Fresh games now begin with the documented turn-1 Research Points. v0.41.9 claimed to fix initial RP but only addressed the per-turn accrual being undefined in MP. Players were still starting turn 1 at 0 RP in both single-player and multiplayer because nothing seeded the v0.30.0 starter pool (5 base + 2 per city + 1 per FAB). v0.41.12 adds an explicit seed at start-of-play in both code paths — the Tech Tree is now actually usable from turn 1 as the design intends.

• SP fix: startGame() now seeds RP after MAP_LAYOUT structure HP setup, when tile ownership is finalized.
• MP fix: mpFinalizePvPStart() seeds RP after the per-client owner remap, so each player gets the correct seed for their own faction holdings.
• Idempotent: a mid-game reconnect won't double-seed, and a second game in the same session re-seeds correctly.

Three multiplayer bugs fixed in one hotfix. Returning to the home screen after an MP match no longer leaves all the panel buttons silently dead. Your opponent's actions now show up in the combat log. And the host no longer absorbs the opponent's losses into their own stats — kills, losses, damage and captures are now correctly attributed per player.

• Bug 1 — Post-MP home buttons fixed. mpShowLobby hides home panels with inline display:none; the cleanup only ran when the user explicitly left the lobby. Coming home from a finished match skipped it, so the inline style stuck and beat the .home-panel.active CSS rule. showHomeScreen now resets those styles on every entry.
• Bug 2 — Opponent actions logged. mpApplyOpponentAction now emits a combat-log entry for attacks (with damage and kills), captures, builds, barrages, airdrops, nuclear strikes, smoke screens, and unit production.
• Bug 3 — Personal stats fixed. Stat tracking now keys on unit.owner === 'player' instead of isHumanSlot(), which returned true for every human in MP and caused the host to absorb the opponent's losses (Megagam3 jumped 36 → 81 KIA after one MP loss). Applied to attack, counter-attack, and capture sites.
• Bug 4 — Megagam3 stats restored. One-off SQL fixup reset units_lost from 81 → 37.

Single-player games now appear on the admin dashboard. v0.41.3 fixed presence tracking and the Active Games count, but the games listing was still multiplayer-only — finish an SP game and the dashboard didn't show it. v0.41.4 adds a dedicated Recent Single-Player Games section pulled from game_history, plus updates the top-line counters so Games Today and Avg Game Length sum SP and MP.

• New section: Recent Single-Player Games shows player, result, faction matchup, difficulty, turns, kills/losses, and timing.
• Games Today now sums multiplayer_games (24h) + game_history (24h).
• Avg Game Length is now a weighted average across SP and MP. SP duration is approximated as turns × 60s since SP doesn't track started_at.
• New endpoint: GET /api/admin/dashboard/sp-games?limit=30. Filters out backend users.
• Existing MP table renamed to "Active & Recent Multiplayer Games" so the two are unambiguous.

The admin dashboard now counts single-player activity. Before v0.41.3, presence tracking was wired entirely to the multiplayer socket — anyone in a solo game showed as "0 players online" and SP games were invisible to the Active Games card. Now the client posts a small heartbeat to /api/sessions/heartbeat every 30 seconds with a kind field (sp / mp / lobby / idle), and the dashboard sums distinct SP players into the unified Active Games count.

• New REST heartbeat: POST /api/sessions/heartbeat with { kind }. Authenticated. Best-effort; never blocks gameplay.
• New player_sessions.session_kind column. Distinguishes SP / MP / lobby / idle without adding a parallel table.
• Active Games card now shows SP + MP combined, with the split visible in the sub-text (SP: 1 · MP: 0).
• Players Online table renders a colored activity tag per row so admins can see at a glance who's in SP vs MP vs the lobby.
• Migration: migrate_v0_41_3_session_kind.js --apply adds the column + index. Idempotent.

The Admin account no longer shows up anywhere in-game. Adding admin privileges in v0.41.1 was a backend-only need (so I could sign into the dashboard without using a real player account), but is_admin = TRUE alone wasn't a filter — the Admin user was leaking into Personnel Dossiers and the leaderboards. v0.41.2 adds a dedicated is_backend_user flag and applies it as a hard filter across every user-facing rollup, plus updates create_admin_user.js so future admin accounts are invisible-in-game by default.

• New users.is_backend_user column (BOOLEAN, default FALSE). Safe to redeploy — ALTER TABLE IF NOT EXISTS.
• Filter applied to: /api/stats/dossiers, /api/stats/leaderboard, /api/stats/ranked/leaderboard, /api/stats/ranked/individual, and the battalion-roster subquery in /api/stats/ranked/battalion/:id.
• create_admin_user.js now sets is_backend_user = TRUE + profile_public = FALSE on every upsert. Creating or resetting an admin produces a fully hidden account out of the box.
• Migration script: migrate_v0_41_2_backend_user.js --apply ensures the column exists and back-fills the existing Admin user. Idempotent and refuses to flag non-admin users.
• Dashboard untouched: the admin dashboard's online-players list still shows everyone signed in, including admins — that's the whole point of an ops view.

The admin dashboard at /dashboard.html now has its own sign-in form. Before v0.41.1, hitting that URL while logged-out showed a generic error and required bouncing through the main site to authenticate. Now the dashboard probes /api/auth/me on load; if you're not signed in, it hides the panels and shows a callsign + password form. The form posts to the existing /api/auth/login endpoint and re-runs the dashboard load on success.

• Sign-in form with callsign + password fields. Errors render inline.
• Auth-state aware: 401 shows the form, 403 shows "signed in but not admin", 200 shows live dashboard.
• Header chip shows the signed-in callsign and a Sign Out button. Sign Out clears the session and returns to the sign-in form.
• Auto-refresh interval pauses when signed out so the page stops spamming 401s.

New admin-gated dashboard with live game metrics. Visit /dashboard.html (admin-flagged accounts only) for a real-time view of active games, online players, today's activity, faction popularity, and a filterable event log. Auto-refreshes every 10 seconds. Backed by two new tables (server_events + player_sessions) and a logEvent() helper hooked into every key code path.

• Top-line metric cards: active games, players online, games today, total users, avg game duration (last 7 days), errors in last 24 hours.
• Online players list: currently-connected users via socket presence. Heartbeat pings every 30s; users drop off after 90s of silence.
• Active & recent games table: room codes, status badges, players (with AI tags), map size + type, victory mode, winner.
• Faction popularity: bar chart of pick counts + win rate per faction over the last 30 days.
• Event log: structured events filterable by severity (info / warn / error / debug) and event type (e.g. auth., mp., error.). Last 100 events shown, auto-refreshing.
• Hooks landed at: auth.login, auth.register, auth.logout, auth.steam-login, mp.game-created, mp.game-ended, mp.socket-connected, mp.socket-disconnected, plus error.500 catch-alls in MP routes.
• 30-day retention on the event log; auto-pruned daily. Player sessions kept indefinitely (small footprint).

