ public class ConnectionHandler : MonoBehaviour, ILobbySubscriber, IDisposable {
             eagleCanvas.GetComponent<EagleGameController>().SetUpGame(
                     gameInfo.GameId,
                     gameInfo.FactionId,
-                    _persistentClientConnection);
+                    _persistentClientConnection,
+                    ConnectedEnvironmentName);
             connectionCanvas.enabled = false;
             connectionCanvas.gameObject.SetActive(false);
             eagleCanvas.gameObject.SetActive(true);

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/DropGameConfirmationPanel.cs

@@ -0,0 +1,24 @@
+using System;
+using TMPro;
+using UnityEngine;
+
+public class DropGameConfirmationPanel : MonoBehaviour {
+    public TextMeshProUGUI messageText;
+
+    public Action<long> OnConfirm;
+
+    private long _pendingGameId;
+
+    public void Show(long gameId, string message) {
+        _pendingGameId = gameId;
+        if (messageText != null) { messageText.text = message; }
+        gameObject.SetActive(true);
+    }
+
+    public void ConfirmClicked() {
+        gameObject.SetActive(false);
+        OnConfirm?.Invoke(_pendingGameId);
+    }
+
+    public void CancelClicked() { gameObject.SetActive(false); }
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/DropGameConfirmationPanel.cs.meta

@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 558d4c7321daa4fe18dc4759a130d919

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/Running Game prefab.prefab

@@ -29,9 +29,9 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 909271087739711220}
-  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -105,20 +105,23 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
+  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_enableWordWrapping: 1
+  m_TextWrappingMode: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
+  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
+  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -185,9 +188,9 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 909271087739711220}
-  m_RootOrder: 1
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -261,20 +264,23 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
+  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_enableWordWrapping: 1
+  m_TextWrappingMode: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
+  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
+  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -312,6 +318,216 @@ MonoBehaviour:
   m_FlexibleWidth: 1
   m_FlexibleHeight: -1
   m_LayoutPriority: 1
+--- !u!1 &4189605341159952945
+GameObject:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  serializedVersion: 6
+  m_Component:
+  - component: {fileID: 7336928442537586311}
+  - component: {fileID: 3344684898730655831}
+  m_Layer: 5
+  m_Name: spacer
+  m_TagString: Untagged
+  m_Icon: {fileID: 0}
+  m_NavMeshLayer: 0
+  m_StaticEditorFlags: 0
+  m_IsActive: 1
+--- !u!224 &7336928442537586311
+RectTransform:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 4189605341159952945}
+  m_LocalRotation: {x: -0, y: -0, z: -0, w: 1}
+  m_LocalPosition: {x: 0, y: 0, z: 0}
+  m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
+  m_Children: []
+  m_Father: {fileID: 909271087739711220}
+  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
+  m_AnchorMin: {x: 0, y: 0}
+  m_AnchorMax: {x: 0, y: 0}
+  m_AnchoredPosition: {x: 0, y: 0}
+  m_SizeDelta: {x: 0, y: 0}
+  m_Pivot: {x: 0.5, y: 0.5}
+--- !u!114 &3344684898730655831
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 4189605341159952945}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: UnityEngine.UI::UnityEngine.UI.LayoutElement
+  m_IgnoreLayout: 0
+  m_MinWidth: 10
+  m_MinHeight: -1
+  m_PreferredWidth: 10
+  m_PreferredHeight: -1
+  m_FlexibleWidth: -1
+  m_FlexibleHeight: -1
+  m_LayoutPriority: 1
+--- !u!1 &4678275134637000934
+GameObject:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  serializedVersion: 6
+  m_Component:
+  - component: {fileID: 1348356180262758599}
+  - component: {fileID: 8617884038396701234}
+  - component: {fileID: 4081637582368108930}
+  - component: {fileID: 5167949463556339992}
+  - component: {fileID: 7482580409419131173}
+  m_Layer: 5
+  m_Name: Drop Game Button
+  m_TagString: Untagged
+  m_Icon: {fileID: 0}
+  m_NavMeshLayer: 0
+  m_StaticEditorFlags: 0
+  m_IsActive: 1
+--- !u!224 &1348356180262758599
+RectTransform:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 4678275134637000934}
+  m_LocalRotation: {x: -0, y: -0, z: -0, w: 1}
+  m_LocalPosition: {x: 0, y: 0, z: 0}
+  m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
+  m_Children:
+  - {fileID: 6454652926630703861}
+  m_Father: {fileID: 909271087739711220}
+  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
+  m_AnchorMin: {x: 0, y: 0}
+  m_AnchorMax: {x: 0, y: 0}
+  m_AnchoredPosition: {x: 0, y: 0}
+  m_SizeDelta: {x: 0, y: 0}
+  m_Pivot: {x: 0.5, y: 0.5}
+--- !u!222 &8617884038396701234
+CanvasRenderer:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 4678275134637000934}
+  m_CullTransparentMesh: 0
+--- !u!114 &4081637582368108930
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 4678275134637000934}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 4e29b1a8efbd4b44bb3f3716e73f07ff, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: 
+  m_Navigation:
+    m_Mode: 0
+    m_WrapAround: 0
+    m_SelectOnUp: {fileID: 0}
+    m_SelectOnDown: {fileID: 0}
+    m_SelectOnLeft: {fileID: 0}
+    m_SelectOnRight: {fileID: 0}
+  m_Transition: 1
+  m_Colors:
+    m_NormalColor: {r: 1, g: 0.42745098, b: 0.42745098, a: 1}
+    m_HighlightedColor: {r: 0.84313726, g: 0.84313726, b: 0.84313726, a: 1}
+    m_PressedColor: {r: 0, g: 0, b: 0, a: 1}
+    m_SelectedColor: {r: 0.84313726, g: 0.84313726, b: 0.84313726, a: 1}
+    m_DisabledColor: {r: 1, g: 1, b: 1, a: 0.39215687}
+    m_ColorMultiplier: 1
+    m_FadeDuration: 0.1
+  m_SpriteState:
+    m_HighlightedSprite: {fileID: 0}
+    m_PressedSprite: {fileID: 0}
+    m_SelectedSprite: {fileID: 0}
+    m_DisabledSprite: {fileID: 0}
+  m_AnimationTriggers:
+    m_NormalTrigger: Normal
+    m_HighlightedTrigger: Highlighted
+    m_PressedTrigger: Pressed
+    m_SelectedTrigger: Highlighted
+    m_DisabledTrigger: Disabled
+  m_Interactable: 1
+  m_TargetGraphic: {fileID: 5167949463556339992}
+  m_OnClick:
+    m_PersistentCalls:
+      m_Calls:
+      - m_Target: {fileID: 7788402836057688155}
+        m_TargetAssemblyTypeName: RunningGameItem, Assembly-CSharp
+        m_MethodName: DropClicked
+        m_Mode: 1
+        m_Arguments:
+          m_ObjectArgument: {fileID: 0}
+          m_ObjectArgumentAssemblyTypeName: UnityEngine.Object, UnityEngine
+          m_IntArgument: 0
+          m_FloatArgument: 0
+          m_StringArgument: 
+          m_BoolArgument: 0
+        m_CallState: 2
+--- !u!114 &5167949463556339992
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 4678275134637000934}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: fe87c0e1cc204ed48ad3b37840f39efc, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: 
+  m_Material: {fileID: 0}
+  m_Color: {r: 1, g: 1, b: 1, a: 1}
+  m_RaycastTarget: 1
+  m_RaycastPadding: {x: 0, y: 0, z: 0, w: 0}
+  m_Maskable: 1
+  m_OnCullStateChanged:
+    m_PersistentCalls:
+      m_Calls: []
+  m_Sprite: {fileID: 21300000, guid: f03f625cc7127f244a2f4da835b92720, type: 3}
+  m_Type: 1
+  m_PreserveAspect: 0
+  m_FillCenter: 1
+  m_FillMethod: 4
+  m_FillAmount: 1
+  m_FillClockwise: 1
+  m_FillOrigin: 0
+  m_UseSpriteMesh: 0
+  m_PixelsPerUnitMultiplier: 1
+--- !u!114 &7482580409419131173
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 4678275134637000934}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 306cc8c2b49d7114eaa3623786fc2126, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: 
+  m_IgnoreLayout: 0
+  m_MinWidth: 0
+  m_MinHeight: -1
+  m_PreferredWidth: 50
+  m_PreferredHeight: -1
+  m_FlexibleWidth: -1
+  m_FlexibleHeight: -1
+  m_LayoutPriority: 1
 --- !u!1 &4703848583262435150
 GameObject:
   m_ObjectHideFlags: 0
@@ -340,9 +556,9 @@ RectTransform:
   m_LocalRotation: {x: -0, y: -0, z: -0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children: []
   m_Father: {fileID: 7341333336313446738}
-  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 1, y: 1}
@@ -416,20 +632,23 @@ MonoBehaviour:
   m_VerticalAlignment: 512
   m_textAlignment: 65535
   m_characterSpacing: 0
+  m_characterHorizontalScale: 1
   m_wordSpacing: 0
   m_lineSpacing: 0
   m_lineSpacingMax: 0
   m_paragraphSpacing: 0
   m_charWidthMaxAdj: 0
-  m_enableWordWrapping: 1
+  m_TextWrappingMode: 1
   m_wordWrappingRatios: 0.4
   m_overflowMode: 0
   m_linkedTextComponent: {fileID: 0}
   parentLinkedComponent: {fileID: 0}
   m_enableKerning: 1
+  m_ActiveFontFeatures: 6e72656b
   m_enableExtraPadding: 0
   checkPaddingRequired: 0
   m_isRichText: 1
+  m_EmojiFallbackSupport: 1
   m_parseCtrlCharacters: 1
   m_isOrthographic: 1
   m_isCullingEnabled: 0
@@ -479,10 +698,10 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children:
   - {fileID: 2089905691925287270}
   m_Father: {fileID: 909271087739711220}
-  m_RootOrder: 2
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 0, y: 0}
@@ -560,6 +779,7 @@ MonoBehaviour:
     atime6: 0
     atime7: 0
     m_Mode: 0
+    m_ColorSpace: -1
     m_NumColorKeys: 2
     m_NumAlphaKeys: 2
   _gradientType: 0
@@ -702,12 +922,14 @@ RectTransform:
   m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
   m_LocalPosition: {x: 0, y: 0, z: 0}
   m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
   m_Children:
   - {fileID: 2008335870574158510}
   - {fileID: 6674238761151365000}
+  - {fileID: 1348356180262758599}
+  - {fileID: 7336928442537586311}
   - {fileID: 7341333336313446738}
   m_Father: {fileID: 0}
-  m_RootOrder: 0
   m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
   m_AnchorMin: {x: 0, y: 0}
   m_AnchorMax: {x: 1, y: 1}
@@ -793,7 +1015,8 @@ MonoBehaviour:
   item: {fileID: 5643565463360785033}
   gameIdField: {fileID: 8058295588038032232}
   leaderField: {fileID: 3311450659768657245}
-  goButton: {fileID: 0}
+  goButton: {fileID: 145214844678457394}
+  dropButton: {fileID: 4081637582368108930}
 --- !u!114 &2208043217657811503
 MonoBehaviour:
   m_ObjectHideFlags: 0
@@ -814,3 +1037,75 @@ MonoBehaviour:
   m_FlexibleWidth: 1
   m_FlexibleHeight: 1
   m_LayoutPriority: 1
+--- !u!1 &7814378479006347708
+GameObject:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  serializedVersion: 6
+  m_Component:
+  - component: {fileID: 6454652926630703861}
+  - component: {fileID: 374667974001408770}
+  - component: {fileID: 5621315126805048060}
+  m_Layer: 5
+  m_Name: Icon
+  m_TagString: Untagged
+  m_Icon: {fileID: 0}
+  m_NavMeshLayer: 0
+  m_StaticEditorFlags: 0
+  m_IsActive: 1
+--- !u!224 &6454652926630703861
+RectTransform:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7814378479006347708}
+  m_LocalRotation: {x: 0, y: 0, z: 0, w: 1}
+  m_LocalPosition: {x: 0, y: 0, z: 0}
+  m_LocalScale: {x: 1, y: 1, z: 1}
+  m_ConstrainProportionsScale: 0
+  m_Children: []
+  m_Father: {fileID: 1348356180262758599}
+  m_LocalEulerAnglesHint: {x: 0, y: 0, z: 0}
+  m_AnchorMin: {x: 0, y: 0}
+  m_AnchorMax: {x: 1, y: 1}
+  m_AnchoredPosition: {x: 0, y: 0}
+  m_SizeDelta: {x: 0, y: 0}
+  m_Pivot: {x: 0.5, y: 0.5}
+--- !u!222 &374667974001408770
+CanvasRenderer:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7814378479006347708}
+  m_CullTransparentMesh: 1
+--- !u!114 &5621315126805048060
+MonoBehaviour:
+  m_ObjectHideFlags: 0
+  m_CorrespondingSourceObject: {fileID: 0}
+  m_PrefabInstance: {fileID: 0}
+  m_PrefabAsset: {fileID: 0}
+  m_GameObject: {fileID: 7814378479006347708}
+  m_Enabled: 1
+  m_EditorHideFlags: 0
+  m_Script: {fileID: 11500000, guid: 1344c3c82d62a2a41a3576d8abb8e3ea, type: 3}
+  m_Name: 
+  m_EditorClassIdentifier: UnityEngine.UI::UnityEngine.UI.RawImage
+  m_Material: {fileID: 0}
+  m_Color: {r: 0, g: 0, b: 0, a: 1}
+  m_RaycastTarget: 1
+  m_RaycastPadding: {x: 0, y: 0, z: 0, w: 0}
+  m_Maskable: 1
+  m_OnCullStateChanged:
+    m_PersistentCalls:
+      m_Calls: []
+  m_Texture: {fileID: 2800000, guid: 8c998213d53883d4b8fdf7a3eb3c2909, type: 3}
+  m_UVRect:
+    serializedVersion: 2
+    x: 0
+    y: 0
+    width: 1
+    height: 1

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionHandler/RunningGameItem.cs

@@ -10,8 +10,10 @@ public class RunningGameItem : MonoBehaviour {
     public TextMeshProUGUI gameIdField;
     public TextMeshProUGUI leaderField;
     public Button goButton;
+    public Button dropButton;
 
     public Action<long> GoCallback;
+    public Action<long> DropCallback;
 
     private long gameId;
 
@@ -20,6 +22,8 @@ public class RunningGameItem : MonoBehaviour {
 
     public void GoClicked() { GoCallback(gameId); }
 
+    public void DropClicked() { DropCallback?.Invoke(gameId); }
+
     public void SetRunningGame(long gameId, AvailableLeader leader) {
         this.gameId = gameId;
 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/ConnectionKiller.cs

@@ -1,6 +1,8 @@
 using System;
 using System.Threading;
+#if UNITY_EDITOR
 using UnityEditor;
+#endif
 using UnityEngine;
 
 public class ConnectionKiller : MonoBehaviour {
@@ -10,6 +12,10 @@ public class ConnectionKiller : MonoBehaviour {
     public void OnApplicationQuit() { ShutdownAll(); }
 
 #if UNITY_EDITOR
+    void OnEnable() { EditorApplication.playModeStateChanged += OnPlayModeStateChanged; }
+
+    void OnDisable() { EditorApplication.playModeStateChanged -= OnPlayModeStateChanged; }
+
     void OnPlayModeStateChanged(PlayModeStateChange state) {
         if (state == PlayModeStateChange.ExitingPlayMode) { ShutdownAll(); }
     }

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/CommandSelectors/ImproveCommandSelector.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using EagleGUIUtils;
@@ -6,6 +6,7 @@ using Net.Eagle0.Eagle.Api;
 using Net.Eagle0.Eagle.Common;
 using Net.Eagle0.Eagle.Views;
 using TMPro;
+using UnityEngine;
 using UnityEngine.UI;
 
 namespace eagle {
@@ -14,16 +15,44 @@ namespace eagle {
 
     public class ImproveCommandSelector : CommandSelector {
         public HeroDropdownController heroDropdownController;
-        public TMP_Dropdown typeDropdown;
         public Toggle lockToggle;
 
+        // Toggle buttons for each improvement type (assign to same ToggleGroup in Unity)
+        public Toggle economyToggle;
+        public Toggle agricultureToggle;
+        public Toggle infrastructureToggle;
+        public Toggle devastationToggle;
+        public ToggleGroup improvementToggleGroup;
+
+        // Labels showing type name and value
+        public TMP_Text economyLabel;
+        public TMP_Text agricultureLabel;
+        public TMP_Text infrastructureLabel;
+        public TMP_Text devastationLabel;
+
         List<HeroView> orderedHeroes;
 
-        private int SelectedTypeIndex => typeDropdown.value;
         private ImproveAvailableCommand ImproveAvailableCommand => _availableCommand.ImproveCommand;
         private ProvinceId ActingProvinceId => ImproveAvailableCommand.ActingProvinceId;
-        private ImprovementType SelectedType =>
-                ImproveAvailableCommand.AvailableTypes[SelectedTypeIndex];
+
+        private ImprovementType SelectedType {
+            get {
+                if (economyToggle != null && economyToggle.isOn && economyToggle.interactable)
+                    return ImprovementType.Economy;
+                if (agricultureToggle != null && agricultureToggle.isOn &&
+                    agricultureToggle.interactable)
+                    return ImprovementType.Agriculture;
+                if (infrastructureToggle != null && infrastructureToggle.isOn &&
+                    infrastructureToggle.interactable)
+                    return ImprovementType.Infrastructure;
+                if (devastationToggle != null && devastationToggle.isOn &&
+                    devastationToggle.interactable)
+                    return ImprovementType.Devastation;
+
+                // Fallback: return first available type
+                return ImproveAvailableCommand.AvailableTypes.FirstOrDefault();
+            }
+        }
 
         private float OriginalImprovementValueForType(ImprovementType type) {
             var province = _model.Provinces[ActingProvinceId];
@@ -57,60 +86,142 @@ namespace eagle {
             }
         }
 