The Service Record summary was showing E-9 (Sergeant Major) for every player past 35,000 XP, even when they'd qualified for Warrant Officer or Commissioned Officer ranks. Root cause: getRankForPlayer() read condition values via stats[key] where the rank-condition key is wins, but the actual player_stats column is games_won. Every wins-gated rank silently failed its condition check and the loop fell through to E-9 (last rank without a condition). The Dossiers route already aliased this manually at its call site — that's why dossier rows showed the correct rank but the Service Record didn't.

• Server fix: getRankForPlayer() now maps wins → games_won internally. Defensive lookup tries the canonical column first, falls back to the literal condition key — so callers that already alias (the Dossiers route) keep working.
• Rank Progression list polish: previously the list marked "achieved" purely by XP, so 92K XP would show green checks all the way to W-3 even if you hadn't met the 10-hard-wins condition. Now derived from the rank's index relative to the server's resolved current rank — monotonic and consistent with the summary at the top.

Two MP lobby fixes shipped together. AI slots no longer render as "Waiting for player..." — they show up filled with AI difficulty visible, host-controlled faction (with a Random option), and host-controlled team. The MP Theater of Operations now has the Terrain Density selector that single-player has had since v0.31.4 — same Low/Medium/High control driving the same terrain generator that v0.31.26 made themed maps respect.

• AI slot rendering. Slots marked AI in the create-game form show "AI · DIFFICULTY" in the lobby, not "Waiting for player...". Steam-blue tint distinguishes them from human slots.
• Host-controlled faction. Each AI slot has a "Select Faction" button (host-only). Opens the existing faction picker; a new "Random" tile at the top of the grid rolls a uniform pick. Click "Change Faction" → "Random" again to re-roll.
• Host-controlled team. Click an AI slot's team badge to cycle 0 → 1 → 2 → 3 → 4 → 0. AI slots now participate in 2v2/3v1/etc. team configs.
• Server mp:select-faction + mp:select-team accept an optional forSlot parameter. Authorized only when the requester is the host (player1) AND the target slot is AI. Other clients are unaffected.
• Theater of Operations: Terrain Density matches the single-player UI — Low / Medium / High buttons. Sent to the server on create, persisted on multiplayer_games.terrain_density, applied to gameState.terrainDensity before initMap runs, so every map generator (standard + the six themed ones) respects the host's pick.

Quick Match was failing for everyone with a generic "Failed to join queue" error. The queue-join endpoint was querying users.elo_lifetime, but that column lives on player_stats — the SELECT crashed with SQLSTATE 42703 ('column elo_lifetime of relation users does not exist') on every attempt, and the catch-all returned a generic 500 that hid the real cause.

• Fixed query: LEFT JOIN player_stats ps ON ps.user_id = u.id with COALESCE(ps.elo_lifetime, 1000) so brand-new accounts (no player_stats row yet) default to ELO 1000 instead of crashing.
• Surface error details: the catch-all in /quickmatch/join now returns err.message, err.code (Postgres SQLSTATE), and err.detail — same diagnostic pattern shipped for /api/auth/steam-login in v0.31.22. Future bugs surface in one launch instead of needing a pm2 log dive.

Closes the v0.40.0 known limitation. The rule that ranked multiplayer games must be all-human is now enforced server-side, not just advisory. The Quick Match matchmaker has always sent all-human compositions, so no live ranked games were affected — the fix prevents a hand-crafted API request from creating a ranked game with an AI slot, which would have let players farm ELO against deterministic computer opponents.

• Server check: /api/multiplayer/create rejects requests where isRanked: true is paired with any AI slot in slotConfig. Returns 400 with: "Ranked games must be all-human. Either turn off Ranked or set every slot to Human."
• No UI change required. The lobby form has no Ranked toggle (only Quick Match creates ranked games, and that path always sends all-human compositions). The guard is hardening, not new UX.
• Backward-compatible: every v0.40.0 ranked game already passes the new check.

Multiplayer games now support mixed human/AI compositions. When you create a 3-4 player game, you can mark each non-host slot as Human (waits for a player to join) or AI (filled at create time, plays automatically). Minimum two humans is enforced — host plus at least one other. AI slots use the same engine the single-player game uses, including difficulty.

• Slot Composition section in the lobby create-game form. Visible for 3-4 player games. Per-slot Human/AI toggle, plus difficulty (Easy/Medium/Hard) for AI slots.
• Min-2-humans rule. Validated client-side (clear in-form message) and server-side (400 on /api/multiplayer/create with an actionable error). Single-player MP-vs-AI is not supported — that's what the regular single-player mode is for.
• AI slots pre-filled. They don't wait for a join. The room moves to faction_select as soon as all human slots are filled.
• AI slots can't be joined by other humans — the join endpoint skips them. If only AI seats remain in a room, a join attempt gets a clear "all human seats are taken or filled by AI" error.
• Host drives all AI turns. When the active turn is an AI slot, the host's client runs runAiSlotTurn() locally (re-using the single-player multi-AI engine). Each AI move is broadcast through the existing mp:action-applied pipeline, so non-host clients see the AI's moves in real time without any new transport.
• Double-apply prevention. The host's own broadcast echoes are filtered via a new senderRole field on mp:action-applied — so the host doesn't apply its own AI moves twice (once when running, once when receiving the broadcast).
• Schema additions. Per-slot player[1-4]_type and per-AI-slot player[2-4]_ai_difficulty columns on multiplayer_games. Default 'human' so existing rows behave exactly like v0.31.x games.

You can now choose what happens when HexArmy is launched via Steam. A new profile-panel section between Public Dossier and Security has two radio options. The default is Automatically use Steam account (current behavior — Steam ticket auto-links to your account). The alternative, Use custom login, shows the manual login form on every Steam launch so you sign in with your callsign and password instead.

• Default: "Automatically use Steam account". Steam ticket → auto-link → signed in. No change for anyone who's been happy with how it works today.
• Alternative: "Use custom login". Steam launch shows the manual login form. The form's existing Steam-detected banner still works — signing in this way still links your Steam profile to the account you log into, if it wasn't already.
• Custom-mode sub-option: "Automatically sign-in". When ON, your session cookie persists across launches so you don't have to re-enter credentials every time. When OFF, the session is cleared on every Steam launch so you're always prompted.
• Per-machine setting. Stored in localStorage. Auto on your PC, custom on a shared laptop, etc. — no server roundtrip required.
• When useful: shared machines where the Steam profile and the HexArmy account shouldn't be coupled, or HexArmy accounts you want to keep deliberately separate from the Steam identity that's running the game.

Buying a research level now upgrades your entire army, not just future production. Until v0.31.29, Tech Tree purchases baked their stat deltas into units only at spawn time — so paying RP for Armor L1 (+1 ATK tank) only affected tanks you produced AFTER the purchase. The four tanks already on the field kept their old ATK, despite the cost being identical and the description making no mention of the limitation.

• What now applies retroactively: all simple stat deltas — atk, def, hp, maxHp, mov, acc, dge, range, vision. Examples: Infantry L1 (+1 ATK Infantry), Infantry L2 (+2 HP Infantry), Armor L1 (+2 DEF Tank), Air L1 (+1 MOV jet/heli), Naval L1 (+3 HP destroyer/aa_ship), etc.
• If a research level grants +1 MOV: the affected units' movRemaining for the current turn is also bumped (capped at the new max), so they can use the extra movement immediately rather than waiting until next turn.
• Combat-time effects (e.g. ACC vs adjacent enemies, DEF when adjacent to friendly Infantry, the Air L6 Stealth Bomber capstone) were already applied dynamically to existing units and are unchanged.
• Comms log now reports how many existing units received the upgrade: "Research: Armor Doctrine L1 — Field Drill: +1 ATK on Tanks — applied to 4 existing units".

NK artillery now keeps its full base MOV, matching the doctrine description. The North Korea weakness card reads "Non-Inf/Art -1 MOV" — meaning infantry and artillery are exempt from the movement penalty. Behind the scenes the modifier is even named nonInfantryArtilleryMovPenalty to make the exemption obvious. But the artillery-specific branch of applyFactionModifiersToUnit() contained a stray application of that modifier, hitting artillery for -1 MOV in direct contradiction of the modifier's name and the on-card text.

• Removed: the duplicate nonInfantryArtilleryMovPenalty application inside if (type === 'artillery').
• Effect: Koksan and any other NK artillery unit now move at base MOV. Tanks, recon, helicopters, jets, AA, engineers, ships, etc. still take the -1, which is correct per the doctrine.
• Infantry was already correctly exempt — behavior unchanged for infantry.

An AA-shot-down helicopter no longer gets a free attack on the way down. Reported case: an AI Apache moved into the player's airspace, the player's Pantsir reaction-fired for -17 damage (lethal), and the comms log still showed the dead Apache hitting the player's Razvedchik on the very next line. Root cause: doAttack() and attackCity() checked attacker.attacked and attacker.movRemaining but never checked attacker.hp > 0. The AI's move-then-attack flow runs checkAAReaction() (which can lethally damage the moving air unit) and then unconditionally fell through to the attack call.

• Single-line guards at the top of both combat functions. A killed unit (hp <= 0) silently fails to resolve its attack instead of completing it. Defense in depth — the bug can't recur from any caller, including future flows we haven't written yet.
• Most visible effect: air units shot down by AA reaction fire no longer score a hit before being removed from the board.
• Side benefit: any future "opportunity fire" or "trap" mechanic that kills the attacker mid-action also benefits from the guard for free.

The Terrain Density slider does what it says on every map type now. Until v0.31.26, the Low/Medium/High setting was silently ignored by every themed map generator — Continents, Archipelago, Pangea, Highlands, Forest Basin, and River Networks. Forest and mountain counts were hardcoded; only the Standard generator honored the slider. And because themed map types are only selectable on maps 400+ tiles, the slider appeared to do nothing on Medium, Large, Max, Huge, and Epic maps whenever a non-Standard type was picked.

• What scales now: forest clusters and forest scattered fill, mountain peaks and Highland plateaus, Highland lakes, Forest Basin ponds, River Networks junction lakes — all in every themed generator.
• What still doesn't scale (intentionally): structural water that defines a theme — Continent oceans, Archipelago seas, Pangean coastline — plus Highland mountain ranges and the river network in River Networks. These stay fixed so a Continents map at Low density still looks like Continents and not like Pangea.
• Desert Wastes is unchanged because it has no forest/mountain/water by design.
• Refactored: the Standard generator's inline density-multiplier is now a shared _terrainDensityMul() helper used by every generator. Easier to verify and tweak in one place.

Steam linkage now visible at a glance on the home screen. The callsign panel shows a "STEAM LINKED" pill (with your Steam persona) directly under the XP bar when your account is linked. If it isn't, a "Link to Steam" button appears whenever Steam is running — one click connects the two profiles without needing to sign out and back in.

• Linked state. Shows "STEAM LINKED as <persona>" in a Steam-blue pill.
• Unlinked + Steam available. Shows a "Link to Steam" button. Click → grabs a fresh Steam auth ticket → POSTs to /api/auth/steam-link-current → server links steam_id onto your existing account in a single transaction. Throwaway accounts (the Nechtan_0546-style auto-creates) are merged + deleted as part of the same operation.
• Unlinked + no Steam. Shows a small "Steam Not Detected — Launch via Steam to Link" hint instead of a button that couldn't work. Browser players see this; Steam players see the button.
• New endpoint. POST /api/auth/steam-link-current requires authenticated session + Steam ticket. No password re-prompt — session establishes account ownership, ticket establishes Steam ownership, and linking doesn't set a new credential.
• Idempotent. Clicking when already linked refreshes persona/avatar (in case you renamed yourself on Steam) but doesn't change anything else.
• Refuses to overwrite. If your HexArmy account is somehow already linked to a different Steam profile, returns 409 with a clear message rather than clobbering.

Personnel Dossiers and Ribbon Bars are now visible by default. Until v0.31.24, manually-registered accounts started with profile_public = FALSE — you had to find the toggle in account settings to appear in the Dossiers tab or to share your Service Record in multiplayer lobbies. Steam-registered accounts always defaulted to public; this brings the manual-registration path in line. The opt-out toggle still works exactly the same; this only changes the default starting state.

• New accounts. /api/auth/register now sets profile_public = TRUE on the INSERT. No extra click required after sign-up — you appear in Dossiers immediately.
• Existing accounts. A one-shot migration (scripts/flip_profile_public.js) flips every existing FALSE/NULL row to TRUE in a single transaction. Inspect-first/apply-second pattern with row counts before and after, same shape as the Steam merge tooling.
• Schema default. db/init.js column default flipped from FALSE to TRUE so fresh deploys come up with the right default without needing the migration.
• Opt-out still works. The Public Dossier checkbox in account settings flips the flag back off any time. The migration is a default-reset, not a permanent override.

Self-service Steam linking. If your first Steam launch landed you on a throwaway numbered account (e.g. Nechtan_0546) because your original callsign was already taken, you can now sign in to your real account from the manual login form and HexArmy will permanently link your Steam profile to it. No more support tickets or SQL surgery for the migration case.

• Login form auto-detects Steam. A blue banner appears above "Returning Operator" when Steam is running, explaining that signing in will link the Steam profile to your existing HexArmy account.
• New endpoint /api/auth/steam-link. Validates the Steam ticket against Valve and your callsign + password against the database in the same request, then transactionally links the steam_id onto your existing account.
• Self-healing for the throwaway case. If steam-login already auto-created a throwaway account for your Steam ID (the typical situation right now), the link operation transfers the steam_* columns onto your real account and deletes the throwaway in one atomic transaction. ON DELETE CASCADE handles its player_stats etc.
• Idempotent. If your account is already linked to the same Steam profile, the request just establishes a session — no DB write.
• Refuses to overwrite. If your HexArmy account is already linked to a different Steam profile, the request is rejected with 409 instead of clobbering.
• Fully transactional. If anything fails (ticket rejection, FK violation, anything), the transaction is rolled back and nothing is changed.