-        private int MinimumImprovementIndex(ProvinceView province) {
-            var minIndex = 0;
-            float minValue =
-                    OriginalImprovementValueForType(ImproveAvailableCommand.AvailableTypes[0]);
+        private ImprovementType GetMinimumImprovementType() {
+            ImprovementType minType = ImproveAvailableCommand.AvailableTypes[0];
+            float minValue = OriginalImprovementValueForType(minType);
             for (int i = 1; i < ImproveAvailableCommand.AvailableTypes.Count; i++) {
-                float thisVal =
-                        OriginalImprovementValueForType(ImproveAvailableCommand.AvailableTypes[i]);
+                var thisType = ImproveAvailableCommand.AvailableTypes[i];
+                float thisVal = OriginalImprovementValueForType(thisType);
                 if (thisVal < minValue) {
-                    minIndex = i;
+                    minType = thisType;
                     minValue = thisVal;
                 }
             }
-            return minIndex;
+            return minType;
         }
 
-        private void ChooseDefaultImprovement(ProvinceView province) {
-            var devastationIndex =
-                    ImproveAvailableCommand.AvailableTypes.IndexOf(ImprovementType.Devastation);
-            if (devastationIndex == -1) {
-                typeDropdown.value = MinimumImprovementIndex(province);
+        private ImprovementType GetDefaultImprovementType() {
+            // Prefer devastation if available
+            if (ImproveAvailableCommand.AvailableTypes.Contains(ImprovementType.Devastation)) {
+                return ImprovementType.Devastation;
+            }
+
+            // Otherwise pick the lowest stat
+            return GetMinimumImprovementType();
+        }
+
+        private Toggle GetToggleForType(ImprovementType type) {
+            switch (type) {
+                case ImprovementType.Economy: return economyToggle;
+                case ImprovementType.Agriculture: return agricultureToggle;
+                case ImprovementType.Infrastructure: return infrastructureToggle;
+                case ImprovementType.Devastation: return devastationToggle;
+                default: return null;
+            }
+        }
+
+        private TMP_Text GetLabelForType(ImprovementType type) {
+            switch (type) {
+                case ImprovementType.Economy: return economyLabel;
+                case ImprovementType.Agriculture: return agricultureLabel;
+                case ImprovementType.Infrastructure: return infrastructureLabel;
+                case ImprovementType.Devastation: return devastationLabel;
+                default: return null;
+            }
+        }
+
+        private void SelectType(ImprovementType type) {
+            // Turn on the selected toggle - ToggleGroup handles turning off others
+            var toggle = GetToggleForType(type);
+            if (toggle != null && toggle.interactable) { toggle.isOn = true; }
+        }
+
+        private const float DisabledAlpha = 0.35f;
+
+        private void ConfigureToggle(ImprovementType type, bool available) {
+            var toggle = GetToggleForType(type);
+            var label = GetLabelForType(type);
+
+            if (toggle == null) return;
+
+            // Always show the toggle, but disable if not available
+            toggle.gameObject.SetActive(true);
+            toggle.interactable = available;
+
+            // Turn off unavailable toggles so they don't appear selected
+            if (!available) { toggle.isOn = false; }
+
+            // Only add to toggle group if available
+            toggle.group = available ? improvementToggleGroup : null;
+
+            // Gray out unavailable toggles using CanvasGroup
+            var canvasGroup = toggle.GetComponent<CanvasGroup>();
+            if (canvasGroup == null) {
+                canvasGroup = toggle.gameObject.AddComponent<CanvasGroup>();
+            }
+            canvasGroup.alpha = available ? 1f : DisabledAlpha;
+
+            // Always show label with current value
+            if (label != null) { label.text = LabelStringForType(type); }
+        }
+
+        private string LabelStringForType(ImprovementType type) {
+            var originalStat =
+                    type == ImprovementType.Devastation
+                            ? ProvinceStatUtils.RoundedDevastation(
+                                      OriginalImprovementValueForType(type))
+                            : ProvinceStatUtils.RoundedStat(OriginalImprovementValueForType(type));
+            if (type == ImprovementType.Devastation) {
+                return GUIUtils.ColoredString(Color.red, originalStat.ToString());
+            }
+            var devastatedStat =
+                    ProvinceStatUtils.RoundedStat(EffectiveImprovementValueForType(type));
+            if (devastatedStat == originalStat) {
+                return $"{devastatedStat}";
             } else {
-                typeDropdown.value = devastationIndex;
+                return $"{GUIUtils.ColoredString(Color.red, devastatedStat.ToString())} / {originalStat}";
             }
         }
 
         protected override void SetUpUI() {
-            var province = _model.Provinces[ImproveAvailableCommand.ActingProvinceId];
             var improveCommand = ImproveAvailableCommand;
 
-            typeDropdown.ClearOptions();
-
             orderedHeroes = ImproveAvailableCommand.AvailableHeroIds.Select(id => _model.Heroes[id])
                                     .ToList();
             heroDropdownController.AvailableHeroes = orderedHeroes;
-
             heroDropdownController.SelectedHeroId = improveCommand.RecommendedHeroId;
 
-            typeDropdown.AddOptions(
-                    improveCommand.AvailableTypes.Select(DropdownStringForType).ToList());
+            // Configure each toggle based on available types
+            ConfigureToggle(
+                    ImprovementType.Economy,
+                    improveCommand.AvailableTypes.Contains(ImprovementType.Economy));
+            ConfigureToggle(
+                    ImprovementType.Agriculture,
+                    improveCommand.AvailableTypes.Contains(ImprovementType.Agriculture));
+            ConfigureToggle(
+                    ImprovementType.Infrastructure,
+                    improveCommand.AvailableTypes.Contains(ImprovementType.Infrastructure));
+            ConfigureToggle(
+                    ImprovementType.Devastation,
+                    improveCommand.AvailableTypes.Contains(ImprovementType.Devastation));
 
+            // Determine which type to select
+            ImprovementType selectedType;
             if (improveCommand.LockedType != ImprovementType.None) {
                 var lockedType = improveCommand.LockedType;
-                var lockedTypeIndex = improveCommand.AvailableTypes.IndexOf(lockedType);
-                if (lockedTypeIndex > -1) {
-                    typeDropdown.value = lockedTypeIndex;
+                if (improveCommand.AvailableTypes.Contains(lockedType)) {
+                    selectedType = lockedType;
                     lockToggle.isOn = true;
                 } else {
-                    ChooseDefaultImprovement(province);
+                    selectedType = GetDefaultImprovementType();
                     lockToggle.isOn = false;
                 }
             } else {
-                ChooseDefaultImprovement(province);
+                selectedType = GetDefaultImprovementType();
                 lockToggle.isOn = false;
             }
+
+            SelectType(selectedType);
         }
 
         public override AvailableCommand.SealedValueOneofCase CommandType =>
@@ -137,23 +248,5 @@ namespace eagle {
                         LockType = lockToggle.isOn
                     }
         };
-
-        private string DropdownStringForType(ImprovementType type) {
-            var originalStat =
-                    type == ImprovementType.Devastation
-                            ? ProvinceStatUtils.RoundedDevastation(
-                                      OriginalImprovementValueForType(type))
-                            : ProvinceStatUtils.RoundedStat(OriginalImprovementValueForType(type));
-            if (type == ImprovementType.Devastation) {
-                return $"{type} ({GUIUtils.ColoredString(UnityEngine.Color.red, originalStat.ToString())})";
-            }
-            var devastatedStat =
-                    ProvinceStatUtils.RoundedStat(EffectiveImprovementValueForType(type));
-            if (devastatedStat == originalStat) {
-                return $"{type} ({devastatedStat})";
-            } else {
-                return $"{type} ({GUIUtils.ColoredString(UnityEngine.Color.red, devastatedStat.ToString())} / {originalStat})";
-            }
-        }
     }
-}
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/ConnectionStatusUI.cs

@@ -26,6 +26,10 @@ namespace eagle {
         private TextMeshProUGUI _textComponent;
         private PersistentClientConnection _connection;
         private IGameStateProvider _gameStateProvider;
+        private string _environmentName;
+
+        [Tooltip("Optional text component to display connected environment (prod/qa)")]
+        public TextMeshProUGUI environmentIndicatorText;
 
         [Tooltip("Optional button to force immediate reconnection when server is down")]
         public Button retryButton;
@@ -64,6 +68,15 @@ namespace eagle {
             _gameStateProvider = provider;
         }
 
+        /// <summary>
+        /// Set the environment name to display (e.g., "prod." or "qa.").
+        /// Pass null to clear the indicator.
+        /// </summary>
+        public void SetEnvironment(string environmentName) {
+            _environmentName = environmentName;
+            UpdateEnvironmentIndicator();
+        }
+
         void Update() {
             if (_connection == null || _textComponent == null) { return; }
 
@@ -165,5 +178,20 @@ namespace eagle {
         private void OnRetryClicked() {
             if (_connection != null) { _connection.ForceReconnect(); }
         }
+
+        private void UpdateEnvironmentIndicator() {
+            if (environmentIndicatorText == null) return;
+
+            if (string.IsNullOrEmpty(_environmentName)) {
+                environmentIndicatorText.text = "";
+                return;
+            }
+
+            // Color prod green, qa yellow
+            environmentIndicatorText.text =
+                    _environmentName switch { "prod." => $"<color=green>{_environmentName}</color>",
+                                              "qa." => $"<color=yellow>{_environmentName}</color>",
+                                              _ => _environmentName };
+        }
     }
 }

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/Discord-Logo-Blurple.png.meta

@@ -0,0 +1,117 @@
+fileFormatVersion: 2
+guid: 1fb1f6deb68f9475281c9f7c427a7024
+TextureImporter:
+  internalIDToNameTable: []
+  externalObjects: {}
+  serializedVersion: 13
+  mipmaps:
+    mipMapMode: 0
+    enableMipMap: 1
+    sRGBTexture: 1
+    linearTexture: 0
+    fadeOut: 0
+    borderMipMap: 0
+    mipMapsPreserveCoverage: 0
+    alphaTestReferenceValue: 0.5
+    mipMapFadeDistanceStart: 1
+    mipMapFadeDistanceEnd: 3
+  bumpmap:
+    convertToNormalMap: 0
+    externalNormalMap: 0
+    heightScale: 0.25
+    normalMapFilter: 0
+    flipGreenChannel: 0
+  isReadable: 0
+  streamingMipmaps: 0
+  streamingMipmapsPriority: 0
+  vTOnly: 0
+  ignoreMipmapLimit: 0
+  grayScaleToAlpha: 0
+  generateCubemap: 6
+  cubemapConvolution: 0
+  seamlessCubemap: 0
+  textureFormat: 1
+  maxTextureSize: 2048
+  textureSettings:
+    serializedVersion: 2
+    filterMode: 1
+    aniso: 1
+    mipBias: 0
+    wrapU: 0
+    wrapV: 0
+    wrapW: 0
+  nPOTScale: 1
+  lightmap: 0
+  compressionQuality: 50
+  spriteMode: 0
+  spriteExtrude: 1
+  spriteMeshType: 1
+  alignment: 0
+  spritePivot: {x: 0.5, y: 0.5}
+  spritePixelsToUnits: 100
+  spriteBorder: {x: 0, y: 0, z: 0, w: 0}
+  spriteGenerateFallbackPhysicsShape: 1
+  alphaUsage: 1
+  alphaIsTransparency: 0
+  spriteTessellationDetail: -1
+  textureType: 0
+  textureShape: 1
+  singleChannelComponent: 0
+  flipbookRows: 1
+  flipbookColumns: 1
+  maxTextureSizeSet: 0
+  compressionQualitySet: 0
+  textureFormatSet: 0
+  ignorePngGamma: 0
+  applyGammaDecoding: 0
+  swizzle: 50462976
+  cookieLightType: 0
+  platformSettings:
+  - serializedVersion: 4
+    buildTarget: DefaultTexturePlatform
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  - serializedVersion: 4
+    buildTarget: Standalone
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  spriteSheet:
+    serializedVersion: 2
+    sprites: []
+    outline: []
+    customData: 
+    physicsShape: []
+    bones: []
+    spriteID: 
+    internalID: 0
+    vertices: []
+    indices: 
+    edges: []
+    weights: []
+    secondaryTextures: []
+    spriteCustomMetadata:
+      entries: []
+    nameFileIdTable: {}
+  mipmapLimitGroupName: 
+  pSDRemoveMatte: 0
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/EagleGameController.cs

@@ -243,7 +243,8 @@ namespace eagle {
         public void SetUpGame(
                 long gameId,
                 int? playerId,
-                PersistentClientConnection persistentClientConnection) {
+                PersistentClientConnection persistentClientConnection,
+                string environmentName = null) {
             ModelUpdater = new GameModelUpdater(
                     gameId,
                     playerId,
@@ -269,9 +270,12 @@ namespace eagle {
 
             ModelUpdater.ErrorHandler = errorHandler;
 
-            // Set up game state provider for connection status UI
+            // Set up game state provider and environment for connection status UI
             var statusUI = connectionStatusLabel.GetComponent<ConnectionStatusUI>();
-            if (statusUI != null) { statusUI.SetGameStateProvider(ModelUpdater); }
+            if (statusUI != null) {
+                statusUI.SetGameStateProvider(ModelUpdater);
+                statusUI.SetEnvironment(environmentName);
+            }
 
             // Fire-and-forget - subscription is awaited internally and failures are logged
             MainQueue.Q.EnqueueForNextUpdate(

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/EagleGameModel.cs

@@ -311,20 +311,36 @@ namespace eagle {
                     // Store server-reported game status for UI
                     if (updateItem.ActionResultResponse.ServerGameStatus != null) {
                         ServerStatus = updateItem.ActionResultResponse.ServerGameStatus;
+                        _connectionLogger.LogLine(
+                                $"[UPDATE] ServerGameStatus updated: {ServerStatus.Status}");
                     }
 
                     // Note: _lastUnfilteredResultCount is updated on the gRPC thread in
                     // UpdateResultCounts() before enqueueing. We don't update it here to avoid
                     // race conditions where a backlogged MainQueue update overwrites a newer count.
 
-                    if (updateItem.ActionResultResponse.ActionResultViews.Any() ||
-                        updateItem.ActionResultResponse.AvailableCommands == null ||
-                        updateItem.ActionResultResponse.AvailableCommands.Token !=
-                                _currentModel.CommandToken) {
+                    var hasResults = updateItem.ActionResultResponse.ActionResultViews.Any();
+                    var hasCommands = updateItem.ActionResultResponse.AvailableCommands != null;
+                    var incomingToken =
+                            hasCommands ? updateItem.ActionResultResponse.AvailableCommands.Token
+                                        : -1;
+                    var tokenMatches = hasCommands && incomingToken == _currentModel.CommandToken;
+
+                    _connectionLogger.LogLine(
+                            $"[UPDATE] hasResults={hasResults}, hasCommands={hasCommands}, " +
+                            $"incomingToken={incomingToken}, currentToken={_currentModel.CommandTokenString}, " +
+                            $"tokenMatches={tokenMatches}");
+
+                    if (hasResults || !hasCommands || !tokenMatches) {
                         HandleUpdates(updateItem.ActionResultResponse.ActionResultViews.ToList());
                         HandleAvailableCommands(updateItem.ActionResultResponse.AvailableCommands);
 
                         if (UpdateAction != null) UpdateAction.Invoke(_currentModel);
+                        _connectionLogger.LogLine(
+                                "[UPDATE] Processed update and invoked UpdateAction");
+                    } else {
+                        _connectionLogger.LogLine(
+                                "[UPDATE] SKIPPED - no results, has commands, token matches");
                     }
 
                     break;
@@ -332,6 +348,10 @@ namespace eagle {
                 case GameUpdate.GameUpdateDetailsOneofCase.ShardokActionResultResponse:
                     var specResponse = updateItem.ShardokActionResultResponse.ShardokGameResponses;
 
+                    // Collect ended games to remove AFTER the UI callback, so the UI
+                    // can see the final battle results before the models are removed.
+                    var endedGames = new List<ShardokGameId>();
+
                     foreach (var oneResponse in specResponse) {
                         if (!_currentModel.ShardokGameModels.TryGetValue(
                                     oneResponse.ShardokGameId,
@@ -372,14 +392,22 @@ namespace eagle {
                             _currentModel.ShardokGameModels[oneResponse.ShardokGameId] =
                                     shardokGameModel;
                         } else {
-                            // Game ended - remove from active models so UI knows battle is over
-                            _currentModel.ShardokGameModels.TryRemove(
-                                    oneResponse.ShardokGameId,
-                                    out _);
-                            _shardokResultCounts.TryRemove(oneResponse.ShardokGameId, out _);
+                            // Game ended - keep model for UI callback, mark for removal after
+                            _currentModel.ShardokGameModels[oneResponse.ShardokGameId] =
+                                    shardokGameModel;
+                            endedGames.Add(oneResponse.ShardokGameId);
                         }
                     }
+
+                    // Invoke UI callback BEFORE removing ended games, so the UI can
+                    // see the final battle results (with GameStatus = Victory/Defeat)
                     if (UpdateAction != null) UpdateAction.Invoke(_currentModel);
+
+                    // Now remove ended games from active models
+                    foreach (var endedGameId in endedGames) {
+                        _currentModel.ShardokGameModels.TryRemove(endedGameId, out _);
+                        _shardokResultCounts.TryRemove(endedGameId, out _);
+                    }
                     break;
 
                 case GameUpdate.GameUpdateDetailsOneofCase.StreamingTextResponse:
@@ -405,9 +433,14 @@ namespace eagle {
         public void UpdateResultCounts(GameUpdate update) {
             switch (update.GameUpdateDetailsCase) {
                 case GameUpdate.GameUpdateDetailsOneofCase.ActionResultResponse:
+                    var newCount = update.ActionResultResponse.UnfilteredResultCountAfter;
                     lock (_resultCountLock) {
-                        _lastUnfilteredResultCount =
-                                update.ActionResultResponse.UnfilteredResultCountAfter;
+                        var oldCount = _lastUnfilteredResultCount;
+                        _lastUnfilteredResultCount = newCount;
+                        if (newCount != oldCount) {
+                            _connectionLogger.LogLine(
+                                    $"[RESULT_COUNT] Updated count {oldCount} -> {newCount}");
+                        }
                     }
                     break;
 