Diagnostic patch. After v0.31.21 fixed the wrong Valve API host, Steam auto-login moved past Valve and started failing with a generic 500 Server error during Steam login instead. The catch-all in /api/auth/steam-login was swallowing the actual error from the DB upsert / session-establishment path, forcing a server-side log dive every time. v0.31.22 surfaces err.message, err.code (Postgres SQLSTATE), err.detail, and err.where in both the server log and the JSON response, and the client autoLogin warning prints all four. The next Steam launch will name the failing column, constraint, or middleware directly in F12.

• Server 500 catch-all now returns { error, message, code, detail, where } instead of just { error }. Truncates message/detail to 300 chars and where to 200 chars to keep payloads bounded.
• Client autoLogin warning prints all four diagnostic fields so F12 alone identifies the failure point — no pm2 log round-trip needed for the next attempt.
• No success-path changes. Only the unexpected-error branch is more verbose.
• Known limitation: this release is purely diagnostic and does NOT fix the underlying 500. Once the next Steam launch reports the specific message/code, a follow-up patch addresses the root cause.

Steam auto-login is fixed. Server-only patch. The ticket validation URL was hitting Valve's Steamworks Partner API host (partner.steam-api.com), which requires a publisher API key. Our STEAM_WEB_API_KEY is a standard Web API key (the kind you get from steamcommunity.com/dev/apikey) — valid, but rejected by the partner endpoint. Valve returned non-2xx, the server's catch-all mapped that to "502 Steam authentication service unavailable", every Steam-launched client saw the manual login screen.

• Switched the validation URL from partner.steam-api.com to api.steampowered.com — same path, public host that accepts Web API keys.
• Server now logs the actual Valve response body on validation failures. Previously just the status code — now you see the actual error text, so future host/key issues are diagnosable in one pass.
• No client rebuild needed. Just deploy the updated server route + restart pm2.
• The diagnostic patches (v0.31.19 F12 + v0.31.20 per-step logs) earned their cost in 24 hours. The user's first new console capture pinpointed the failure end-to-end. Without F12 and per-step logs, this would still be a guessing game.

Diagnostic patch. Steam auto-login was failing silently — F12 console showed only [STEAM] Ready. Persona: <name> with no follow-up explaining why the chain didn't continue. HexSteam.getAuthTicket was swallowing every Steamworks error (catch (_) { return null; }) and autoLogin had no per-step logging. This patch adds explicit logs at every decision point so the next failed launch produces an actionable trace. No behavior change — only diagnostic output.

• getAuthTicket now logs the actual Steamworks error before returning null instead of fully swallowing it. Logs the result type and length so 'returned null' vs 'returned empty string' vs 'returned a real hex ticket' is distinguishable.
• autoLogin logs every step: starting, ticket length, POST URL+persona, response status, JSON parse failures, rejection vs success.
• Followup target: once the new logs surface the actual root cause, the underlying fix ships as v0.31.21.

F12 silently doing nothing in Steam-launched builds is fixed. Tauri 2 strips the WebView inspector entirely from release builds by default unless you explicitly opt in via the devtools Cargo feature flag. We weren't opting in, so F12 was a no-op in every shipped build. With this patch, F12 (and right-click → Inspect) open the inspector in any Steam-launched copy.

• F12 opens the WebView inspector in Steam-launched (release) builds.
• Right-click → Inspect Element also works.
• All console logs visible: [STEAM], [STATS], [API], [AI] — useful for debugging end-of-game stat issues, MP lobby, Steam autoLogin diagnosis, etc.
• Network tab available for inspecting API calls in flight.

Reason for the trade-off (small binary size + players can inspect HTML/JS): every future "this doesn't work in Steam" bug now becomes diagnosable in 30 seconds instead of requiring a multi-step server-side investigation. Devtools-in-release is the standard for any Tauri app expected to ever debug shipped builds.

Steam launches were silently dropping into the manual login screen. The multiplayer lobby was refusing entry. Same root cause for both: the server's require('dotenv').config() call was looking for the .env file in the wrong directory (process cwd, not the server's own directory). STEAM_WEB_API_KEY ended up undefined in the running process; /api/auth/steam-login returned 500 to every client; Steam autoLogin failed silently; you saw the login screen and the lobby couldn't authenticate you.

• One-line server-side fix — pinned the dotenv path explicitly to the .env next to server.js, so it works regardless of which directory pm2 was started from.
• Steam auto-login works again. No manual login screen on Steam launches.
• MP lobby reachable again (the lobby gate needed an authenticated session — which Steam auto-login was failing to produce).
• No client rebuild needed. Server-only change. Just deploy src/server.js + restart pm2.

If you've been seeing the login screen on Steam launches over the last few days — that's done. The Steam autoLogin flow has been correct in code for releases; the dotenv path was just looking in the wrong place.

Two real bugs surfaced by the v0.31.16 tutorial accuracy audit, both fixed. Plus a documentation correction to the in-game Field Manual and the public tutorial page that had been quietly inaccurate for releases.

• Artillery suppression now actually works. The Field Manual has documented since release that artillery hits suppress survivors (−1 MOV next turn, cannot counter-attack). The suppressed flag was read in the counter-attack guard but never set anywhere — the mechanic was a Field Manual fiction. Now applied: artillery hits AND Barrage ultimate hits both flag survivors as suppressed, −1 MOV applied at the suppressed unit's next turn, flag cleared at end of that turn.
• Advance-on-kill onto a neutral structure now captures it. A melee unit that killed a defender on a neutral city/HQ would advance onto the tile but the city stayed neutral — the capture branch required hp ≤ 0, which excluded full-HP neutrals. Now captures neutrals AND empty-HP enemy structures, mirroring the moveUnit walk-on capture rule. Capturing unit also gets promotion-progress credit.
• Flanking description corrected. The Field Manual and tutorial pages had been claiming the defender's facing updates with attacks/advances and that pinning forces the defender to face the pinning unit. Neither is true — the flank calc uses each defender's HQ position as a fixed facing reference. Both pages rewritten to accurately describe the mechanic.

If your artillery has felt weirdly underwhelming — counters were ignoring suppression, MOV reductions weren't applying. That's done. The Field Manual has been telling you about a feature that didn't exist; now it does.

New Field Academy page on the marketing site. A structured ~15-minute walkthrough that takes a brand-new player from "I just installed it" to "I won my first match." Twelve numbered missions plus a ten-tip cheat sheet, with all numbers, terrain values, faction budgets, capture rules, and combat formulas sourced from the canonical Field Manual rather than guessed.

• Mission 01–04 — match setup (the real menu: faction picker, AI count and per-slot difficulty, map size, map type, terrain density, victory condition, map lock), reading the hex map (real DEF/dodge values: Plains +0/+0, Forest +2/+10, Mountain +3/+0, City +3/+5, HQ +4/+5, plus a movement-cost table showing tanks are impassable in forest/mountain), the draft phase (faction budgets 850–1,020g, 6/7/8 unit caps), and placement (within 2 hexes of any owned HQ or city).
• Mission 05–07 — the move-then-attack rule and its two exceptions (Tank Blitz, Assault Veteran Infantry), real combat math (Hit% formula, damage formula with current-HP scaling, flank multipliers 1.0x/1.25x/1.5x/Iran 1.75x, counter-attacks only on melee at 50% ATK, suppression mechanics, advance-after-kill), and the combined-arms role table with effectiveness multipliers (Heli vs Tank 1.7x, AA vs Jet 2.5x, Infantry vs Tank 0.25x, etc.).
• Mission 08–11 — capture rules (neutral = walk-on instant, enemy = HP must be reduced to 0 first, air units cannot capture), the five structure types (HQ 150g/turn, City 100g/turn, FOB/FAB/Port), engineer camps (engineer is consumed on construction), garrisons (City 525g, HQ 800g), fog of war with real vision values (Scout 5, Recon 4, Heli 4, default 2), promotions with real OR-gated thresholds (2 kills / 8 kills / 16 kills with combats-survived and captures alternates), Commander aura rules and the one-per-class-per-side limit, and all five victory conditions (HQ Takeover, Military Annihilation, Complete Domination, Infantry Only, 20 Turn Survival).
• Quick-tips block — ten one-liner habits sourced from real mechanics: read the damage preview because damage scales with HP, save 1 MP for the punch (move-then-attack), tanks cannot enter forest/mountain, pin-and-flank, mortars need a Recon spotter, artillery must deploy before firing, engineers are consumed when building camps, etc.
• Wired into nav and footers — new "Tutorial" link added to the index nav, the home footer, the features-page footer, and this release-notes footer.

Marketing-only release. No game-engine changes. Initial draft of this page was rewritten end-to-end after a code-grounded factual audit — first version was authored without consulting the Field Manual and contained substantial inaccuracies; this released version is sourced from HexArmy_Field_Manual_v0.20.20.pdf.

Audited all 598 unit and HQ sprites for proper transparent backgrounds. Found five problems — four subtle, one obvious. All fixed.

• AA Ship non-directional sprites (4 team colors) — were stored as RGB without an alpha channel and rendered with solid gray/white backdrops in the selected-unit panel, draft preview, production menu, and minimap. Fixed by replacing them with copies of their `_d2` directional variants, which were correctly RGBA-transparent.
• New Zealand HQ sprite — was RGBA-mode but every single pixel was opaque. The building rendered with a 300x300 white square around it instead of being cut out from the terrain like the other 9 HQs. Fixed by flood-filling the white background from the four corners with a tolerance, preserving any white elements of the building itself.
• All 598 sprites verified. Every PNG now has an alpha channel and at least some transparent pixels.

If your AA Ships have looked subtly off in production cards or your NZ HQ has had an awkward white halo — that's done.

Two follow-ups from v0.31.13 land here. AI engineers now know how to use the repair action they were granted last patch — if they're sitting next to a damaged owned city/HQ/camp and can't build a camp from where they are, they patch it up instead of moving past it. And the Engineering Tech Tree's L1 node (Sapper Drill, +10% engineer repair) now actually applies to the player's repair rate — until now it was a Tech Tree node with no in-game effect.

• AI engineer fallback — Medium and Hard AI engineers auto-repair the most-damaged adjacent owned structure when they can't build a camp from their current tile.
• 15% damage threshold — AI doesn't waste a turn fixing a 5% scratch when there's offensive value to be had.
• Sapper Drill (Engineering L1, +10%) now stacks on the faction base rate — Canada engineer + Sapper Drill = 50% repair per action; USA + Sapper = 30%; Russia + Sapper = 25%; default + Sapper = 30%.
• Generic research-delta accessor added so future research effects with numeric deltas (Field Medic +1 heal, Logistics structure self-repair, etc.) plug in cleanly when their resolver hooks land.

Easy-difficulty AI engineers still don't repair, matching the existing easy-no-engineer-camps policy. AI tech-spending is the next major Tech Tree milestone.

Engineers can finally repair damaged owned cities and structures. The Field Manual has been describing this for releases ("Engineers also repair owned cities — 20% per action; Canada: 40%") but the action button was never actually wired up. The engineerRepairRate modifier on USA / Canada / Russia was set, displayed in the bonus list, but did nothing. Closing that gap.

• Repair action — appears on the engineer's action bar when they're on or adjacent to an owned damaged structure (City / HQ / FOB / FAB / Port).
• Single target — one click repairs.
• Multiple targets — valid structures glow gold; click the one to repair.
• Repair amount: -20% damage by default (USA), -40% Canada (highest in the game), -15% Russia.
• Engineer survives the repair (unlike camp construction, which sacrifices the unit). The engineer's MOV and ATK are spent for the turn, but they can repair again next turn.
• PvP synced — the action broadcasts to the opponent so both clients see the same damage value.

If you've been losing income on a half-damaged HQ for ten turns — that's no longer just on you. Walk an engineer over.

Walked every faction's bonuses and penalties end-to-end. Most were correctly applied. Five real bugs found in cost calc, ultimate cooldowns, and Iran's air penalties — each one had the modifier set in the FACTIONS table and shown in the bonus/penalty list, but the runtime code wasn't actually reading it.

• Canada — +20% jet/heli cost penalty now actually applied. The cost calc handled the same penalty under two other names (airCostIncrease, jetCostIncrease) but missed Canada's third synonym.
• China — -10% production cost is now actually applied at city production for both player and AI. Previously the bonus list bragged about it; the production code didn't read it.
• UK — Engineer Fortify cooldown is now 4 (was running at 5 like every other faction).
• China — Recon Deep Scan cooldown is now 2 (was running at 3). Same root cause as UK.
• Iran — Jet -10 ACC penalty now applies once to jets (was double-applied) and not at all to helicopters (was leaking onto them).
• Iran — Jet -2 HP penalty no longer leaks onto helicopters.
• Cleanup — removed a typo in createUnit (jetHeliDgePenalty → the actual modifier is heliJetDgePenalty, already handled elsewhere).

If your last few games against China felt suspiciously hard — you weren't imagining it. Their economy was supposed to have a 10% production discount that wasn't actually firing. Now it is.

Walked all 19 unit ultimates end-to-end. Most worked correctly. Four real bugs found and fixed. One cosmetic description mismatch corrected.

• Engineer Fortify — was fortifying the player's hovered hex (or nothing for AI engineers). Now correctly fortifies the engineer's current hex, matching the Field Manual.
• Submarine Dive (single-player) — was lasting 1 turn instead of the documented 2 because the duration counter was being decremented twice per turn cycle. Subs now stay down the full duration.
• Submarine Dive (multiplayer) — was even worse: subs never surfaced because the MP turn cleanup never cleared the submerged flag. Fixed.
• AA Ship Missile Salvo — the "guaranteed hit vs air" portion of the ability was documented but never implemented (only the 2x damage and range 4 worked). Now actually guarantees a hit against air targets.
• Recon Deep Scan description — was "Vision range 8 for 1 turn" which sounded omnidirectional. Now reads "Reveals an 8-hex directional corridor (pick an adjacent tile to set direction)" — matches the Field Manual and the actual behavior.