@@ -481,13 +514,22 @@ namespace eagle {
             _connectionLogger.LogLine(
                     $"[STATE_RESYNC] timestamp={timestamp} round={startingState.CurrentRoundId} factions={startingState.Factions.Count} heroes={startingState.Heroes.Count}");
 
+            // Clear all stale state before applying new starting state.
+            // This handles rewind/reset scenarios where the server sends an earlier state.
+            _currentModel.ShardokGameModels.Clear();
+            _shardokResultCounts.Clear();
+            _shardokNeedsResync.Clear();
+            _currentModel.CommandToken = null;
+            _currentModel.LastPostedToken = -1;
+            _currentModel.AvailableCommandsByProvince.Clear();
+            _commandSubmittedTime = null;
+
             _currentModel.GsView = startingState;
             _currentModel.BattalionTypes =
                     startingState.BattalionTypes.ToDictionary(bt => bt.TypeId, bt => bt);
             _currentModel.ChronicleEntries = startingState.ChronicleEntries.ToList();
 
-            // For any outstanding battles not in ShardokGameModels, create models and mark for
-            // resync. This ensures fresh clients get Shardok state for ongoing battles.
+            // For any outstanding battles in the new state, create models and mark for resync.
             bool needsResubscribe = false;
             foreach (var battle in _currentModel.ShardokBattles) {
                 if (!_currentModel.ShardokGameModels.ContainsKey(battle.ShardokGameId)) {

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/Notifications/ARNNotifications/ARNNotificationDispatcher.cs

@@ -57,7 +57,8 @@ namespace eagle.Notifications {
             { BreakAllianceAcceptedDetails, BreakAllianceAcceptedNotificationGenerator.Generator },
             { VassalExiledDetails, VassalExiledDetailsNotificationGenerator.Generator },
             { WithdrewForTruce, WithdrewForTruceDetailsNotificationGenerator.Generator },
-            { ProfessionGainedDetails, ProfessionGainedDetailsNotificationGenerator.Generator }
+            { ProfessionGainedDetails, ProfessionGainedDetailsNotificationGenerator.Generator },
+            { NewFactionHeadDetails, NewFactionHeadDetailsNotificationGenerator.Generator }
         };
 
         public static IEnumerable<Notification> GenerateNotifications(

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/Notifications/ARNNotifications/NewFactionHeadDetailsNotificationGenerator.cs

@@ -0,0 +1,98 @@
+using System;
+using System.Collections.Generic;
+using Net.Eagle0.Eagle.Common;
+using Net.Eagle0.Eagle.Views;
+
+namespace eagle.Notifications.ARNNotifications {
+    using ProvinceId = Int32;
+    using HeroId = Int32;
+
+    public static class NewFactionHeadDetailsNotificationGenerator {
+        public static readonly ARNNotificationGenerator Generator = GenerateNotifications;
+
+        private static readonly Random Random = new();
+
+        private static readonly List<string> NotificationTitles = new() {
+            "New Leadership",
+            "Succession",
+            "A New Era",
+            "Rise to Power",
+            "The Mantle Passes",
+            "Heir Ascendant",
+            "Crown of Command",
+            "Leadership Transferred",
+            "The Torch Passes",
+            "New Commander"
+        };
+
+        private static string GetNotificationTitle() {
+            return NotificationTitles[Random.Next(NotificationTitles.Count)];
+        }
+
+        private static ProvinceId? FindProvinceForHero(HeroId heroId, IGameModel model) {
+            foreach (var province in model.Provinces.Values) {
+                if (province.FullInfo?.RulingFactionHeroIds.Contains(heroId) == true) {
+                    return province.Id;
+                }
+            }
+            return null;
+        }
+
+        private static IEnumerable<Notification> GenerateNotifications(
+                Net.Eagle0.Eagle.Common.Notification notification,
+                IGameModel currentModel) {
+            var details = notification.Details.NewFactionHeadDetails;
+            var newHeadHero = currentModel.Heroes[details.NewHeadHeroId];
+            var previousHeadHero =
+                    currentModel.Heroes.TryGetValue(details.PreviousHeadHeroId, out var prev)
+                            ? prev
+                            : null;
+
+            string textTemplate;
+            List<ProvinceId> affectedProvinces;
+
+            if (details.FactionId == currentModel.PlayerId) {
+                // Player's own faction - their new faction head
+                string previousHeadDescription =
+                        previousHeadHero != null ? $"Following the death of {{PreviousHead}}, your"
+                                                 : "Your";
+                textTemplate =
+                        $"{previousHeadDescription} sworn {DisplayNames.SiblingDescription(newHeadHero.PronounGender)} {{NewHead}} now leads your faction.\n\n";
+
+                var heroProvinceId = FindProvinceForHero(details.NewHeadHeroId, currentModel);
+                affectedProvinces = heroProvinceId.HasValue
+                                            ? new List<ProvinceId> { heroProvinceId.Value }
+                                            : currentModel.ProvincesForFaction(details.FactionId);
+            } else {
+                // Another faction
+                var factionName = currentModel.FactionName(details.FactionId);
+                if (previousHeadHero != null) {
+                    textTemplate =
+                            $"Following the death of {{PreviousHead}}, {{NewHead}} now leads {factionName}.\n\n";
+                } else {
+                    textTemplate = $"{{NewHead}} now leads {factionName}.\n\n";
+                }
+                affectedProvinces = currentModel.ProvincesForFaction(details.FactionId);
+            }
+
+            var heroPlaceholders = new Dictionary<string, (string nameTextId, string fallback)> {
+                { "NewHead", (newHeadHero.NameTextId, "A hero") }
+            };
+            if (previousHeadHero != null) {
+                heroPlaceholders["PreviousHead"] =
+                        (previousHeadHero.NameTextId, "the previous leader");
+            }
+
+            var displayedHeroes = new List<HeroView> { newHeadHero };
+            if (previousHeadHero != null) { displayedHeroes.Add(previousHeadHero); }
+
+            yield return DynamicTextNotification.StreamingDynamicNotification(
+                    title: GetNotificationTitle(),
+                    textTemplate: textTemplate,
+                    heroPlaceholders: heroPlaceholders,
+                    llmId: notification.LlmId,
+                    provinceIds: affectedProvinces,
+                    displayedHeroes: displayedHeroes);
+        }
+    }
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/Notifications/ARNNotifications/NewFactionHeadDetailsNotificationGenerator.cs.meta

@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: e9afdd2068b294a29993f07b379eb9c3

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/Notifications/ARNNotifications/PrisonerExecutedDetailsNotificationGenerator.cs

@@ -36,10 +36,10 @@ namespace eagle.Notifications.ARNNotifications {
                             $"{DisplayNames.ResolvedFactionString(lastFaction, currentModel)}'s hero {{HeroName}}";
                 }
 
-                textTemplate = $"{executingFactionName} has executed {victimDescription}!";
+                textTemplate = $"{executingFactionName} has executed {victimDescription}!\n\n";
                 heroPlaceholders["HeroName"] = (hero.NameTextId, "the hero");
             } else {
-                textTemplate = $"{executingFactionName} has executed {{ExecutedHero}}!";
+                textTemplate = $"{executingFactionName} has executed {{ExecutedHero}}!\n\n";
                 heroPlaceholders["ExecutedHero"] = (hero.NameTextId, "the prisoner");
             }
 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/OAuth Buttons.meta

@@ -0,0 +1,8 @@
+fileFormatVersion: 2
+guid: e661753a1e43a4f2da81b76457cf55c8
+folderAsset: yes
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/OAuth Buttons/Discord-Logo-Blurple.png.meta

@@ -0,0 +1,117 @@
+fileFormatVersion: 2
+guid: 8d524cd6fa08d47c99b2462c2686b8d0
+TextureImporter:
+  internalIDToNameTable: []
+  externalObjects: {}
+  serializedVersion: 13
+  mipmaps:
+    mipMapMode: 0
+    enableMipMap: 1
+    sRGBTexture: 1
+    linearTexture: 0
+    fadeOut: 0
+    borderMipMap: 0
+    mipMapsPreserveCoverage: 0
+    alphaTestReferenceValue: 0.5
+    mipMapFadeDistanceStart: 1
+    mipMapFadeDistanceEnd: 3
+  bumpmap:
+    convertToNormalMap: 0
+    externalNormalMap: 0
+    heightScale: 0.25
+    normalMapFilter: 0
+    flipGreenChannel: 0
+  isReadable: 0
+  streamingMipmaps: 0
+  streamingMipmapsPriority: 0
+  vTOnly: 0
+  ignoreMipmapLimit: 0
+  grayScaleToAlpha: 0
+  generateCubemap: 6
+  cubemapConvolution: 0
+  seamlessCubemap: 0
+  textureFormat: 1
+  maxTextureSize: 2048
+  textureSettings:
+    serializedVersion: 2
+    filterMode: 1
+    aniso: 1
+    mipBias: 0
+    wrapU: 0
+    wrapV: 0
+    wrapW: 0
+  nPOTScale: 1
+  lightmap: 0
+  compressionQuality: 50
+  spriteMode: 0
+  spriteExtrude: 1
+  spriteMeshType: 1
+  alignment: 0
+  spritePivot: {x: 0.5, y: 0.5}
+  spritePixelsToUnits: 100
+  spriteBorder: {x: 0, y: 0, z: 0, w: 0}
+  spriteGenerateFallbackPhysicsShape: 1
+  alphaUsage: 1
+  alphaIsTransparency: 0
+  spriteTessellationDetail: -1
+  textureType: 0
+  textureShape: 1
+  singleChannelComponent: 0
+  flipbookRows: 1
+  flipbookColumns: 1
+  maxTextureSizeSet: 0
+  compressionQualitySet: 0
+  textureFormatSet: 0
+  ignorePngGamma: 0
+  applyGammaDecoding: 0
+  swizzle: 50462976
+  cookieLightType: 0
+  platformSettings:
+  - serializedVersion: 4
+    buildTarget: DefaultTexturePlatform
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  - serializedVersion: 4
+    buildTarget: Standalone
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  spriteSheet:
+    serializedVersion: 2
+    sprites: []
+    outline: []
+    customData: 
+    physicsShape: []
+    bones: []
+    spriteID: 
+    internalID: 0
+    vertices: []
+    indices: 
+    edges: []
+    weights: []
+    secondaryTextures: []
+    spriteCustomMetadata:
+      entries: []
+    nameFileIdTable: {}
+  mipmapLimitGroupName: 
+  pSDRemoveMatte: 0
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/OAuth Buttons/web_neutral_rd_SI@4x.png.meta

@@ -0,0 +1,117 @@
+fileFormatVersion: 2
+guid: 1e69ea88b87d34a48bbb45a1fbad81fc
+TextureImporter:
+  internalIDToNameTable: []
+  externalObjects: {}
+  serializedVersion: 13
+  mipmaps:
+    mipMapMode: 0
+    enableMipMap: 1
+    sRGBTexture: 1
+    linearTexture: 0
+    fadeOut: 0
+    borderMipMap: 0
+    mipMapsPreserveCoverage: 0
+    alphaTestReferenceValue: 0.5
+    mipMapFadeDistanceStart: 1
+    mipMapFadeDistanceEnd: 3
+  bumpmap:
+    convertToNormalMap: 0
+    externalNormalMap: 0
+    heightScale: 0.25
+    normalMapFilter: 0
+    flipGreenChannel: 0
+  isReadable: 0
+  streamingMipmaps: 0
+  streamingMipmapsPriority: 0
+  vTOnly: 0
+  ignoreMipmapLimit: 0
+  grayScaleToAlpha: 0
+  generateCubemap: 6
+  cubemapConvolution: 0
+  seamlessCubemap: 0
+  textureFormat: 1
+  maxTextureSize: 2048
+  textureSettings:
+    serializedVersion: 2
+    filterMode: 1
+    aniso: 1
+    mipBias: 0
+    wrapU: 0
+    wrapV: 0
+    wrapW: 0
+  nPOTScale: 1
+  lightmap: 0
+  compressionQuality: 50
+  spriteMode: 0
+  spriteExtrude: 1
+  spriteMeshType: 1
+  alignment: 0
+  spritePivot: {x: 0.5, y: 0.5}
+  spritePixelsToUnits: 100
+  spriteBorder: {x: 0, y: 0, z: 0, w: 0}
+  spriteGenerateFallbackPhysicsShape: 1
+  alphaUsage: 1
+  alphaIsTransparency: 0
+  spriteTessellationDetail: -1
+  textureType: 0
+  textureShape: 1
+  singleChannelComponent: 0
+  flipbookRows: 1
+  flipbookColumns: 1
+  maxTextureSizeSet: 0
+  compressionQualitySet: 0
+  textureFormatSet: 0
+  ignorePngGamma: 0
+  applyGammaDecoding: 0
+  swizzle: 50462976
+  cookieLightType: 0
+  platformSettings:
+  - serializedVersion: 4
+    buildTarget: DefaultTexturePlatform
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  - serializedVersion: 4
+    buildTarget: Standalone
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  spriteSheet:
+    serializedVersion: 2
+    sprites: []
+    outline: []
+    customData: 
+    physicsShape: []
+    bones: []
+    spriteID: 
+    internalID: 0
+    vertices: []
+    indices: 
+    edges: []
+    weights: []
+    secondaryTextures: []
+    spriteCustomMetadata:
+      entries: []
+    nameFileIdTable: {}
+  mipmapLimitGroupName: 
+  pSDRemoveMatte: 0
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/OAuth Buttons/web_neutral_sq_ctn@4x.png.meta

@@ -0,0 +1,117 @@
+fileFormatVersion: 2
+guid: 1850a7332b6e84e1a9b69f5f5b4cf482
+TextureImporter:
+  internalIDToNameTable: []
+  externalObjects: {}
+  serializedVersion: 13
+  mipmaps:
+    mipMapMode: 0
+    enableMipMap: 1
+    sRGBTexture: 1
+    linearTexture: 0
+    fadeOut: 0
+    borderMipMap: 0
+    mipMapsPreserveCoverage: 0
+    alphaTestReferenceValue: 0.5
+    mipMapFadeDistanceStart: 1
+    mipMapFadeDistanceEnd: 3
+  bumpmap:
+    convertToNormalMap: 0
+    externalNormalMap: 0
+    heightScale: 0.25
+    normalMapFilter: 0
+    flipGreenChannel: 0
+  isReadable: 0
+  streamingMipmaps: 0
+  streamingMipmapsPriority: 0
+  vTOnly: 0
+  ignoreMipmapLimit: 0
+  grayScaleToAlpha: 0
+  generateCubemap: 6
+  cubemapConvolution: 0
+  seamlessCubemap: 0
+  textureFormat: 1
+  maxTextureSize: 2048
+  textureSettings:
+    serializedVersion: 2
+    filterMode: 1
+    aniso: 1
+    mipBias: 0
+    wrapU: 0
+    wrapV: 0
+    wrapW: 0
+  nPOTScale: 1
+  lightmap: 0
+  compressionQuality: 50
+  spriteMode: 0
+  spriteExtrude: 1
+  spriteMeshType: 1
+  alignment: 0
+  spritePivot: {x: 0.5, y: 0.5}
+  spritePixelsToUnits: 100
+  spriteBorder: {x: 0, y: 0, z: 0, w: 0}
+  spriteGenerateFallbackPhysicsShape: 1
+  alphaUsage: 1
+  alphaIsTransparency: 0
+  spriteTessellationDetail: -1
+  textureType: 0
+  textureShape: 1
+  singleChannelComponent: 0
+  flipbookRows: 1
+  flipbookColumns: 1
+  maxTextureSizeSet: 0
+  compressionQualitySet: 0
+  textureFormatSet: 0
+  ignorePngGamma: 0
+  applyGammaDecoding: 0
+  swizzle: 50462976
+  cookieLightType: 0
+  platformSettings:
+  - serializedVersion: 4
+    buildTarget: DefaultTexturePlatform
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  - serializedVersion: 4
+    buildTarget: Standalone
+    maxTextureSize: 2048
+    resizeAlgorithm: 0
+    textureFormat: -1
+    textureCompression: 1
+    compressionQuality: 50
+    crunchedCompression: 0
+    allowsAlphaSplitting: 0
+    overridden: 0
+    ignorePlatformSupport: 0
+    androidETC2FallbackOverride: 0
+    forceMaximumCompressionQuality_BC6H_BC7: 0
+  spriteSheet:
+    serializedVersion: 2
+    sprites: []
+    outline: []
+    customData: 
+    physicsShape: []
+    bones: []
+    spriteID: 
+    internalID: 0
+    vertices: []
+    indices: 
+    edges: []
+    weights: []
+    secondaryTextures: []
+    spriteCustomMetadata:
+      entries: []
+    nameFileIdTable: {}
+  mipmapLimitGroupName: 
+  pSDRemoveMatte: 0
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/PersistentClientConnection.cs

@@ -44,6 +44,18 @@ namespace eagle {
 
         private readonly Logger _remoteEagleClientLogger = Logger.GetLogger("ConnectionLogger");
         private readonly Logger _timingsLogger = Logger.GetLogger("ConnectionLogger");
+
+        // Counter to diagnose duplicate logging - if logs show same seq# twice, two threads
+        // are processing same message. If seq# increments but lines doubled, Logger issue.
+        private int _logFlowSeq = 0;
+
+        /// <summary>Timestamped log for connection flow tracing.</summary>
+        private void LogFlow(string message) {
+            var seq = Interlocked.Increment(ref _logFlowSeq);
+            var ts = DateTime.UtcNow.ToString("HH:mm:ss.fff");
+            _remoteEagleClientLogger.LogLine($"[FLOW {ts}] #{seq} {message}");
+        }
+
         private volatile bool _isConnecting = false;
         private Timer _idleCheckTimer = null;
         private Timer _heartbeatTimer = null;
@@ -77,7 +89,23 @@ namespace eagle {
             _retryTimer?.Dispose();
             NextReconnectAttempt = null;
             LogConnectionEvent("force_reconnect", "User requested immediate reconnect");
-            Task.Run(() => Connect());
+            RunConnectAsync();
+        }
+
+        /// <summary>
+        /// Fire-and-forget wrapper for Connect() that ensures exceptions are logged
+        /// rather than silently swallowed by Task.Run().
+        /// </summary>
+        private void RunConnectAsync() {
+            Task.Run(async () => {
+                try {
+                    await Connect();
+                } catch (Exception e) {
+                    // Log but don't rethrow - this is fire-and-forget
+                    Console.WriteLine($"[CONNECT] Exception in Connect: {e}");
+                    _remoteEagleClientLogger.LogLine($"Exception in Connect: {e}");
+                }
+            });
         }
 
         private DateTime? GetDeadlineFromNow() {
@@ -122,6 +150,7 @@ namespace eagle {
             _currentState = ConnectionState.Reconnecting;
             NextReconnectAttempt = DateTime.UtcNow.AddSeconds(backoffSeconds);
 
+            LogFlow($"SCHEDULE_RECONNECT reason={reason} backoff={backoffSeconds:F1}s attempt={_consecutiveFailures}");
             LogConnectionEvent(
                     "schedule_reconnect",
                     $"{reason}, backoff={backoffSeconds:F1}s, attempt={_consecutiveFailures}");
@@ -130,7 +159,7 @@ namespace eagle {
             _retryTimer = new Timer();
             _retryTimer.AutoReset = false;
             _retryTimer.Interval = backoffSeconds * 1000;
-            _retryTimer.Elapsed += (sender, args) => Task.Run(() => Connect());
+            _retryTimer.Elapsed += (sender, args) => RunConnectAsync();
             _retryTimer.Enabled = true;
         }
 
@@ -149,6 +178,7 @@ namespace eagle {
         private readonly Dictionary<EagleGameId, TaskCompletionSource<SubscriptionAck>>
                 _pendingSubscriptionAcks = new();
         private const int SubscriptionAckTimeoutMs = 10000;  // 10 seconds
+        private const int WriteAsyncTimeoutMs = 10000;       // 10 seconds for WriteAsync operations
 
         public PersistentClientConnection(
                 Eagle.EagleClient grpcClient,
@@ -194,6 +224,8 @@ namespace eagle {
             var ackTcs = new TaskCompletionSource<SubscriptionAck>();
             lock (_pendingSubscriptionAcks) { _pendingSubscriptionAcks[gameId] = ackTcs; }
 
+            var shardokCount = shardokStatuses.Count();
+            LogFlow($"SUBSCRIBE game={gameId} unfilteredCount={subscriber.LastUnfilteredResultCount} shardokGames={shardokCount}");
             _remoteEagleClientLogger.LogLine(
                     $"[SUBSCRIBE] Sending StreamGameRequest for game {gameId}, " +
                     $"unfilteredCount={subscriber.LastUnfilteredResultCount}");
@@ -233,6 +265,7 @@ namespace eagle {
 
                 var ack = await ackTask;
                 if (ack.Success) {
+                    LogFlow($"SUBSCRIBE_ACK game={gameId} success=true confirmedCount={ack.ConfirmedResultCount}");
                     _remoteEagleClientLogger.LogLine(
                             $"[SUBSCRIBE] Subscription confirmed for game {gameId}, " +
                             $"confirmedResultCount={ack.ConfirmedResultCount}");
@@ -244,6 +277,7 @@ namespace eagle {
 
                     return true;
                 } else {
+                    LogFlow($"SUBSCRIBE_ACK game={gameId} success=false error={ack.ErrorMessage}");
                     LogConnectionEvent(
                             "subscribe_ack_failed",
                             $"game={gameId}, error={ack.ErrorMessage}");
@@ -268,23 +302,24 @@ namespace eagle {
         public async Task Connect() {
             // Prevent concurrent connection attempts
             if (_isConnecting) {
-                _remoteEagleClientLogger.LogLine($"Connect() skipped - already connecting");
+                LogFlow($"Connect() SKIPPED already_connecting=true");
                 return;
             }
 
             // Check circuit breaker
             if (!_circuitBreaker.ShouldAttemptConnection()) {
-                _remoteEagleClientLogger.LogLine(
-                        $"[CIRCUIT] Connection attempt blocked - circuit {_circuitBreaker.CurrentState}");
+                LogFlow($"Connect() BLOCKED circuit={_circuitBreaker.CurrentState}");
                 LogConnectionEvent("connect_blocked", $"circuit={_circuitBreaker.CurrentState}");
                 return;
             }
 
             _isConnecting = true;
             try {
+                LogFlow($"Connect() START failures={_consecutiveFailures}");
                 _lastConnectAttempt = DateTime.UtcNow;
                 _currentState = _consecutiveFailures > 0 ? ConnectionState.Reconnecting
                                                          : ConnectionState.Connecting;
+                LogFlow($"State -> {_currentState}");
                 NextReconnectAttempt = null;
                 LogConnectionEvent("connect_attempt");
 
@@ -318,8 +353,10 @@ namespace eagle {
 
                     // Stream subscriptions OUTSIDE lock (can await)
                     // Set state to SubscriptionPending while waiting for acks
+                    LogFlow($"Streaming {subscribersToStream.Count} subscriptions");
                     if (subscribersToStream.Any()) {
                         _currentState = ConnectionState.SubscriptionPending;
+                        LogFlow($"State -> {_currentState}");
                     }
 
                     bool allSucceeded = true;
@@ -330,6 +367,7 @@ namespace eagle {
                     if (!allSucceeded) {
                         // Subscription failed - this is critical because the game won't receive
                         // updates. Trigger reconnect rather than proceeding to Connected state.
+                        LogFlow("SUBSCRIBE_FAILED triggering reconnect");
                         LogConnectionEvent(
                                 "subscribe_failed",
                                 "Subscription failed - triggering reconnect");
@@ -353,6 +391,7 @@ namespace eagle {
                     _lastSuccessfulConnect = DateTime.UtcNow;
                     _consecutiveFailures = 0;  // Reset backoff on successful connection
                     _currentState = ConnectionState.Connected;
+                    LogFlow($"State -> {_currentState}");
                     _circuitBreaker.RecordSuccess();
                     LogConnectionEvent("connect_success");
 
@@ -387,6 +426,18 @@ namespace eagle {
                             _pendingCommands.Add(pendingCommands.Dequeue());
                         }
                     }
+
+                    // Clean up resources before reconnecting
+                    lock (this) {
+                        _streamingCall?.Dispose();
+                        _streamingCall = null;
+                        _threadCancellationTokenSource?.Cancel();
+                    }
+                    MarkAllShardokGamesForResync();
+                    CancelAllPendingSubscriptionAcks();
+
+                    // Schedule reconnect - without this, the connection dies silently
+                    ScheduleReconnect($"ConnectFailed-{e.GetType().Name}");
                 }
             } finally { _isConnecting = false; }
         }
@@ -424,26 +475,35 @@ namespace eagle {
                                             lock (this) { _pendingCommands.Add(nextCommand); }
                                         }
                                     } else {
+                                        // CurrentEagleToken is null - server hasn't sent us
+                                        // commands yet, or we skipped them. Retry the pending
+                                        // command anyway; if the server already processed it, it
+                                        // will be ignored as duplicate.
                                         _remoteEagleClientLogger.LogLine(
-                                                "No matching command for token " + providedToken);
+                                                $"No current token, retrying pending command with token {providedToken}");
+                                        await PostRequest(nextCommand);
                                     }
 
                                     break;
                                 case UniversalCommand.SealedValueOneofCase.ShardokCommand: {
                                     Int64 providedShardokToken =
                                             nextCommand.Command.ShardokCommand.ShardokToken;
-                                    if (subscriber.CurrentShardokToken(
-                                                nextCommand.Command.ShardokCommand.GameId)
-                                                is Int64 shardokToken &&
+                                    var currentShardokToken = subscriber.CurrentShardokToken(
+                                            nextCommand.Command.ShardokCommand.GameId);
+                                    if (currentShardokToken is Int64 shardokToken &&
                                         shardokToken == providedShardokToken) {
                                         _remoteEagleClientLogger.LogLine(
                                                 "Found a matching pending command with token " +
                                                 shardokToken);
                                         await PostRequest(nextCommand);
+                                    } else if (currentShardokToken == null) {
+                                        // No current token - retry anyway
+                                        _remoteEagleClientLogger.LogLine(
+                                                $"No current Shardok token, retrying pending command with token {providedShardokToken}");
+                                        await PostRequest(nextCommand);
                                     } else {
                                         _remoteEagleClientLogger.LogLine(
-                                                "No matching command for token " +
-                                                providedShardokToken);
+                                                $"Shardok token mismatch: pending={providedShardokToken} current={currentShardokToken}, dropping");
                                     }
 
                                     break;
@@ -453,25 +513,27 @@ namespace eagle {
                                     Int64 providedShardokToken =
                                             nextCommand.Command.ShardokPlacementCommands
                                                     .ShardokToken;
-                                    if (subscriber.CurrentShardokToken(
-                                                nextCommand.Command.ShardokCommand.GameId)
-                                                is Int64 shardokToken &&
+                                    var currentShardokToken = subscriber.CurrentShardokToken(
+                                            nextCommand.Command.ShardokPlacementCommands.GameId);
+                                    if (currentShardokToken is Int64 shardokToken &&
                                         shardokToken == providedShardokToken) {
                                         _remoteEagleClientLogger.LogLine(
-                                                "Found a matching pending command with token " +
+                                                "Found a matching pending placement command with token " +
                                                 shardokToken);
                                         await PostRequest(nextCommand);
+                                    } else if (currentShardokToken == null) {
+                                        // No current token - retry anyway
+                                        _remoteEagleClientLogger.LogLine(
+                                                $"No current Shardok token, retrying pending placement command with token {providedShardokToken}");
+                                        await PostRequest(nextCommand);
                                     } else {
                                         _remoteEagleClientLogger.LogLine(
-                                                "No matching command for token " +
-                                                providedShardokToken);
+                                                $"Shardok placement token mismatch: pending={providedShardokToken} current={currentShardokToken}, dropping");
                                     }
 
                                     break;
                                 }
                             }
-
-                            await PostRequest(nextCommand);
                         }
                     }
 
@@ -503,6 +565,9 @@ namespace eagle {
         }
 
         public void Dispose() {
+            Thread threadToJoin = null;
+            CancellationTokenSource tokenSourceToDispose = null;
+
             lock (this) {
                 // Dispose timers first to stop any pending callbacks
                 StopIdleCheckTimer();
@@ -525,20 +590,25 @@ namespace eagle {
                 // Clear pending commands
                 _pendingCommands.Clear();
 
-                // Cancel and dispose thread cancellation token
+                // Cancel thread cancellation token (but don't dispose yet)
                 _threadCancellationTokenSource?.Cancel();
 
-                // Give thread a chance to exit gracefully
-                if (_streamingCallThread != null) {
-                    if (!_streamingCallThread.Join(TimeSpan.FromSeconds(2))) {
-                        Console.WriteLine("Warning: Streaming call thread did not exit gracefully");
-                    }
-                    _streamingCallThread = null;
-                }
-
-                _threadCancellationTokenSource?.Dispose();
+                // Capture thread and token source references for cleanup outside lock
+                threadToJoin = _streamingCallThread;
+                _streamingCallThread = null;
+                tokenSourceToDispose = _threadCancellationTokenSource;
                 _threadCancellationTokenSource = null;
             }
+
+            // Join thread OUTSIDE lock to avoid deadlock - the streaming thread
+            // may be trying to acquire lock(this) when we're waiting for it
+            if (threadToJoin != null) {
+                if (!threadToJoin.Join(TimeSpan.FromSeconds(2))) {
+                    Console.WriteLine("Warning: Streaming call thread did not exit gracefully");
+                }
+            }
+
+            tokenSourceToDispose?.Dispose();
         }
 
         public void SetLobbySubscriber(ILobbySubscriber subscriber) {
@@ -582,13 +652,25 @@ namespace eagle {
             try {
                 lock (this) { _pendingCommands.Add(request); }
 
-                await DoWithStreamingCall(async (streamingCall) => {
+                var success = await DoWithStreamingCall(async (streamingCall) => {
                     await streamingCall.RequestStream.WriteAsync(
                             new UpdateStreamRequest { PostCommandRequest = request });
                     return true;
                 });
-                lock (this) { _pendingCommands.Remove(request); }
-            } catch (Exception e) { Console.WriteLine("Failed to post command: " + e); }
+
+                // Only remove from pending if successfully sent.
+                // If connection was dead, leave in queue for retry after reconnect.
+                if (success) {
+                    lock (this) { _pendingCommands.Remove(request); }
+                } else {
+                    _remoteEagleClientLogger.LogLine(
+                            $"[POST] Command not sent (connection dead), keeping in pending queue for retry");
+                }
+            } catch (Exception e) {
+                Console.WriteLine("Failed to post command: " + e);
+                _remoteEagleClientLogger.LogLine($"[POST] Exception posting command: {e.Message}");
+                // Leave in _pendingCommands for retry after reconnect
+            }
         }
 
         private async Task
@@ -665,9 +747,38 @@ namespace eagle {
 
         private delegate Task<bool> WithStreamingCallDelegate(
                 AsyncDuplexStreamingCall<UpdateStreamRequest, UpdateStreamResponse> call);
+
+        /// <summary>
+        /// Execute an action with the streaming call, with a timeout to prevent indefinite
+        /// blocking. If the action takes longer than WriteAsyncTimeoutMs, we consider the
+        /// connection dead and return false. This prevents thread pool exhaustion on dead
+        /// connections.
+        /// </summary>
         private async Task<bool> DoWithStreamingCall(WithStreamingCallDelegate action) {
+            var sc = _streamingCall;
+            if (sc == null) return false;
+
             try {
-                return await action(_streamingCall);
+                using var timeoutCts = new CancellationTokenSource(WriteAsyncTimeoutMs);
+                var actionTask = action(sc);
+                var timeoutTask = Task.Delay(WriteAsyncTimeoutMs, timeoutCts.Token);
+
+                var completedTask =
+                        await Task.WhenAny(actionTask, timeoutTask).ConfigureAwait(false);
+
+                if (completedTask == timeoutTask) {
+                    // WriteAsync timed out - connection is likely dead
+                    LogConnectionEvent(
+                            "write_timeout",
+                            $"WriteAsync timed out after {WriteAsyncTimeoutMs}ms");
+                    _remoteEagleClientLogger.LogLine(
+                            $"[WRITE_TIMEOUT] WriteAsync timed out after {WriteAsyncTimeoutMs}ms, connection may be dead");
+                    return false;
+                }
+
+                // Cancel the timeout task since action completed
+                timeoutCts.Cancel();
+                return await actionTask.ConfigureAwait(false);
             } catch (RpcException e) {
                 if (e.StatusCode == StatusCode.Cancelled) {
                     // This is expected when the connection is closed.
@@ -675,9 +786,15 @@ namespace eagle {
                 } else {
                     throw;
                 }
+            } catch (OperationCanceledException) {
+                // Timeout was triggered
+                return false;
             }
         }
 
+        /// <summary>
+        /// Send a request on the streaming call with a timeout to prevent indefinite blocking.
+        /// </summary>
         public async Task<bool> SendUpdateStreamRequestAsync(UpdateStreamRequest request) {
             AsyncDuplexStreamingCall<UpdateStreamRequest, UpdateStreamResponse> sc = null;
             lock (this) {
@@ -686,7 +803,30 @@ namespace eagle {
             }
 
             try {
-                await sc.RequestStream.WriteAsync(request, _cancellationToken);
+                using var timeoutCts = new CancellationTokenSource(WriteAsyncTimeoutMs);
+                using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(
+                        _cancellationToken,
+                        timeoutCts.Token);
+
+                var writeTask = sc.RequestStream.WriteAsync(request, linkedCts.Token);
+                var timeoutTask = Task.Delay(WriteAsyncTimeoutMs, timeoutCts.Token);
+
+                var completedTask =
+                        await Task.WhenAny(writeTask, timeoutTask).ConfigureAwait(false);
+
+                if (completedTask == timeoutTask) {
+                    // WriteAsync timed out - connection is likely dead
+                    LogConnectionEvent(
+                            "write_timeout",
+                            $"SendUpdateStreamRequestAsync timed out after {WriteAsyncTimeoutMs}ms");
+                    _remoteEagleClientLogger.LogLine(
+                            $"[WRITE_TIMEOUT] SendUpdateStreamRequestAsync timed out after {WriteAsyncTimeoutMs}ms");
+                    return false;
+                }
+
+                // Cancel the timeout task since write completed
+                timeoutCts.Cancel();
+                await writeTask.ConfigureAwait(false);  // Observe any exception
                 return true;
             } catch (RpcException e) {
                 if (e.StatusCode == StatusCode.Cancelled) {
@@ -695,6 +835,9 @@ namespace eagle {
                 } else {
                     throw;
                 }
+            } catch (OperationCanceledException) {
+                // Timeout was triggered
+                return false;
             }
         }
 