Confirmed working as expected: Dig In, Barrage, Strafe, Broadside, Strategic Strike, Killshot, Airdrop, Nuclear Strike, Smoke Screen, Phantom Signal, Recon Dash, Rapid Deploy, Antiair Missile Salvo, Bombing Run. Tank Blitz was already fixed in 0.31.10. AoE kills already counted toward promotion as of 0.31.8.

Tank Blitz has been silently broken since v0.20.17. Activating Blitz correctly reset movement and flagged the tank for a second attack — but the v0.20.17 "no movement, no attack" rule we added later didn't carve out an exception for Blitz, and the first attack zeroes out movement. So the second attack always rejected with "has no movement left and cannot attack." For three weeks of patches, Blitz's documented "two attacks per turn" was actually one attack with extra cooldown.

• Tank Blitz now grants two attacks per activation, as documented.
• Player and AI both fixed — the AI's move-then-Blitz pattern correctly resolves both shots now.
• Patch is tight: only the second-attack window is exempted, not all 0-MP attacks. attacker.attacked = true on the second hit closes the door behind it — no third attack possible.
• City bombardment via Blitz works too — the same fix covers attackCity for tanks blasting structures with their second shot.

If your favorite tactic was "Blitz to break a stalemate" and it felt underwhelming — that's because half the ability was missing. Try it again.

The map and minimap are no longer permanently revealed when you go back from the draft screen and re-enter it. Repro: start a match vs AI, get to draft, click Back to the lock-map screen, click Start again. Before this fix, the entire map and minimap stayed revealed for the rest of the match — you could see every AI unit and movement through the fog.

• Root cause: the visibility rebuilder revealed every tile during the draft preview but didn't track those writes in its dirty-tile list. The placement and play phases use that list to know which tiles to clear, so they had nothing to clean up.
• Fix: the draft preview now records every tile it sets, so when the player confirms draft and moves to placement and play, fog is correctly restored.
• Minimap uses the same visibility grid — this fix covers it too.
• Saves: format unchanged, older saves load normally.

If your last AI matches felt suspiciously easy — the AI was hiding nothing. Try again with proper fog of war.

Kills from area-of-effect ultimates now count toward promotion. Strafe Run (helicopter), Broadside (destroyer), Barrage (artillery), and Nuclear Strike (nuclear) all bypassed the normal attack pipeline, so the firing unit's promotion progress never advanced from those kills. Most painful with helicopters — their ultimate is a kill machine, but it was contributing zero toward Veteran/Specialist/Commander promotions.

• Strafe Run (helicopter) — kills now count.
• Broadside (destroyer) — previously had NO tracking at all (not even end-of-game stats). Now full bookkeeping.
• Barrage (artillery) — kills now count toward the artillery's promotion (game stats were already tracked).
• Nuclear Strike — the firing unit self-destructs, but slain enemy commanders now correctly vacate their commander slot.
• Combat-survived credit for promotion is also now awarded to units who participated in AoE damage and survived — same end-of-turn pass that handles normal-combat survivors.

If your "kill leaderboard" helicopter has been stuck at zero promotion progress despite a body count — that's why. It's fixed.

Gold and Research Points now live in one canonical place: the bottom command panel. They sit alongside TURN, UNITS, CITIES, and FACTION, both with their per-turn income lines underneath. The duplicate counters at the top of the screen and on the Tech Tree button are gone. One place to read your economy — bottom-center, always visible.

• RESEARCH section added to the bottom panel between GOLD and UNITS. Shows current RP and "+N/turn" income.
• Top-left gold counter retired — just the flag and faction name now.
• Top-right twin counter (gold-coin + flask, added in v0.31.0) retired.
• Tech Tree button: RP badge removed; cleaner icon-and-label look.

If your eye was bouncing between three corners of the screen to track resources — that's done. One row, one read.

Every player unit now shows how close it is to its next promotion. The Intel Panel on the left and the bottom command-bar unit card both render a tinted progress bar — bronze for Veteran, silver for Specialist, gold for Commander — that fills toward whichever path is closest to its threshold. No more guessing whether your infantry is one combat away from Veteran or six.

• Intel Panel — full breakdown: every promotion path (kills, combats, captures, turns-as-spec where applicable) listed with current/threshold and percent. The closest path is tinted in the next-rank color.
• Bottom command-bar card — compact bar showing just the closest path inline with the buffs row.
• Color coded by next rank: bronze, silver, gold.
• ★★★ COMMANDER reached shows a gold MAX track instead of a fill, so the cap is visible.
• ⬆ READY badge next to the path label when a promotion is pending pickup — reinforces the existing PROMOTE buff.

Worth noting: promotion thresholds are OR-gated — you only need to hit one path's number, not all of them. So the bar tracks your fastest lane to the next rank, which is what actually triggers the promotion.

The AI no longer gets to attack with free movement. The "no movement, no attack" rule that was added in v0.20.17 was being silently bypassed by the AI: it relocates units by teleporting them (assigning row/col directly) instead of going through the same movement pipeline the player uses, and that pipeline is what deducts the path cost. As a result, the gate that checks movRemaining ≤ 0 never fired for the AI, and AI units could move-then-attack with their full MP intact regardless of distance traveled.

• Move-then-attack — AI's path cost is now deducted before the attack resolves. If the move used all its MP, the attack is rejected just like a player's would be.
• Standard movement — same deduction, so the post-move attack block correctly skips when no MP remains.
• Retreat — deduction applied for consistency. A unit that retreated all the way can't turn around and attack on the same turn.
• AI move-target simulator — also respects the prospective MP cost. The AI no longer plans attacks from positions that would zero out its MP and then waste its turn moving to a useless spot.

Practical effect: melee AI units now have to commit. They can move close and attack, OR move further without attacking — same trade-off you've been making since v0.20.9. Long-distance "free" charges are gone.

Low / Medium / High terrain density now produces visibly different maps at every size. The setting was working as intended for small maps but quietly broke down on anything larger than roughly 25×25 because the terrain placement loop had a hard-coded 200-attempt cap. On a 100×100 map at High density the requested forest count is around 1,400 tiles — the loop bailed at 200 every time, so all three density settings produced near-identical large maps.

• Low density on a 100×100 map: ~280 forests now actually place (was capped at ~200 regardless).
• High density on a 100×100 map: ~1,400 forests now actually place (was capped at ~200 — a 7× difference).
• Mountains and small-map water share the same placement helper and benefit from the same fix.
• Small-map behavior unchanged — the 200-attempt floor preserves the original numbers for any density target under 20 tiles.

If you've been picking maps based on a "they all feel the same" assumption, give Max + High Density another look — you'll see real forest cover this time.

Every dossier row now shows the player's rank to the left of their callsign. A tier-tinted badge displays the rank abbreviation — Pvt, Cpl, GySgt, Capt, Gen, etc. Hover the badge to see the full grade and title (e.g. "E-7 Gunnery Sergeant").

• Rank badge rendered between the row number and the battalion tag, in the same line as the callsign.
• Tier tinting — green for enlisted (E-1 through E-9), silver for warrant officers (W-1 through W-5), gold for commissioned officers (O-1 through O-10). Visually scannable at a glance.
• Server-side resolution — the Dossiers endpoint now returns rank data computed by the same getRankForPlayer() helper used on the main profile page, so a player's rank is consistent everywhere it's displayed.