@@ -706,6 +849,7 @@ namespace eagle {
         private void HandleGameUpdate(GameUpdate gameUpdate, DateTime receivedTime) {
             switch (gameUpdate.GameUpdateDetailsCase) {
                 case GameUpdate.GameUpdateDetailsOneofCase.ErrorResponse:
+                    LogFlow($"UPDATE ErrorResponse game={gameUpdate.GameId}");
                     _remoteEagleClientLogger.LogLine("Got an error response!");
                     MainQueue.Q.Enqueue(() => {
                         lock (this) { _subscribers.Remove(gameUpdate.GameId); }
@@ -728,16 +872,63 @@ namespace eagle {
                     break;
 
                 case GameUpdate.GameUpdateDetailsOneofCase.ActionResultResponse:
-                case GameUpdate.GameUpdateDetailsOneofCase.ShardokActionResultResponse:
+                    var arResp = gameUpdate.ActionResultResponse;
+                    var arCount = arResp.ActionResultViews?.Count ?? 0;
+                    var hasStartingState = gameUpdate.StartingState != null;
+                    var hasCommands = arResp.AvailableCommands != null;
+                    var cmdToken = hasCommands ? arResp.AvailableCommands.Token : -1;
+                    var cmdCount = hasCommands
+                                           ? arResp.AvailableCommands.CommandsByProvince?.Count ?? 0
+                                           : 0;
+                    var status = arResp.ServerGameStatus?.Status.ToString() ?? "null";
+                    LogFlow($"UPDATE ActionResult game={gameUpdate.GameId} countAfter={arResp.UnfilteredResultCountAfter} " +
+                            $"actionResults={arCount} startingState={hasStartingState} hasCommands={hasCommands} " +
+                            $"token={cmdToken} cmdProvinces={cmdCount} status={status}");
+
                     // Update result counts IMMEDIATELY on the gRPC thread, before enqueueing.
-                    // This ensures reconnects use accurate counts even when MainQueue is blocked
-                    // (e.g., when Unity is backgrounded).
                     lock (this) {
                         if (_subscribers.TryGetValue(gameUpdate.GameId, out var sub)) {
                             sub.UpdateResultCounts(gameUpdate);
                         }
                     }
 
+                    MainQueue.Q.Enqueue(async () => {
+                        IClientConnectionSubscriber subscriber;
+                        lock (this) {
+                            if (_subscribers.TryGetValue(gameUpdate.GameId, out subscriber)) {
+                                subscriber.ReceiveGameUpdate(gameUpdate);
+                            } else {
+                                _subscribers.Remove(gameUpdate.GameId);
+                            }
+                        }
+
+                        await TryPendingCommands();
+
+                        var processTime = (DateTime.UtcNow - receivedTime).TotalMilliseconds;
+                        if (processTime > 100.0) {
+                            _timingsLogger.LogLine($"PROCESS {processTime} ms");
+                        }
+                    });
+                    break;
+
+                case GameUpdate.GameUpdateDetailsOneofCase.ShardokActionResultResponse:
+                    var shardokResp = gameUpdate.ShardokActionResultResponse;
+                    var shardokGameCount = shardokResp.ShardokGameResponses?.Count ?? 0;
+                    // Log each Shardok game's sequence to detect missing results
+                    foreach (var sgr in shardokResp.ShardokGameResponses) {
+                        var resultCount = sgr.ActionResultViews?.Count ?? 0;
+                        LogFlow($"UPDATE ShardokResult game={gameUpdate.GameId} " +
+                                $"shardok={sgr.ShardokGameId} countAfter={sgr.NewResultViewCount} " +
+                                $"results={resultCount}");
+                    }
+
+                    // Update result counts IMMEDIATELY on the gRPC thread, before enqueueing.
+                    lock (this) {
+                        if (_subscribers.TryGetValue(gameUpdate.GameId, out var sub2)) {
+                            sub2.UpdateResultCounts(gameUpdate);
+                        }
+                    }
+
                     MainQueue.Q.Enqueue(async () => {
                         IClientConnectionSubscriber subscriber;
                         lock (this) {
@@ -760,6 +951,7 @@ namespace eagle {
         }
 
         private async void HandleStreamingCall() {
+            LogFlow("HandleStreamingCall STARTED");
             try {
                 AsyncDuplexStreamingCall<UpdateStreamRequest, UpdateStreamResponse> sc;
                 CancellationToken threadToken;
@@ -875,6 +1067,10 @@ namespace eagle {
                     waitStartTime = DateTime.UtcNow;
                 }
 
+                // While loop exited normally (not via exception)
+                var scNull = sc == null;
+                var tokenCancelled = _currentThreadToken.IsCancellationRequested;
+                LogFlow($"HandleStreamingCall ENDED normally: sc_null={scNull} token_cancelled={tokenCancelled}");
                 _remoteEagleClientLogger.LogLine(
                         "How did we get here? This is not my beautiful wife!");
             } catch (RpcException e) {
@@ -941,6 +1137,19 @@ namespace eagle {
                 CancelAllPendingSubscriptionAcks();
 
                 ScheduleReconnect("ObjectDisposed");
+            } catch (Exception e) {
+                // Catch-all for any unexpected exceptions. Without this, exceptions in an
+                // async void method can crash the process or be silently lost, leaving the
+                // connection dead with no recovery.
+                _lastDisconnect = DateTime.UtcNow;
+                LogConnectionEvent("disconnect", $"UnexpectedException: {e.GetType().Name}");
+                _remoteEagleClientLogger.LogLine(
+                        $"UNEXPECTED exception in HandleStreamingCall: {e}");
+
+                MarkAllShardokGamesForResync();
+                CancelAllPendingSubscriptionAcks();
+
+                ScheduleReconnect($"UnexpectedException-{e.GetType().Name}");
             }
 
             return;
@@ -974,7 +1183,17 @@ namespace eagle {
                 AutoReset = true,
                 Interval = 5000  // Check every 5 seconds
             };
-            _idleCheckTimer.Elapsed += (sender, args) => CheckForIdleTimeout();
+            _idleCheckTimer.Elapsed += (sender, args) => {
+                try {
+                    // Log BEFORE callback to confirm timer is firing
+                    Console.WriteLine($"[IDLE_TIMER] Elapsed at {DateTime.UtcNow:HH:mm:ss.fff}");
+                    CheckForIdleTimeout();
+                } catch (Exception e) {
+                    // Timer callbacks must not throw - it can stop the timer from firing again
+                    Console.WriteLine($"[IDLE_TIMER] Exception in callback: {e}");
+                    _remoteEagleClientLogger.LogLine($"Exception in idle check timer: {e}");
+                }
+            };
             _idleCheckTimer.Enabled = true;
         }
 
@@ -987,10 +1206,16 @@ namespace eagle {
         }
 
         private void CheckForIdleTimeout() {
-            if (_cancellationToken.IsCancellationRequested) { return; }
-
             var idleTime = (DateTime.UtcNow - _lastResponseReceived).TotalSeconds;
 
+            // Log every check when idle > 5s to diagnose timer issues
+            if (idleTime > 5.0) {
+                _remoteEagleClientLogger.LogLine(
+                        $"[IDLE_CHECK] idle_time={idleTime:F1}s, cancelled={_cancellationToken.IsCancellationRequested}");
+            }
+
+            if (_cancellationToken.IsCancellationRequested) { return; }
+
             // Early warnings at 10s and 20s to help diagnose slow connections
             if (idleTime > 20.0 && _lastIdleWarningLevel < 2) {
                 _lastIdleWarningLevel = 2;
@@ -1013,7 +1238,7 @@ namespace eagle {
                 if (toCancel != null) {
                     toCancel.Dispose();
                     lock (this) { _streamingCall = null; }
-                    Task.Run(() => Connect());
+                    RunConnectAsync();
                 }
             }
         }
@@ -1022,7 +1247,26 @@ namespace eagle {
             StopHeartbeatTimer();
             _heartbeatTimer =
                     new Timer { AutoReset = true, Interval = HeartbeatIntervalSeconds * 1000 };
-            _heartbeatTimer.Elapsed += (sender, args) => Task.Run(() => SendHeartbeat());
+            _heartbeatTimer.Elapsed += (sender, args) => {
+                try {
+                    // Log BEFORE Task.Run to confirm timer is firing
+                    Console.WriteLine(
+                            $"[HEARTBEAT_TIMER] Elapsed at {DateTime.UtcNow:HH:mm:ss.fff}");
+                    Task.Run(async () => {
+                        try {
+                            await SendHeartbeat();
+                        } catch (Exception e) {
+                            // Log but don't rethrow - exceptions in Task.Run are silently lost
+                            Console.WriteLine($"[HEARTBEAT] Exception in SendHeartbeat: {e}");
+                            _remoteEagleClientLogger.LogLine($"Exception in SendHeartbeat: {e}");
+                        }
+                    });
+                } catch (Exception e) {
+                    // Timer callbacks must not throw
+                    Console.WriteLine($"[HEARTBEAT_TIMER] Exception in callback: {e}");
+                    _remoteEagleClientLogger.LogLine($"Exception in heartbeat timer: {e}");
+                }
+            };
             _heartbeatTimer.Enabled = true;
         }
 
@@ -1035,8 +1279,16 @@ namespace eagle {
         }
 
         private async Task SendHeartbeat() {
-            if (_cancellationToken.IsCancellationRequested) { return; }
-            if (_currentState != ConnectionState.Connected) { return; }
+            LogFlow($"HEARTBEAT_START state={_currentState}");
+
+            if (_cancellationToken.IsCancellationRequested) {
+                LogFlow("HEARTBEAT_SKIP reason=cancellation_requested");
+                return;
+            }
+            if (_currentState != ConnectionState.Connected) {
+                LogFlow($"HEARTBEAT_SKIP reason=not_connected state={_currentState}");
+                return;
+            }
 
             // Build sync status for all subscribed games
             var heartbeatRequest = new HeartbeatRequest {
@@ -1066,8 +1318,13 @@ namespace eagle {
 
             var sent = await SendUpdateStreamRequestAsync(request);
             if (sent) {
-                _remoteEagleClientLogger.LogLine(
-                        $"[HEARTBEAT] Sent heartbeat with {heartbeatRequest.GameSyncStatuses.Count} games");
+                var gameInfo = string.Join(
+                        ", ",
+                        heartbeatRequest.GameSyncStatuses.Select(
+                                g => $"{g.GameId}:{g.UnfilteredResultCount}"));
+                LogFlow($"HEARTBEAT_SENT games={heartbeatRequest.GameSyncStatuses.Count} ({gameInfo})");
+            } else {
+                LogFlow("HEARTBEAT_FAILED stream_unavailable");
             }
         }
 
@@ -1076,6 +1333,7 @@ namespace eagle {
         private const double SyncMismatchGracePeriodSeconds = 60.0;
 
         private void HandleHeartbeatResponse(HeartbeatResponse response) {
+            LogFlow($"HEARTBEAT_RESPONSE server_ts={response.ServerTimestamp}");
             _remoteEagleClientLogger.LogLine(
                     $"[HEARTBEAT] Got response, server_timestamp={response.ServerTimestamp}");
 
@@ -1083,6 +1341,7 @@ namespace eagle {
             bool hasMismatch = false;
             foreach (var syncResult in response.GameSyncResults) {
                 if (!syncResult.EagleInSync) {
+                    LogFlow($"SYNC_MISMATCH game={syncResult.GameId} server_count={syncResult.ServerUnfilteredResultCount}");
                     _remoteEagleClientLogger.LogLine(
                             $"[SYNC_MISMATCH] Game {syncResult.GameId}: Eagle out of sync, " +
                             $"server has {syncResult.ServerUnfilteredResultCount} results");
@@ -1126,6 +1385,9 @@ namespace eagle {
             LogConnectionEvent("sync_mismatch_reconnect", "Triggering reconnect to resync");
 
             // Schedule reconnect to resync
+            // Stop timers FIRST to prevent them firing during reconnection
+            StopHeartbeatTimer();
+            StopIdleCheckTimer();
             lock (this) {
                 _streamingCall?.Dispose();
                 _streamingCall = null;

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/EagleConnection.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Threading;
+using Auth;
 using Cysharp.Net.Http;
 using eagle;
 using Grpc.Core;
@@ -28,11 +29,7 @@ public class EagleConnection : IDisposable {
         _channel = GrpcChannel.ForAddress(
                 "https://" + url,
                 new GrpcChannelOptions {
-                    HttpHandler =
-                            new YetAnotherHttpHandler {
-                                Http2Only = true,
-                                Http2KeepAliveInterval = TimeSpan.FromSeconds(KeepAliveSeconds)
-                            },
+                    HttpHandler = CreateHttpHandler(),
                     DisposeHttpClient = true,
                     LoggerFactory = _loggerFactory,
                     MaxReceiveMessageSize = null
@@ -42,6 +39,44 @@ public class EagleConnection : IDisposable {
         return invoker;
     }
 
+    /// <summary>
+    /// Create HTTP handler with timeouts configured for reliable connection management.
+    /// These settings help detect and recover from dead connections, especially on Windows
+    /// where firewalls may silently drop HTTP/2 keep-alive pings.
+    /// </summary>
+    private static YetAnotherHttpHandler CreateHttpHandler() {
+        return new YetAnotherHttpHandler {
+            Http2Only = true,
+            // Send keep-alive pings every 15 seconds
+            Http2KeepAliveInterval = TimeSpan.FromSeconds(KeepAliveSeconds),
+            // Close connection if ping not acknowledged within 5 seconds
+            Http2KeepAliveTimeout = TimeSpan.FromSeconds(5),
+            // Continue pinging even when idle to detect dead connections
+            Http2KeepAliveWhileIdle = true,
+            // Don't wait forever for initial connection
+            ConnectTimeout = TimeSpan.FromSeconds(10)
+        };
+    }
+
+    private CallInvoker MakeJwtInvoker(string url) {
+        var jwtInterceptor = new JwtAuthInterceptor();
+
+        _channel = GrpcChannel.ForAddress(
+                "https://" + url,
+                new GrpcChannelOptions {
+                    HttpHandler = CreateHttpHandler(),
+                    DisposeHttpClient = true,
+                    LoggerFactory = _loggerFactory,
+                    MaxReceiveMessageSize = null
+                });
+
+        var invoker = _channel.Intercept(jwtInterceptor);
+        return invoker;
+    }
+
+    /// <summary>
+    /// Create connection using Basic Auth (legacy).
+    /// </summary>
     public EagleConnection(string playerName, string password, string url) {
         this.playerName = playerName;
         credentials = new Metadata { { "user", playerName } };
@@ -53,6 +88,26 @@ public class EagleConnection : IDisposable {
         EagleGrpcClient = new Eagle.EagleClient(MakeInvoker(playerName, password, url));
     }
 
+    /// <summary>
+    /// Create connection using JWT Bearer token auth.
+    /// Tokens are read from TokenStorage on each request.
+    /// </summary>
+    public static EagleConnection CreateWithJwt(string url) {
+        return new EagleConnection(url, useJwt: true);
+    }
+
+    private EagleConnection(string url, bool useJwt) {
+        // For JWT auth, get display name from TokenStorage
+        playerName = TokenStorage.DisplayName ?? "Unknown";
+        credentials = new Metadata { { "user", TokenStorage.UserId ?? "" } };
+        authHeader = null;  // Not used for JWT
+
+        _loggerFactory = LoggerFactory.Create(
+                builder => { builder.AddProvider(new CustomFileLoggerProvider()); });
+
+        EagleGrpcClient = new Eagle.EagleClient(MakeJwtInvoker(url));
+    }
+
     public void Dispose() {
         try {
             _channel?.Dispose();

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Shardok/HexGrid.cs

@@ -511,6 +511,7 @@ public class HexGrid : MonoBehaviour {
     }
 
     public void ClearCellLabels() {
+        if (cells == null) return;
         for (int i = 0; i < width * height; i++) {
             cells[i].UpperUnitInfoLabel.text = "";
             cells[i].LowerUnitInfoLabel.text = "";

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/common/Logger.cs

@@ -1,24 +1,39 @@
-using System;
+using System;
+using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
+using System.Threading;
 using UnityEngine;
 
 namespace common {
+    /// <summary>
+    /// Non-blocking logger that queues messages and writes them on a dedicated background thread.
+    /// This ensures that file I/O issues (antivirus, cloud sync, slow disk) never block the caller.
+    /// </summary>
     public sealed class Logger : IDisposable {
         private readonly StreamWriter _sw;
+        private readonly ConcurrentQueue<string> _messageQueue = new ConcurrentQueue<string>();
+        private readonly Thread _writerThread;
+        private readonly AutoResetEvent _messageAvailable = new AutoResetEvent(false);
+        private volatile bool _disposed;
+        private readonly string _name;
 
         private static Dictionary<String, Logger> _loggers = new Dictionary<String, Logger>();
+        private static readonly object _loggersLock = new object();
 
         public static Logger GetLogger(string name) {
-            if (!_loggers.ContainsKey(name)) { _loggers[name] = new Logger(name); }
-            return _loggers[name];
+            lock (_loggersLock) {
+                if (!_loggers.ContainsKey(name)) { _loggers[name] = new Logger(name); }
+                return _loggers[name];
+            }
         }
 
-        private string CurrentTimeString() {
+        private static string CurrentTimeString() {
             return DateTime.UtcNow.ToString("yyyyMMdd_HHmmss.fff");
         }
 
         private Logger(string name) {
+            _name = name;
             var directoryPath =
                     Path.Combine(Application.persistentDataPath, "eagle0", "Resources", name);
 
@@ -26,17 +41,94 @@ namespace common {
 
             var logFilePath = Path.Combine(directoryPath, $"{name}_{CurrentTimeString()}.txt");
             _sw = new StreamWriter(logFilePath, append: true);
+
+            // Start dedicated writer thread
+            _writerThread = new Thread(WriterLoop) {
+                Name = $"Logger-{name}",
+                IsBackground = true  // Won't prevent app exit
+            };
+            _writerThread.Start();
         }
 
+        /// <summary>
+        /// Queue a log message. This method never blocks on file I/O.
+        /// </summary>
         public void LogLine(string line) {
-            _sw.WriteLine(CurrentTimeString() + "  " + line);
-            _sw.Flush();
+            if (_disposed) return;
+
+            // Format the message with timestamp immediately (captures accurate time)
+            var formattedMessage = CurrentTimeString() + "  " + line;
+            _messageQueue.Enqueue(formattedMessage);
+            _messageAvailable.Set();  // Signal the writer thread
         }
 
-        public void Close() { _sw.Close(); }
+        /// <summary>
+        /// Background thread that processes the message queue and writes to file.
+        /// File I/O blocking only affects this thread, not the callers of LogLine().
+        /// </summary>
+        private void WriterLoop() {
+            while (!_disposed) {
+                try {
+                    // Wait for messages with timeout so we can check _disposed periodically
+                    _messageAvailable.WaitOne(1000);
+
+                    // Process all queued messages
+                    while (_messageQueue.TryDequeue(out var message)) {
+                        try {
+                            _sw.WriteLine(message);
+                        } catch (Exception ex) {
+                            // File write failed - log to Console as fallback
+                            Console.WriteLine($"[Logger-{_name}] Write failed: {ex.Message}");
+                        }
+                    }
+
+                    // Flush after processing batch
+                    try {
+                        _sw.Flush();
+                    } catch (Exception ex) {
+                        Console.WriteLine($"[Logger-{_name}] Flush failed: {ex.Message}");
+                    }
+                } catch (Exception ex) {
+                    // Don't let any exception kill the writer thread
+                    Console.WriteLine($"[Logger-{_name}] WriterLoop error: {ex.Message}");
+                }
+            }
+
+            // Drain remaining messages on shutdown
+            while (_messageQueue.TryDequeue(out var message)) {
+                try {
+                    _sw.WriteLine(message);
+                } catch { /* ignore on shutdown */
+                }
+            }
+
+            try {
+                _sw.Flush();
+            } catch { /* ignore on shutdown */
+            }
+        }
+
+        public void Close() { Dispose(); }
 
         public void Dispose() {
-            if (_sw != null) { _sw.Dispose(); }
+            if (_disposed) return;
+            _disposed = true;
+
+            // Signal writer thread to exit and wait for it
+            _messageAvailable.Set();
+            if (_writerThread != null && _writerThread.IsAlive) {
+                _writerThread.Join(5000);  // Wait up to 5 seconds for clean shutdown
+            }
+
+            try {
+                _sw?.Dispose();
+            } catch { /* ignore */
+            }
+
+            try {
+                _messageAvailable?.Dispose();
+            } catch { /* ignore */
+            }
         }
     }
-}
+}

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/common/ResourceFetcher.cs

@@ -6,6 +6,7 @@ using System.Net;
 using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
+using Cysharp.Net.Http;
 using eagle;
 using Google.Protobuf;
 using Net.Eagle0.Eagle.Api;
@@ -45,6 +46,10 @@ namespace common {
 
         private readonly HashSet<string> _failedPaths = new();
         private readonly object _failedPathsLock = new();
+
+        // Track paths currently being fetched to avoid duplicate requests
+        private readonly HashSet<string> _inFlightPaths = new();
+        private readonly object _inFlightLock = new();
         private Timer _periodicRetryTimer;
 
         ResourceFetcher(string relativeLocalPath, HttpClient httpClient) {
@@ -55,9 +60,17 @@ namespace common {
                     relativeLocalPath);
             Directory.CreateDirectory(_localPath);
 
-            // Create a client that doesn't follow redirects automatically,
-            // so we can retry each hop independently
-            var handler = new HttpClientHandler { AllowAutoRedirect = false };
+            // Use HTTP/2 handler for better connection reuse and multiplexing.
+            // YetAnotherHttpHandler doesn't follow redirects automatically,
+            // which is what we want so we can retry each hop independently.
+            var handler = new YetAnotherHttpHandler {
+                Http2Only = true,
+                // Keep connections alive to improve reliability on poor networks
+                Http2KeepAliveInterval = TimeSpan.FromSeconds(15),
+                Http2KeepAliveTimeout = TimeSpan.FromSeconds(5),
+                Http2KeepAliveWhileIdle = true,
+                ConnectTimeout = TimeSpan.FromSeconds(RequestTimeoutSeconds)
+            };
             _noRedirectClient = new HttpClient(
                     handler) { Timeout = TimeSpan.FromSeconds(RequestTimeoutSeconds) };
             // Store auth header to add per-request only for eagle0.net
@@ -103,32 +116,45 @@ namespace common {
         }
 
         private async Task<bool> FetchRemote(string path) {
-            Uri currentUri = new Uri(BaseUri, path);
-
-            for (int hop = 0; hop < MaxRedirectHops; hop++) {
-                var result = await FetchOneHopWithRetry(currentUri, path, hop);
-
-                if (result.GotContent) {
-                    // Successfully received and saved content
-                    ClearFailed(path);
-                    return true;
+            // Check if this path is already being fetched
+            lock (_inFlightLock) {
+                if (_inFlightPaths.Contains(path)) {
+                    // Already being fetched; the existing fetch will handle _imageLoadQueue
+                    return false;
                 }
-
-                if (result.RedirectUri != null) {
-                    // Follow the redirect
-                    currentUri = result.RedirectUri;
-                    continue;
-                }
-
-                // Failed and not a redirect
-                MarkFailed(path);
-                return false;
+                _inFlightPaths.Add(path);
             }
 
-            // Too many redirects
-            Debug.Log($"ResourceFetcher: Too many redirects for {path}");
-            MarkFailed(path);
-            return false;
+            try {
+                Uri currentUri = new Uri(BaseUri, path);
+
+                for (int hop = 0; hop < MaxRedirectHops; hop++) {
+                    var result = await FetchOneHopWithRetry(currentUri, path, hop);
+
+                    if (result.GotContent) {
+                        // Successfully received and saved content
+                        ClearFailed(path);
+                        return true;
+                    }
+
+                    if (result.RedirectUri != null) {
+                        // Follow the redirect
+                        currentUri = result.RedirectUri;
+                        continue;
+                    }
+
+                    // Failed and not a redirect
+                    MarkFailed(path);
+                    return false;
+                }
+
+                // Too many redirects
+                Debug.Log($"ResourceFetcher: Too many redirects for {path}");
+                MarkFailed(path);
+                return false;
+            } finally {
+                lock (_inFlightLock) { _inFlightPaths.Remove(path); }
+            }
         }
 
         // Fetch a single hop with retries. Returns content, redirect, or failure.
@@ -181,9 +207,9 @@ namespace common {
                     if (attempt < MaxRetryAttempts - 1) {
                         await Task.Delay(RetryDelaysMs[attempt]);
                     }
-                } catch (TaskCanceledException e) {
+                } catch (OperationCanceledException e) {
                     Debug.Log(
-                            $"ResourceFetcher: hop {hopIndex} timeout for {path} (attempt {attempt + 1}/{MaxRetryAttempts}): {e.Message}");
+                            $"ResourceFetcher: hop {hopIndex} canceled for {path} (attempt {attempt + 1}/{MaxRetryAttempts}): {e.Message}");
                     if (attempt < MaxRetryAttempts - 1) {
                         await Task.Delay(RetryDelaysMs[attempt]);
                     }
@@ -291,10 +317,13 @@ namespace common {
         public void Prefetch(IEnumerable<string> paths) {
             List<string> toFetch;
             lock (_failedPathsLock) {
-                toFetch = paths.Where(path => !string.IsNullOrEmpty(path) &&
-                                              !File.Exists(FullLocalPath(path)) &&
-                                              !_failedPaths.Contains(path))
-                                  .ToList();
+                lock (_inFlightLock) {
+                    toFetch = paths.Where(path => !string.IsNullOrEmpty(path) &&
+                                                  !File.Exists(FullLocalPath(path)) &&
+                                                  !_failedPaths.Contains(path) &&
+                                                  !_inFlightPaths.Contains(path))
+                                      .ToList();
+                }
             }
 
             foreach (var path in toFetch) { FetchRemote(path); }

src/main/csharp/net/eagle0/clients/unity/eagle0/Packages/manifest.json

@@ -1,6 +1,6 @@
 {
   "dependencies": {
-    "com.cysharp.yetanotherhttphandler": "https://github.com/Cysharp/YetAnotherHttpHandler.git?path=src/YetAnotherHttpHandler#1.5.3",
+    "com.cysharp.yetanotherhttphandler": "https://github.com/Cysharp/YetAnotherHttpHandler.git?path=src/YetAnotherHttpHandler#1.11.4",
     "com.unity.2d.sprite": "1.0.0",
     "com.unity.2d.tilemap": "1.0.0",
     "com.unity.ai.navigation": "2.0.9",

src/main/csharp/net/eagle0/clients/unity/eagle0/Packages/packages-lock.json

@@ -1,11 +1,11 @@
 {
   "dependencies": {
     "com.cysharp.yetanotherhttphandler": {
-      "version": "https://github.com/Cysharp/YetAnotherHttpHandler.git?path=src/YetAnotherHttpHandler#1.5.3",
+      "version": "https://github.com/Cysharp/YetAnotherHttpHandler.git?path=src/YetAnotherHttpHandler#1.11.4",
       "depth": 0,
       "source": "git",
       "dependencies": {},
-      "hash": "ceb2f24f343c93d66c8a784a283be65b9627efe1"
+      "hash": "5719afbc6b1d8cfa8729f24f0fe6a0e9dfa70f3a"
     },
     "com.unity.2d.sprite": {
       "version": "1.0.0",

src/main/csharp/net/eagle0/clients/unity/eagle0/protos/protos.csproj

@@ -253,5 +253,8 @@
     <Protobuf Include="..\..\..\..\..\..\..\..\..\src\main\protobuf\net\eagle0\eagle\api\command\util\expanded_combat_unit.proto" ProtoRoot="..\..\..\..\..\..\..\..\..\">
       <Link>src\main\protobuf\net\eagle0\eagle\api\command\util\expanded_combat_unit.proto</Link>
     </Protobuf>
+    <Protobuf Include="..\..\..\..\..\..\..\..\..\src\main\protobuf\net\eagle0\eagle\api\auth.proto" ProtoRoot="..\..\..\..\..\..\..\..\..\" GrpcServices="Client">
+      <Link>src\main\protobuf\net\eagle0\eagle\api\auth.proto</Link>
+    </Protobuf>
   </ItemGroup>
 </Project>

src/main/go/net/eagle0/admin_server/BUILD.bazel

@@ -3,6 +3,10 @@ load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 go_library(
     name = "admin_server_lib",
     srcs = ["admin_server.go"],
+    embedsrcs = glob([
+        "static/*",
+        "templates/*.html",
+    ]),
     importpath = "github.com/nolen777/eagle0/src/main/go/net/eagle0/admin_server",
     visibility = ["//visibility:private"],
     deps = [
@@ -15,5 +19,24 @@ go_library(
 go_binary(
     name = "admin_server",
     embed = [":admin_server_lib"],
+    pure = "on",
     visibility = ["//visibility:public"],
+    x_defs = {
+        "main.buildTime": "{BUILD_TIMESTAMP}",
+        "main.gitCommit": "{STABLE_GIT_COMMIT}",
+    },
+)
+
+# Linux x86_64 target for Docker deployment
+go_binary(
+    name = "admin_server_linux_amd64",
+    embed = [":admin_server_lib"],
+    goarch = "amd64",
+    goos = "linux",
+    pure = "on",
+    visibility = ["//visibility:public"],
+    x_defs = {
+        "main.buildTime": "{BUILD_TIMESTAMP}",
+        "main.gitCommit": "{STABLE_GIT_COMMIT}",
+    },
 )

src/main/go/net/eagle0/admin_server/static/style.css

@@ -0,0 +1,565 @@
+/* Admin Server Styles - supplements Pico CSS */
+
+:root {
+    --pico-font-size: 16px;
+}
+
+/* Navigation */
+nav {
+    background: var(--pico-card-background-color);
+    padding: 1rem;
+    margin-bottom: 2rem;
+    border-bottom: 1px solid var(--pico-muted-border-color);
+}
+
+nav ul {
+    display: flex;
+    gap: 1.5rem;
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    align-items: center;
+}
+
+nav .brand {
+    font-weight: bold;
+    font-size: 1.25rem;
+    margin-right: auto;
+}
+
+/* Game cards */
+.game-card {
+    background: var(--pico-card-background-color);
+    border: 1px solid var(--pico-muted-border-color);
+    border-radius: var(--pico-border-radius);
+    padding: 1.5rem;
+    margin-bottom: 1rem;
+}
+
+.game-card h3 {
+    margin-top: 0;
+    margin-bottom: 0.5rem;
+}
+
+.game-card .meta {
+    color: var(--pico-muted-color);
+    font-size: 0.875rem;
+    margin-bottom: 0.75rem;
+}
+
+.game-card .players {
+    margin-bottom: 1rem;
+}
+
+.game-card .actions {
+    display: flex;
+    gap: 0.5rem;
+}
+
+/* Player badges */
+.player-badge {
+    display: inline-block;
+    padding: 0.25rem 0.5rem;
+    border-radius: var(--pico-border-radius);
+    font-size: 0.875rem;
+    margin-right: 0.5rem;
+    margin-bottom: 0.25rem;
+}
+
+.player-badge.human {
+    background: var(--pico-primary-background);
+    color: var(--pico-primary-inverse);
+}
+
+.player-badge.ai {
+    background: var(--pico-secondary-background);
+    color: var(--pico-secondary-inverse);
+}
+
+/* Status badges */
+.status-badge {
+    display: inline-block;
+    padding: 0.25rem 0.5rem;
+    border-radius: var(--pico-border-radius);
+    font-size: 0.75rem;
+    text-transform: uppercase;
+}
+
+.status-badge.running {
+    background: #22c55e;
+    color: white;
+}
+
+.status-badge.finished {
+    background: var(--pico-muted-color);
+    color: white;
+}
+
+/* History table */
+.history-table {
+    width: 100%;
+}
+
+.history-table th,
+.history-table td {
+    text-align: left;
+    padding: 0.75rem;
+}
+
+.history-table tr:hover {
+    background: var(--pico-card-background-color);
+}
+
+.action-type {
+    font-family: monospace;
+    font-size: 0.875rem;
+}
+
+/* Loading indicator */
+.htmx-indicator {
+    display: none;
+}
+
+.htmx-request .htmx-indicator {
+    display: inline;
+}
+
+.htmx-request.htmx-indicator {
+    display: inline;
+}
+
+/* Empty state */
+.empty-state {
+    text-align: center;
+    padding: 3rem;
+    color: var(--pico-muted-color);
+}
+
+/* Page header */
+.page-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 1.5rem;
+}
+
+.page-header h1 {
+    margin: 0;
+}
+
+/* Breadcrumbs */
+.breadcrumb {
+    display: flex;
+    gap: 0.5rem;
+    font-size: 0.875rem;
+    margin-bottom: 1rem;
+    color: var(--pico-muted-color);
+}
+
+.breadcrumb a {
+    color: var(--pico-muted-color);
+}
+
+.breadcrumb .separator {
+    color: var(--pico-muted-color);
+}
+
+/* Clickable action rows */
+.action-row {
+    cursor: pointer;
+    transition: background-color 0.15s ease;
+}
+
+.action-row:hover {
+    background: var(--pico-primary-background) !important;
+    color: var(--pico-primary-inverse);
+}
+
+/* Action detail panel */
+.action-detail-row {
+    background: var(--pico-card-background-color);
+}
+
+.action-detail {
+    padding: 1rem;
+    border: 1px solid var(--pico-muted-border-color);
+    border-radius: var(--pico-border-radius);
+    margin: 0.5rem 0;
+}
+
+.action-detail-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 0.75rem;
+    padding-bottom: 0.5rem;
+    border-bottom: 1px solid var(--pico-muted-border-color);
+}
+
+.action-detail .close-btn {
+    background: none;
+    border: none;
+    font-size: 1.5rem;
+    cursor: pointer;
+    padding: 0 0.5rem;
+    color: var(--pico-muted-color);
+    line-height: 1;
+}
+
+.action-detail .close-btn:hover {
+    color: var(--pico-del-color);
+}
+
+.action-json {
+    background: var(--pico-code-background-color);
+    padding: 1rem;
+    border-radius: var(--pico-border-radius);
+    overflow-x: auto;
+    font-size: 0.875rem;
+    margin: 0;
+    white-space: pre-wrap;
+    word-wrap: break-word;
+}
+
+/* Settings page */
+.settings-search {
+    display: flex;
+    align-items: center;
+    gap: 1rem;
+    margin-bottom: 1.5rem;
+}
+
+.settings-search input {
+    flex: 1;
+    max-width: 400px;
+    margin: 0;
+}
+
+.settings-count {
+    color: var(--pico-muted-color);
+    font-size: 0.875rem;
+}
+
+.settings-table {
+    width: 100%;
+    border-collapse: collapse;
+}
+
+.settings-table th,
+.settings-table td {
+    text-align: left;
+    padding: 0.25rem 0.5rem;
+    border-bottom: 1px solid var(--pico-muted-border-color);
+    vertical-align: middle;
+}
+
+.settings-table th {
+    background: var(--pico-card-background-color);
+    font-weight: 600;
+    font-size: 0.75rem;
+}
+
+.setting-name {
+    font-family: monospace;
+    font-size: 0.8rem;
+}
+
+.setting-type {
+    font-size: 0.7rem;
+    color: var(--pico-muted-color);
+    text-transform: uppercase;
+}
+
+.setting-value form {
+    display: flex;
+    gap: 0.25rem;
+    margin: 0;
+    align-items: center;
+}
+
+.setting-input {
+    width: 100px;
+    padding: 2px 6px !important;
+    margin: 0 !important;
+    font-size: 0.75rem;
+    height: 22px !important;
+    line-height: 1 !important;
+    border-width: 1px;
+}
+
+.setting-default {
+    font-size: 0.8rem;
+    color: var(--pico-muted-color);
+}
+
+.setting-row.modified {
+    background: rgba(255, 193, 7, 0.1);
+}
+
+.setting-row.modified .setting-name {
+    font-weight: bold;
+}
+
+.btn-small {
+    padding: 2px 8px !important;
+    font-size: 0.7rem;
+    margin: 0 !important;
+    height: 22px !important;
+    line-height: 1 !important;
+}
+
+.actions-cell {
+    white-space: nowrap;
+}
+
+.actions-cell button {
+    margin-right: 0.25rem;
+}
+
+.settings-note {
+    margin-top: 2rem;
+    padding: 1rem;
+    background: var(--pico-card-background-color);
+    border-radius: var(--pico-border-radius);
+    font-size: 0.875rem;
+    color: var(--pico-muted-color);
+}
+
+.error {
+    color: var(--pico-del-color);
+}
+
+.success {
+    color: var(--pico-ins-color);
+}
+
+/* Players table */
+.players-table {
+    width: 100%;
+    border-collapse: collapse;
+    margin-bottom: 2rem;
+}
+
+.players-table th,
+.players-table td {
+    text-align: left;
+    padding: 0.75rem;
+    border-bottom: 1px solid var(--pico-muted-border-color);
+}
+
+.players-table th {
+    background: var(--pico-card-background-color);
+    font-weight: 600;
+}
+
+.player-type {
+    display: inline-block;
+    padding: 0.25rem 0.5rem;
+    border-radius: var(--pico-border-radius);
+    font-size: 0.75rem;
+    text-transform: uppercase;
+}
+
+.player-type.human {
+    background: var(--pico-primary-background);
+    color: var(--pico-primary-inverse);
+}
+
+.player-type.ai {
+    background: var(--pico-secondary-background);
+    color: var(--pico-secondary-inverse);
+}
+
+/* Button variants */
+.btn-primary {
+    background: var(--pico-primary-background);
+    color: var(--pico-primary-inverse);
+    border: none;
+}
+
+.btn-secondary {
+    background: var(--pico-secondary-background);
+    color: var(--pico-secondary-inverse);
+    border: none;
+}
+
+.btn-danger {
+    background: var(--pico-del-color);
+    color: white;
+    border: none;
+}
+
+.btn-danger:hover {
+    background: #c0392b;
+}
+
+/* Modal dialogs */
+dialog {
+    border: 1px solid var(--pico-muted-border-color);
+    border-radius: var(--pico-border-radius);
+    padding: 1.5rem;
+    min-width: 300px;
+}
+
+dialog::backdrop {
+    background: rgba(0, 0, 0, 0.5);
+}
+
+dialog h3 {
+    margin-top: 0;
+    margin-bottom: 1rem;
+}
+
+dialog .form-group {
+    margin-bottom: 1rem;
+}
+
+dialog .form-group label {
+    display: block;
+    margin-bottom: 0.5rem;
+    font-weight: 500;
+}
+
+dialog .form-group input {
+    width: 100%;
+    margin: 0;
+}
+
+dialog .modal-actions {
+    display: flex;
+    gap: 0.5rem;
+    justify-content: flex-end;
+    margin-top: 1.5rem;
+}
+
+dialog .modal-actions button {
+    min-width: 80px;
+}
+
+/* Rewind button and cell */
+.rewind-cell {
+    text-align: center;
+}
+
+.btn-rewind {
+    padding: 2px 8px !important;
+    font-size: 0.7rem;
+    margin: 0 !important;
+    height: 22px !important;
+    line-height: 1 !important;
+    background: var(--pico-del-color);
+    border-color: var(--pico-del-color);
+    color: white;
+    cursor: pointer;
+}
+
+.btn-rewind:hover {
+    background: #c82333;
+    border-color: #c82333;
+}
+
+/* Alert messages */
+.alert {
+    padding: 1rem;
+    border-radius: var(--pico-border-radius);
+    margin-bottom: 1rem;
+}
+
+.alert-success,
+.alert.success {
+    background: rgba(34, 197, 94, 0.2);
+    color: #16a34a;
+    border: 1px solid #22c55e;
+}
+
+.alert-error,
+.alert.error {
+    background: rgba(239, 68, 68, 0.2);
+    color: #dc2626;
+    border: 1px solid #ef4444;
+}
+
+.alert a {
+    color: inherit;
+    font-weight: bold;
+}
+
+/* Table action buttons */
+.players-table .actions {
+    display: flex;
+    gap: 0.5rem;
+}
+
+/* JFR controls in nav */
+#jfr-controls {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+}
+
+.jfr-status {
+    font-size: 0.75rem;
+    font-weight: 600;
+    padding: 0.25rem 0.5rem;
+    border-radius: var(--pico-border-radius);
+    text-transform: uppercase;
+}
+
+.jfr-on {
+    background: #22c55e;
+    color: white;
+}
+
+.jfr-off {
+    background: var(--pico-muted-color);
+    color: white;
+}
+
+.jfr-loading {
+    color: var(--pico-muted-color);
+    font-size: 0.875rem;
+}
+
+.jfr-error {
+    color: var(--pico-del-color);
+    font-size: 0.875rem;
+}
+
+#jfr-controls .btn-small {
+    padding: 0.25rem 0.5rem !important;
+    font-size: 0.75rem;
+    height: auto !important;
+    line-height: 1.2 !important;
+    text-decoration: none;
+    display: inline-block;
+}
+
+#jfr-controls button.btn-small {
+    background: var(--pico-primary-background);
+    color: var(--pico-primary-inverse);
+    border: none;
+    cursor: pointer;
+}
+
+#jfr-controls button.btn-small.secondary {
+    background: var(--pico-secondary-background);
+    color: var(--pico-secondary-inverse);
+}
+
+#jfr-controls a.btn-small {
+    background: var(--pico-primary-background);
+    color: var(--pico-primary-inverse);
+    border-radius: var(--pico-border-radius);
+}
+
+/* Result div */
+.rewind-result:empty {
+    display: none;
+}
+
+/* Build info in header */
+.build-info {
+    font-size: 0.7rem;
+    font-weight: normal;
+    color: var(--pico-muted-color);
+}