If you've been wondering where you stand against other commanders — sort the Dossiers by Top Wins and see how many ★★★ Commanders are ahead of you.

Sleeping units are now clearly marked in the Unit Roster panel. Until now, a sleeping unit looked identical to an exhausted unit — same ✕ status icon, same 50% opacity, same "MOV 0/N" and "ATK NO" stat row. There was no way to tell at a glance which of your units were voluntarily resting versus actually out of moves.

• 💤SLEEP label sits next to the unit name alongside the existing ⚓DEPLOYED / rank / stack-count badges.
• Status icon for sleeping units is the 💤 moon, distinct from the ✕ used for exhausted units.
• Stat row reads MOV ZZZ and ATK SLEEP in blue, rather than the misleading MOV 0/N + ATK NO — the unit isn't out of resources, it's resting.
• Row chrome tinted blue with softer opacity, so sleeping rows visually cluster with "done for the turn" but read as their own state.

The MOV ▼ filter still hides sleeping units the same way it hides exhausted ones — sleeping units aren't actionable, so they don't clutter the "what can still move?" view.

The UK's 175g/turn HQ income was being labelled a penalty even though it's a +25g/turn bonus over the 150g default. The faction-select card listed it under "Penalties," and the Field Manual called it a "Weakness" while simultaneously admitting it was higher than default. Both threads have been straightened out.

• Faction-select card — UK's 175g HQ income now shows in the Bonuses column. Threshold logic checks against the actual 150g default (was incorrectly checking < 200).
• MP faction-detail panel — the secondary display path had no hqIncome handling at all; now renders the bonus on the same logic as the main card.
• Field Manual UK card — "+25g/turn HQ income (175g vs 150g default)" moved to Strengths. Weaknesses rewritten to focus on the real constraint: the 7-unit initial draft cap.

If you've been picking other factions because UK looked like it had a bad economic profile — that profile was a bug, not a balance choice. UK actually has the highest HQ income in the game.

The Tech Tree is now playable. v0.30.0 shipped the foundation; v0.31.0 ships the UI to interact with it and the first fully-resolved branch in combat. Open the tree from the bottom of the Intel Panel, watch your Research Points tick up next to your gold in the new top-right HUD, and click any unlocked node to research it.

Air Superiority is fully active. All 6 levels of the Air branch now have resolver hooks — deploy bonuses, AA reaction-fire dodge, ECM first-shot immunity, anti-ground bonuses, and the Stealth Bombers capstone. Every other branch still ticks up RP and accepts purchases, but their gameplay effects ship branch-by-branch in 0.31.x patches.

• Tech Tree overlay — 10 branch columns × 6 level rows. Available nodes glow green; locked nodes are greyed with their requirement text; capstones get a gold border. Click to research.
• Resource HUD swap — the AI faction flag/gold leak in the top-right is gone. In its place: a gold-coin counter and a research-flask counter for the human player. The AI's intel lives in the Intel Panel, where it should.
• Intel Panel button — "Tech Tree" with the flask-and-gear icon, anchored at the bottom.
• Air L1 — Jet Engine Tuning: Jet and Helicopter deploy with +1 MOV.
• Air L2 — Targeting Pod: Jet deploys with +5 ACC.
• Air L3 — Chaff Dispenser: air units gain +10 DGE against AA reaction fire.
• Air L4 — ECM Suite: each air unit ignores the first AA reaction shot taken against it per turn.
• Air L5 — Air-to-Ground: Jet attacks against ground targets get +2 ATK.
• Air L6 — Stealth Bombers (capstone): AA fired at Bombers takes a −75% accuracy and −75% damage hit.
• Generic stat hook in createUnit — every numeric stat (MOV/ATK/DEF/ACC/DGE/range/vision/HP) now sums in research deltas at deploy. Means future "+stat" research effects across the other 9 branches auto-apply with zero per-branch wiring.

Coming in 0.31.x: Armor (Sabot Rounds, Reactive Armor), Infantry (Squad Tactics, Forward Observer), Recon city vision, Engineering FAB cost reductions, Logistics supply lines, Command HQ aura. AI-side tech spending lands in 0.31.6.

HexArmy gets a Tech Tree. Spend Research Points each turn to unlock 60 nodes across 10 doctrines: Infantry, Armor, Artillery, Air Superiority, Naval Power, Reconnaissance, Engineering, Anti-Air, Logistics, and Command. Each branch has 5 stat-bump tiers plus a L6 capstone with a unique mechanic (Stealth Bombers, Saturation Strike, Satellite Deployment, Corpsman Up!, Sky Curtain, and more).

v0.30.0 is the foundation drop — the data model, the RP economy, save/load wiring, and the resolver helpers all ship today. The in-game Tech Tree overlay and the runtime gameplay effects roll out in 0.30.1+ patches alongside the resource HUD redesign.

• Research Points — base 5/turn + 2 per owned city + 5 per captured HQ + 1 per FAB. Aggression scales your tech faster than turtling.
• Faction-favored discount — each faction has one branch at −25% cost (USA: Air, UK: Engineering, Russia: Armor, China & Canada: Logistics, etc.).
• Linear unlock — L2 needs L1, L3 needs L2, capstone L6 needs L5. No leapfrogging.
• Save format additive — 0.20.x saves still load cleanly. Old saves get all branches at level 0.
• Per-game tree — not meta-progression. Every new match starts fresh, so build choice is part of every game.

Coming in 0.30.1: the Tech Tree overlay, the resource HUD swap (gold-coin + flask icons replacing the AI flag/money leak), and the first wave of combat resolver hooks (Air Superiority all 6 levels as the proof-of-pattern).

Newly drafted and produced units now use their faction-modified movement on their first turn instead of the base value. The unit-creation function was setting movRemaining = def.mov (base) before applying faction modifiers to unit.mov, so units deployed with mismatched MP — for example Iran helicopters showing 5/4 (could move 5) and India infantry showing 3/4 (could only move 3). The mismatch fixed itself from turn 2 onward but mattered immediately for Iran (whose units act on their spawn turn) and on turn 1 of every game for any drafted faction with MOV modifiers.

• D-MOV — Single-line sync at the end of createUnit. After all faction modifiers have been applied, unit.movRemaining = unit.mov brings the displayed and usable MP into agreement.
• Affected factions: Iran (heliMovPenalty, tankMovPenalty), India (infantryEngineerMovBonus, artilleryMovPenalty), North Korea (nonInfantryArtilleryMovPenalty), Australia (reconMovBonus), Canada (engineerMovBonus). All now show correct MP on deploy.

If you've been wondering why Iran's helicopters felt faster than they should — that's why. They were quietly cheating themselves an extra hex on the spawn turn.

Loading units onto an APC and ending your turn no longer freezes the game. Embarked cargo units are stored at (row=-1, col=-1) while inside the carrier so they don't render on the map. The AI's spatial-index builder — called every enemy turn — was using Math.floor(-1 / 5) = -1 to bucket them, producing a negative array index that crashed with Cannot read properties of undefined (reading 'push'). The throw killed the AI turn chain and the game appeared frozen.