src/main/go/net/eagle0/admin_server/templates/action_detail.html

@@ -0,0 +1,11 @@
+<tr class="action-detail-row">
+    <td colspan="6">
+        <div class="action-detail">
+            <div class="action-detail-header">
+                <strong>Action #{{.Index}}</strong> - {{.ActionType}} (Round {{.RoundId}})
+                <button class="close-btn" onclick="this.closest('tr').remove()">&times;</button>
+            </div>
+            <pre class="action-json">{{.ActionJSON}}</pre>
+        </div>
+    </td>
+</tr>

src/main/go/net/eagle0/admin_server/templates/game_detail.html

@@ -0,0 +1,191 @@
+{{define "content"}}
+<nav class="breadcrumb">
+    <a href="/">Games</a>
+    <span class="separator">/</span>
+    <span>{{.Game.GameID}}</span>
+</nav>
+
+<div class="page-header">
+    <h1>Game {{.Game.GameID}}</h1>
+    <span class="status-badge {{if eq .Game.RunStatus "Running"}}running{{else}}finished{{end}}">
+        {{.Game.RunStatus}}
+    </span>
+</div>
+
+<article>
+    <header>
+        <strong>Round {{.Game.CurrentRound}}</strong> &bull; {{.Game.ActionCount}} total actions
+    </header>
+</article>
+
+<h2>Players</h2>
+<div id="player-management-result"></div>
+<table class="players-table">
+    <thead>
+        <tr>
+            <th>Faction ID</th>
+            <th>Faction Name</th>
+            <th>Leader</th>
+            <th>Type</th>
+            <th>User</th>
+            <th>Actions</th>
+        </tr>
+    </thead>
+    <tbody>
+        {{range .Game.Players}}
+        <tr>
+            <td>{{.FactionID}}</td>
+            <td>{{.FactionName}}</td>
+            <td>{{.LeaderName}}</td>
+            <td>
+                <span class="player-type {{if .IsHuman}}human{{else}}ai{{end}}">
+                    {{if .IsHuman}}Human{{else}}AI{{end}}
+                </span>
+            </td>
+            <td>{{if .IsHuman}}{{.UserName}}{{else}}-{{end}}</td>
+            <td class="actions">
+                {{if .IsHuman}}
+                <button class="btn-small btn-danger"
+                        onclick="confirmDropToAi('{{$.Game.GameID}}', {{.FactionID}}, '{{.UserName}}')">
+                    Drop to AI
+                </button>
+                <button class="btn-small"
+                        onclick="showReassignModal('{{$.Game.GameID}}', {{.FactionID}}, '{{.UserName}}')">
+                    Reassign
+                </button>
+                {{else}}
+                <button class="btn-small btn-primary"
+                        onclick="showAssignUserModal('{{$.Game.GameID}}', {{.FactionID}})">
+                    Assign User
+                </button>
+                {{end}}
+            </td>
+        </tr>
+        {{end}}
+    </tbody>
+</table>
+
+<!-- Modal for Assign User -->
+<dialog id="assign-user-modal">
+    <form method="dialog">
+        <h3>Assign User to AI Faction</h3>
+        <div class="form-group">
+            <label for="assign-username">Username:</label>
+            <input type="text" id="assign-username" name="username" required>
+        </div>
+        <input type="hidden" id="assign-faction-id" name="faction_id">
+        <input type="hidden" id="assign-game-id" name="game_id">
+        <div class="modal-actions">
+            <button type="button" class="btn-secondary" onclick="document.getElementById('assign-user-modal').close()">Cancel</button>
+            <button type="button" class="btn-primary" onclick="submitAssignUser()">Assign</button>
+        </div>
+    </form>
+</dialog>
+
+<!-- Modal for Reassign -->
+<dialog id="reassign-modal">
+    <form method="dialog">
+        <h3>Reassign Faction</h3>
+        <p id="reassign-current-user"></p>
+        <div class="form-group">
+            <label for="reassign-username">New Username:</label>
+            <input type="text" id="reassign-username" name="username" required>
+        </div>
+        <input type="hidden" id="reassign-faction-id" name="faction_id">
+        <input type="hidden" id="reassign-game-id" name="game_id">
+        <div class="modal-actions">
+            <button type="button" class="btn-secondary" onclick="document.getElementById('reassign-modal').close()">Cancel</button>
+            <button type="button" class="btn-primary" onclick="submitReassign()">Reassign</button>
+        </div>
+    </form>
+</dialog>
+
+<script>
+function showAssignUserModal(gameId, factionId) {
+    document.getElementById('assign-game-id').value = gameId;
+    document.getElementById('assign-faction-id').value = factionId;
+    document.getElementById('assign-username').value = '';
+    document.getElementById('assign-user-modal').showModal();
+}
+
+function submitAssignUser() {
+    const gameId = document.getElementById('assign-game-id').value;
+    const factionId = document.getElementById('assign-faction-id').value;
+    const username = document.getElementById('assign-username').value;
+
+    if (!username.trim()) {
+        alert('Username is required');
+        return;
+    }
+
+    htmx.ajax('POST', '/games/' + gameId + '/player-management/ai-to-human', {
+        values: {faction_id: factionId, username: username},
+        target: '#player-management-result',
+        swap: 'innerHTML'
+    });
+
+    document.getElementById('assign-user-modal').close();
+}
+
+function confirmDropToAi(gameId, factionId, username) {
+    if (confirm('Are you sure you want to convert "' + username + '" to AI control?')) {
+        htmx.ajax('POST', '/games/' + gameId + '/player-management/human-to-ai', {
+            values: {faction_id: factionId},
+            target: '#player-management-result',
+            swap: 'innerHTML'
+        });
+    }
+}
+
+function showReassignModal(gameId, factionId, currentUsername) {
+    document.getElementById('reassign-game-id').value = gameId;
+    document.getElementById('reassign-faction-id').value = factionId;
+    document.getElementById('reassign-current-user').textContent = 'Currently assigned to: ' + currentUsername;
+    document.getElementById('reassign-username').value = '';
+    document.getElementById('reassign-modal').showModal();
+}
+
+function submitReassign() {
+    const gameId = document.getElementById('reassign-game-id').value;
+    const factionId = document.getElementById('reassign-faction-id').value;
+    const username = document.getElementById('reassign-username').value;
+
+    if (!username.trim()) {
+        alert('Username is required');
+        return;
+    }
+
+    htmx.ajax('POST', '/games/' + gameId + '/player-management/reassign', {
+        values: {faction_id: factionId, username: username},
+        target: '#player-management-result',
+        swap: 'innerHTML'
+    });
+
+    document.getElementById('reassign-modal').close();
+}
+</script>
+
+<h2>Action History</h2>
+<div id="rewind-result" class="rewind-result"></div>
+
+<table class="history-table">
+    <thead>
+        <tr>
+            <th style="width: 60px">#</th>
+            <th>Action Type</th>
+            <th>Faction</th>
+            <th style="width: 120px">Date</th>
+            <th style="width: 80px">Round</th>
+            <th style="width: 80px">Actions</th>
+        </tr>
+    </thead>
+    <tbody id="history-body"
+           hx-get="/games/{{.Game.GameID}}/history?start=0&limit=50"
+           hx-trigger="load"
+           hx-swap="innerHTML">
+        <tr>
+            <td colspan="6" class="htmx-indicator">Loading history...</td>
+        </tr>
+    </tbody>
+</table>
+{{end}}

src/main/go/net/eagle0/admin_server/templates/game_state.html

@@ -0,0 +1,11 @@
+<tr class="game-state-row">
+    <td colspan="6">
+        <div class="action-detail">
+            <div class="action-detail-header">
+                <strong>Game State after Action #{{.ActionIndex}}</strong>
+                <button class="close-btn" onclick="this.closest('tr').remove()">&times;</button>
+            </div>
+            <pre class="action-json">{{.GameStateJSON}}</pre>
+        </div>
+    </td>
+</tr>

src/main/go/net/eagle0/admin_server/templates/games.html

@@ -0,0 +1,37 @@
+{{define "content"}}
+<div class="page-header">
+    <h1>Running Games</h1>
+    <span>{{len .Games}} game{{if ne (len .Games) 1}}s{{end}}</span>
+</div>
+
+{{if .Games}}
+    {{range .Games}}
+    <article class="game-card">
+        <h3>
+            <a href="/games/{{.GameID}}">Game {{.GameID}}</a>
+            <span class="status-badge {{if eq .RunStatus "Running"}}running{{else}}finished{{end}}">
+                {{.RunStatus}}
+            </span>
+        </h3>
+        <div class="meta">
+            Round {{.CurrentRound}} &bull; {{.ActionCount}} actions
+        </div>
+        <div class="players">
+            {{range .Players}}
+            <span class="player-badge {{if .IsHuman}}human{{else}}ai{{end}}">
+                {{.FactionName}}{{if .IsHuman}} ({{.UserName}}){{end}}
+            </span>
+            {{end}}
+        </div>
+        <div class="actions">
+            <a href="/games/{{.GameID}}" role="button" class="outline">View History</a>
+        </div>
+    </article>
+    {{end}}
+{{else}}
+    <div class="empty-state">
+        <p>No games currently running.</p>
+        <p>Start a game from the Unity client to see it here.</p>
+    </div>
+{{end}}
+{{end}}

src/main/go/net/eagle0/admin_server/templates/history_rows.html

@@ -0,0 +1,58 @@
+{{range .Entries}}
+<tr class="action-row" onclick="toggleActionDetail(this)">
+    <td>{{.Index}}</td>
+    <td class="action-type">{{.ActionType}}</td>
+    <td>{{.FactionName}}</td>
+    <td>{{.GameDate}}</td>
+    <td>{{.RoundId}}</td>
+    <td class="actions-cell">
+        <button class="btn-small"
+                hx-get="/games/{{$.GameID}}/state/{{.Index}}"
+                hx-target="closest tr"
+                hx-swap="afterend"
+                onclick="event.stopPropagation()">
+            State
+        </button>
+        <button class="btn-rewind"
+                hx-post="/games/{{$.GameID}}/rewind"
+                hx-vals='{"targetAction": "{{.Index}}"}'
+                hx-confirm="Rewind game to action {{.Index}}? This will disconnect all clients and cannot be undone."
+                hx-target="#rewind-result"
+                hx-swap="innerHTML"
+                onclick="event.stopPropagation()">
+            Rewind
+        </button>
+    </td>
+</tr>
+<tr class="action-detail-row" style="display: none;">
+    <td colspan="6">
+        <div class="action-detail">
+            <div class="action-detail-header">
+                <strong>Action #{{.Index}}</strong> - {{.ActionType}} (Round {{.RoundId}})
+                <button class="close-btn" onclick="event.stopPropagation(); this.closest('tr').style.display='none'">&times;</button>
+            </div>
+            <pre class="action-json">{{.ActionJSON}}</pre>
+        </div>
+    </td>
+</tr>
+{{end}}
+{{if .HasMore}}
+<tr hx-get="/games/{{.GameID}}/history?start={{.NextStart}}&limit=50"
+    hx-trigger="revealed"
+    hx-swap="outerHTML">
+    <td colspan="6" class="htmx-indicator">Loading more...</td>
+</tr>
+{{end}}
+{{if and (not .Entries) (not .HasMore)}}
+<tr>
+    <td colspan="6" class="empty-state">No actions recorded yet.</td>
+</tr>
+{{end}}
+<script>
+function toggleActionDetail(row) {
+    const detailRow = row.nextElementSibling;
+    if (detailRow && detailRow.classList.contains('action-detail-row')) {
+        detailRow.style.display = detailRow.style.display === 'none' ? '' : 'none';
+    }
+}
+</script>

src/main/go/net/eagle0/admin_server/templates/layout.html

@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{.Title}} - Eagle Admin</title>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css">
+    <link rel="stylesheet" href="/static/style.css">
+    <script src="https://unpkg.com/htmx.org@1.9.10"></script>
+</head>
+<body>
+    <nav>
+        <ul>
+            <li class="brand">Eagle Admin <span class="build-info">{{if .BuildInfo.GitCommit}}({{.BuildInfo.GitCommit}}{{if .BuildInfo.BuildTime}}, {{.BuildInfo.BuildTime}}{{end}}){{end}}</span></li>
+            <li><a href="/">Games</a></li>
+            <li><a href="/settings">Settings</a></li>
+            <li><a href="/health">Health</a></li>
+            <li id="jfr-controls" hx-get="/jfr/status" hx-trigger="load" hx-swap="innerHTML">
+                <span class="jfr-loading">JFR: ...</span>
+            </li>
+        </ul>
+    </nav>
+    <main class="container">
+        {{template "content" .}}
+    </main>
+    <script>
+        // Handle JFR status response and update controls
+        document.body.addEventListener('htmx:afterRequest', function(evt) {
+            if (evt.detail.pathInfo.requestPath === '/jfr/status') {
+                try {
+                    const data = JSON.parse(evt.detail.xhr.responseText);
+                    updateJfrControls(data.recording);
+                } catch(e) {
+                    document.getElementById('jfr-controls').innerHTML =
+                        '<span class="jfr-error">JFR: Error</span>';
+                }
+            } else if (evt.detail.pathInfo.requestPath === '/jfr/start' ||
+                       evt.detail.pathInfo.requestPath === '/jfr/stop') {
+                try {
+                    const data = JSON.parse(evt.detail.xhr.responseText);
+                    updateJfrControls(data.recording);
+                } catch(e) {
+                    // Refresh status on error
+                    htmx.ajax('GET', '/jfr/status', '#jfr-controls');
+                }
+            }
+        });
+
+        function updateJfrControls(isRecording) {
+            const container = document.getElementById('jfr-controls');
+            if (isRecording) {
+                container.innerHTML = `
+                    <span class="jfr-status jfr-on">JFR: ON</span>
+                    <button hx-post="/jfr/stop" hx-swap="none" class="btn-small secondary">Stop</button>
+                    <a href="/jfr/download" class="btn-small">Download</a>
+                `;
+            } else {
+                container.innerHTML = `
+                    <span class="jfr-status jfr-off">JFR: OFF</span>
+                    <button hx-post="/jfr/start" hx-swap="none" class="btn-small">Start</button>
+                `;
+            }
+            htmx.process(container);
+        }
+    </script>
+</body>
+</html>

src/main/go/net/eagle0/admin_server/templates/settings.html

@@ -0,0 +1,52 @@
+{{define "content"}}
+<h1>Settings</h1>
+
+<div class="settings-search">
+    <input type="text"
+           id="settings-filter"
+           name="filter"
+           placeholder="Search settings..."
+           value="{{.Filter}}"
+           hx-get="/settings/search"
+           hx-trigger="input changed delay:300ms, keyup[key=='Enter']"
+           hx-target="#settings-body"
+           hx-swap="innerHTML">
+    <span class="settings-count">{{len .Settings}} settings</span>
+</div>
+
+<table class="settings-table">
+    <thead>
+        <tr>
+            <th>Name</th>
+            <th>Type</th>
+            <th>Current Value</th>
+            <th>Default</th>
+        </tr>
+    </thead>
+    <tbody id="settings-body">
+        {{range .Settings}}
+        <tr class="setting-row{{if .IsModified}} modified{{end}}" id="setting-{{.Name}}">
+            <td class="setting-name">{{.Name}}</td>
+            <td class="setting-type">{{.SettingType}}</td>
+            <td class="setting-value">
+                <form hx-post="/settings/update" hx-target="#setting-{{.Name}}" hx-swap="outerHTML">
+                    <input type="hidden" name="name" value="{{.Name}}">
+                    <input type="text" name="value" value="{{.CurrentValue}}" class="setting-input">
+                    <button type="submit" class="btn-small">Save</button>
+                </form>
+            </td>
+            <td class="setting-default">{{.DefaultValue}}</td>
+        </tr>
+        {{end}}
+        {{if not .Settings}}
+        <tr>
+            <td colspan="4" class="empty-state">No settings found.</td>
+        </tr>
+        {{end}}
+    </tbody>
+</table>
+
+<p class="settings-note">
+    <strong>Note:</strong> Settings changes are in-memory only. A server restart will reset all values to defaults.
+</p>
+{{end}}

src/main/go/net/eagle0/admin_server/templates/settings_rows.html

@@ -0,0 +1,19 @@
+{{range .Settings}}
+<tr class="setting-row{{if .IsModified}} modified{{end}}" id="setting-{{.Name}}">
+    <td class="setting-name">{{.Name}}</td>
+    <td class="setting-type">{{.SettingType}}</td>
+    <td class="setting-value">
+        <form hx-post="/settings/update" hx-target="#setting-{{.Name}}" hx-swap="outerHTML">
+            <input type="hidden" name="name" value="{{.Name}}">
+            <input type="text" name="value" value="{{.CurrentValue}}" class="setting-input">
+            <button type="submit" class="btn-small">Save</button>
+        </form>
+    </td>
+    <td class="setting-default">{{.DefaultValue}}</td>
+</tr>
+{{end}}
+{{if not .Settings}}
+<tr>
+    <td colspan="4" class="empty-state">No settings match "{{.Filter}}"</td>
+</tr>
+{{end}}

src/main/go/net/eagle0/build/settings_loader_generator/settings_loader_generator.go

@@ -15,8 +15,9 @@ func usage() {
 }
 
 type Setting struct {
-	Name string
-	Type string
+	Name         string
+	Type         string
+	DefaultValue string
 }
 
 func parseSettings(buildFile string) ([]Setting, error) {
@@ -32,30 +33,38 @@ func parseSettings(buildFile string) ([]Setting, error) {
 	// Regex patterns to extract setting info
 	settingNameRegex := regexp.MustCompile(`setting_name = "([^"]+)"`)
 	settingTypeRegex := regexp.MustCompile(`setting_type = "([^"]+)"`)
-	
-	var currentName, currentType string
-	
+	settingValueRegex := regexp.MustCompile(`setting_value = "([^"]+)"`)
+
+	var currentName, currentType, currentValue string
+
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
-		
+
 		// Look for setting_name
 		if matches := settingNameRegex.FindStringSubmatch(line); matches != nil {
 			currentName = matches[1]
 		}
-		
+
 		// Look for setting_type
 		if matches := settingTypeRegex.FindStringSubmatch(line); matches != nil {
 			currentType = matches[1]
 		}
-		
+
+		// Look for setting_value
+		if matches := settingValueRegex.FindStringSubmatch(line); matches != nil {
+			currentValue = matches[1]
+		}
+
 		// When we hit the end of a scala_setting_library block, save the setting
 		if strings.Contains(line, ")") && currentName != "" && currentType != "" {
 			settings = append(settings, Setting{
-				Name: currentName,
-				Type: currentType,
+				Name:         currentName,
+				Type:         currentType,
+				DefaultValue: currentValue,
 			})
 			currentName = ""
 			currentType = ""
+			currentValue = ""
 		}
 	}
 	
@@ -92,6 +101,30 @@ func generateSettingsLoader(settings []Setting) string {
 	sb.WriteString("    case _ => throw NoSuchSettingException(key)\n")
 	sb.WriteString("  }\n\n")
 	
+	// Generate the getAllSettings method that returns current values and metadata
+	sb.WriteString("  case class SettingInfo(\n")
+	sb.WriteString("      name: String,\n")
+	sb.WriteString("      settingType: String,\n")
+	sb.WriteString("      currentValue: String,\n")
+	sb.WriteString("      defaultValue: String\n")
+	sb.WriteString("  )\n\n")
+
+	sb.WriteString("  def getAllSettings: Vector[SettingInfo] = Vector(\n")
+	for i, setting := range settings {
+		if setting.Type == "Int" {
+			sb.WriteString(fmt.Sprintf("    SettingInfo(\"%s\", \"Int\", %s.intValue.toString, \"%s\")",
+				setting.Name, setting.Name, setting.DefaultValue))
+		} else {
+			sb.WriteString(fmt.Sprintf("    SettingInfo(\"%s\", \"Double\", %s.doubleValue.toString, \"%s\")",
+				setting.Name, setting.Name, setting.DefaultValue))
+		}
+		if i < len(settings)-1 {
+			sb.WriteString(",")
+		}
+		sb.WriteString("\n")
+	}
+	sb.WriteString("  )\n\n")
+
 	// Add the rest of the class
 	sb.WriteString(`  case class SettingLine(
       key: String,

src/main/go/net/eagle0/jfr_server/BUILD.bazel

@@ -0,0 +1,25 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "jfr_server_lib",
+    srcs = ["jfr_server.go"],
+    importpath = "github.com/nolen777/eagle0/src/main/go/net/eagle0/jfr_server",
+    visibility = ["//visibility:private"],
+)
+
+go_binary(
+    name = "jfr_server",
+    embed = [":jfr_server_lib"],
+    pure = "on",
+    visibility = ["//visibility:public"],
+)
+
+# Linux x86_64 target for Docker deployment
+go_binary(
+    name = "jfr_server_linux_amd64",
+    embed = [":jfr_server_lib"],
+    goarch = "amd64",
+    goos = "linux",
+    pure = "on",
+    visibility = ["//visibility:public"],
+)

src/main/go/net/eagle0/jfr_server/jfr_server.go

@@ -0,0 +1,237 @@
+// Package main provides a simple HTTP server for JFR (Java Flight Recorder) control.
+// It runs as a sidecar container with shared PID namespace to access the Eagle JVM.
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const recordingName = "admin"
+
+var (
+	port       = flag.Int("port", 8081, "HTTP server port")
+	targetProc = flag.String("target", "eagle_server", "Target process name to find in jcmd output")
+)
+
+// StatusResponse is the JSON response for /status endpoint
+type StatusResponse struct {
+	Recording bool   `json:"recording"`
+	Details   string `json:"details,omitempty"`
+}
+
+func main() {
+	flag.Parse()
+
+	http.HandleFunc("/status", handleStatus)
+	http.HandleFunc("/start", handleStart)
+	http.HandleFunc("/stop", handleStop)
+	http.HandleFunc("/dump", handleDump)
+	http.HandleFunc("/health", handleHealth)
+
+	addr := fmt.Sprintf(":%d", *port)
+	log.Printf("JFR sidecar server starting on %s", addr)
+	log.Fatal(http.ListenAndServe(addr, nil))
+}
+
+func handleHealth(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte("ok"))
+}
+
+func handleStatus(w http.ResponseWriter, r *http.Request) {
+	log.Printf("JFR status requested from %s", r.RemoteAddr)
+
+	pid, err := findJvmPid()
+	if err != nil {
+		log.Printf("Error finding JVM PID: %v", err)
+		http.Error(w, fmt.Sprintf("Failed to find JVM: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	// Check JFR recording status
+	cmd := exec.Command("jcmd", strconv.Itoa(pid), "JFR.check")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Printf("jcmd JFR.check failed: %s - %v", output, err)
+		http.Error(w, fmt.Sprintf("jcmd failed: %s - %v", output, err), http.StatusInternalServerError)
+		return
+	}
+
+	outputStr := string(output)
+	log.Printf("JFR.check output: %s", outputStr)
+
+	// Check if our named recording is active
+	recording := strings.Contains(outputStr, fmt.Sprintf("name=%s", recordingName)) &&
+		strings.Contains(outputStr, "running")
+
+	resp := StatusResponse{
+		Recording: recording,
+		Details:   outputStr,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(resp)
+}
+
+func handleStart(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	log.Printf("JFR start requested from %s", r.RemoteAddr)
+
+	pid, err := findJvmPid()
+	if err != nil {
+		log.Printf("Error finding JVM PID: %v", err)
+		http.Error(w, fmt.Sprintf("Failed to find JVM: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	// Start JFR recording with profile settings
+	cmd := exec.Command("jcmd", strconv.Itoa(pid), "JFR.start",
+		fmt.Sprintf("name=%s", recordingName),
+		"settings=profile",
+		"maxage=1h",
+		"maxsize=100m")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Printf("jcmd JFR.start failed: %s - %v", output, err)
+		http.Error(w, fmt.Sprintf("jcmd failed: %s - %v", output, err), http.StatusInternalServerError)
+		return
+	}
+
+	log.Printf("JFR.start output: %s", output)
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(StatusResponse{Recording: true, Details: string(output)})
+}
+
+func handleStop(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	log.Printf("JFR stop requested from %s", r.RemoteAddr)
+
+	pid, err := findJvmPid()
+	if err != nil {
+		log.Printf("Error finding JVM PID: %v", err)
+		http.Error(w, fmt.Sprintf("Failed to find JVM: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	// Stop JFR recording
+	cmd := exec.Command("jcmd", strconv.Itoa(pid), "JFR.stop", fmt.Sprintf("name=%s", recordingName))
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Printf("jcmd JFR.stop failed: %s - %v", output, err)
+		http.Error(w, fmt.Sprintf("jcmd failed: %s - %v", output, err), http.StatusInternalServerError)
+		return
+	}
+
+	log.Printf("JFR.stop output: %s", output)
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(StatusResponse{Recording: false, Details: string(output)})
+}
+
+func handleDump(w http.ResponseWriter, r *http.Request) {
+	log.Printf("JFR dump requested from %s", r.RemoteAddr)
+
+	// Find the target JVM PID
+	pid, err := findJvmPid()
+	if err != nil {
+		log.Printf("Error finding JVM PID: %v", err)
+		http.Error(w, fmt.Sprintf("Failed to find JVM: %v", err), http.StatusInternalServerError)
+		return
+	}
+	log.Printf("Found target JVM at PID %d", pid)
+
+	// Generate filename with timestamp
+	timestamp := time.Now().Format("2006-01-02T15-04-05")
+	filename := fmt.Sprintf("profile-%s.jfr", timestamp)
+	tempPath := "/tmp/" + filename
+
+	// Run jcmd to dump JFR (use our named recording)
+	dumpCmd := exec.Command("jcmd", strconv.Itoa(pid), "JFR.dump",
+		fmt.Sprintf("name=%s", recordingName),
+		"filename="+tempPath)
+	output, err := dumpCmd.CombinedOutput()
+	if err != nil {
+		log.Printf("jcmd JFR.dump failed: %s - %v", output, err)
+		http.Error(w, fmt.Sprintf("jcmd failed: %s - %v", output, err), http.StatusInternalServerError)
+		return
+	}
+	log.Printf("JFR dump output: %s", output)
+
+	// Clean up temp file after we're done
+	defer os.Remove(tempPath)
+
+	// Read the file
+	data, err := os.ReadFile(tempPath)
+	if err != nil {
+		log.Printf("Failed to read JFR file: %v", err)
+		http.Error(w, fmt.Sprintf("Failed to read JFR file: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	log.Printf("Serving JFR file: %s (%d bytes)", filename, len(data))
+
+	// Serve as download
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s", filename))
+	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
+	w.Write(data)
+}
+
+// findJvmPid finds the PID of the target JVM process using jcmd -l
+func findJvmPid() (int, error) {
+	cmd := exec.Command("jcmd", "-l")
+	output, err := cmd.Output()
+	if err != nil {
+		return 0, fmt.Errorf("jcmd -l failed: %v", err)
+	}
+
+	// Parse jcmd output - format is "PID MainClass" per line
+	// Example: "1 net.eagle0.eagle.Main"
+	scanner := bufio.NewScanner(strings.NewReader(string(output)))
+	pidRegex := regexp.MustCompile(`^(\d+)\s+(.*)$`)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		matches := pidRegex.FindStringSubmatch(line)
+		if len(matches) == 3 {
+			pid, _ := strconv.Atoi(matches[1])
+			mainClass := matches[2]
+
+			// Skip jcmd itself
+			if strings.Contains(mainClass, "jcmd") || mainClass == "jdk.jcmd/sun.tools.jcmd.JCmd" {
+				continue
+			}
+
+			// Look for our target process
+			if strings.Contains(mainClass, *targetProc) || strings.Contains(mainClass, "eagle") {
+				return pid, nil
+			}
+
+			// If there's only one non-jcmd JVM, use it (likely PID 1 in container)
+			if pid == 1 {
+				return pid, nil
+			}
+		}
+	}
+
+	// Default to PID 1 if nothing else found (common in containers with shared PID namespace)
+	return 1, nil
+}

src/main/protobuf/net/eagle0/common/shardok_internal_interface.proto

@@ -21,15 +21,12 @@ option java_outer_classname = "EagleInterface";
 option objc_class_prefix = "E0G";
 
 service ShardokInternalInterface {
-    // Server-side streaming for game updates - replaces polling via GetGameStatus
+    // Server-side streaming for game updates
     rpc SubscribeToGame(GameSubscriptionRequest) returns (stream GameStatusResponse) {}
 
     rpc PostCommand(PostCommandRequest) returns (GameStatusResponse) {}
     rpc PostPlacementCommands(PlacementCommandsRequest) returns (GameStatusResponse) {}
 
-    // Deprecated: Use SubscribeToGame for streaming updates instead
-    rpc GetGameStatus(GameStatusRequest) returns (GameStatusResponse) {}
-
     rpc GetHexMap(HexMapRequest) returns (HexMapResponse) {}
     rpc GetHexMapNames(HexMapNamesRequest) returns (HexMapNamesResponse) {}
 }
@@ -58,11 +55,6 @@ message PlacementCommandsRequest {
     GameSetupInfo game_setup_info = 6;
 }
 
-message GameStatusRequest {
-    string game_id = 1;
-    GameSetupInfo game_setup_info = 2;
-}
-
 message GameStatusResponse {
     string game_id = 1;
 

src/main/protobuf/net/eagle0/eagle/api/BUILD.bazel

@@ -3,6 +3,22 @@ load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_scala//scala_proto:scala_proto.bzl", "scala_proto_library")
 
+# Auth service for OAuth login
+scala_proto_library(
+    name = "auth_scala_grpc",
+    visibility = [
+        "//src/main/scala/net/eagle0:__subpackages__",
+        "//src/test/scala/net/eagle0/eagle:__subpackages__",
+    ],
+    deps = [":auth_grpc"],
+)
+
+proto_library(
+    name = "auth_grpc",
+    srcs = ["auth.proto"],
+    visibility = ["//visibility:public"],
+)
+
 scala_proto_library(
     name = "eagle_scala_grpc",
     visibility = [
@@ -242,6 +258,7 @@ go_proto_library(
     compilers = ["@io_bazel_rules_go//proto:go_grpc"],  # keep
     importpath = "github.com/nolen777/eagle0/src/main/protobuf/net/eagle0/eagle/api/eagle",  # keep
     protos = [
+        ":auth_grpc",
         ":available_command_proto",
         ":command_proto",
         ":eagle_grpc",