• D-APC — Spatial index ignores off-map entities. SpatialIndex.build() now skips any entity with negative coordinates or embarked = true. Two-line guard, fixes the crash directly.
• D-APC — Embarked cargo excluded from AI targeting. getEnemyUnitsForSlot and getOwnUnitsForSlot filter out embarked units so threat maps, targeting, and the "all enemies destroyed" check all behave correctly.
• D-APC — aiActUnit wrapped in try/catch. If any AI unit throws an unhandled exception, the error is logged to console and the unit is marked done so the rest of the turn proceeds. No more silent freezes from a single bad unit.

This affects both the player's APC + Transport loading and AI-driven loading. Existing carriers in saved games will work without any further intervention.

The in-game Field Manual is now in sync with how the game actually plays. Roughly 80 stats and rules across all 9 sections were out of date — unit costs were off by 2-3x, draft budgets were wrong for most factions, garrison costs were ~2.6x what the manual claimed, the NZ-only force cap doctrine wasn't documented, and the move-then-attack rule (v0.20.9) wasn't anywhere in the manual at all. Every section was audited against the actual game data and rewritten where needed.

• Overview — documents the move-then-attack rule and Assault Infantry exemption, multi-AI 1v1/1v2/1v3 matches, all 8 map types, terrain density options, and the unit cycle / sleep controls.
• Factions — all 10 factions are now documented as player-pickable. Each entry has the correct draft budget, doctrine, strengths, weaknesses, and play tips. New Force Cap Rule section clarifies that only NZ has an alive-units cap.
• Units — 21 unit cost cells corrected. Specialist unit list expanded. Passives and ultimates now match UNIT_DEFS exactly.
• Terrain — FOB, FAB, and Port now properly distinguished. Movement-cost table expanded to cover all unit categories.
• Combat — new section on the move-then-attack rule. Damage formula updated to current factors. Special attack rules (snipers, mortars, bombers, subs, AA, min-range) called out.
• Promotions — Assault Infantry correctly described as "attack with 0 MP, one attack per turn" (per the v0.20.9 rework).
• Economy — HQ income 150g (UK 175g), garrison costs 525g/800g/400g, force cap rule, engineer camp construction, damaged-city production multiplier.
• Advanced — updated vision table (Scout 5, Recon 4, etc.), multi-AI match documentation, AI difficulty per slot.
• Strategy Tips — rewritten to cover all 10 factions on both sides of an engagement.

If you've referenced specific manual numbers in past planning, those numbers are now reliable. Future rebalances should update the manual alongside the game data.

v0.20.18 shipped with a corrupt index.html — the inline <script> block was truncated mid-statement, leaving every JS event handler unbound and every main-screen button dead. v0.20.19 restores the missing tail (the rest of the disconnect-overlay timer, the PvP chat helper, the init() call that wires up the page, and the closing </script></body></html>) and bumps the version so it's clearly distinguishable from the broken build.

All v0.20.16, v0.20.17, and v0.20.18 changes ship intact: NZ-only force cap, AI movement-gated attacks, 10x10-start fix, start-flow diagnostics, server version stamp.

Apologies for the broken build — v0.20.18 should never have shipped without a parse-check on the inline script. CI guard is on the followup list.

Caught the actual cause of the 10x10-cannot-start bug, thanks to v0.20.16's diagnostic envelope. The error was a stale-visibility-list bug: after playing on a larger map (default 20x20) and then trying to start a 10x10 game, the visibility tracker still held tile coordinates from the bigger grid. The first visibility pass for the new game tried to clear row 15 on a 10-row grid, threw Cannot set properties of undefined (setting '2'), and the new try/catch envelope showed it cleanly in the alert.

• D-DIMS — Purge tile-tracking lists when dimensions change. applyMapDimensions() now nulls _visGrid, _discoveredGrid, _aiVisGrid AND clears _visibleTiles, _aiVisibleTiles. The previous code only nulled _visGrid, leaving the tile lists pointing at rows that no longer existed.
• D-DIMS — Same purge on exit-to-home. Players who finish a game, return to home, then start a different-sized one are also covered.
• D-DIMS — Bounds check in the visibility loops. A defensive guard inside each for (const vt of _visibleTiles) skips any entry outside the current grid bounds. If a future code path forgets to clear the list on map-size change, the fallback prevents a hard crash.

10x10 maps now start cleanly from any prior state — first launch, after a 20x20 game, after exit-to-home, etc.

The 0-movement attack ban now applies to every unit on the board, not just yours. v0.20.9 introduced the rule for player units: spend all your MP on movement, you don't get to attack that turn (Assault Infantry exempt). The AI was supposed to follow the same rule, but a couple of attack-after-move branches in aiActUnit() computed targets directly and bypassed the UI-side gate. v0.20.17 closes that.

• D-PROMO2 — Centralized in the combat resolvers. The 0-MP check now lives at the top of doAttack() and attackCity(), so every caller — player UI, AI, and any future multiplayer/scripted path — is uniformly gated. Belt-and-suspenders with the existing getAttackableHexes() gate (which shapes the player's targeting UI).
• D-PROMO2 — Assault Infantry exemption preserved on both sides. Player and AI Infantry that have earned the Assault Veteran promotion can still attack with 0 MP, one attack per turn. This isn't a nerf to anyone — it's the rule the player has always seen, now consistently enforced for the opposition.
• D-PROMO2 — Silent reject for AI. The combat log only emits a "no movement left" line when the player would have seen the attempt, so AI bookkeeping doesn't pollute the feed.

Practically: you'll notice fewer "how did that AI unit get an attack after running across the map" moments. Tactically it tightens late-turn AI positioning — the AI now has to choose between closing distance and attacking, just like you.

Course-corrects the v0.20.14 force cap and adds the diagnostic plumbing to chase down the remaining 10x10-start and stats-not-updating reports. The cap was applying to too many factions and quietly hard-locking USA at 7 alive units mid-match. The start flow was throwing silently on 10x10 boards. The stats deploy state was not visible from the client. All three are addressed here.

• D-CAP — Force cap is a New Zealand doctrine, not a universal rule. v0.20.14 extended NZ's maxDraft: 6 alive-unit cap to every faction with a maxDraft modifier — which silently capped UK at 7 alive units, blocking replacement production after a single casualty. Fixed: produceUnit() and showProduceMenu() now only enforce the cap when playerFaction === 'newzealand'. Every other faction can field replacements without limit. UK's maxDraft: 7 still constrains the initial draft.
• D-START — Diagnostic envelope around the start flow. The Start Game button click, beginGame(), the initMap() call, and the startDraft() setTimeout callback are all wrapped in try/catch with [START]-tagged console logs. Previously a thrown exception in the 500ms draft-init timer was silently swallowed. Now any failure surfaces in F12 with the precise function name + stack trace, and the user sees a gameAlert instead of a stuck overlay.
• D-START — Multi-AI HQ placement floor relaxed for small maps. The 10-hex minimum HQ separation was unreachable on a 10x10 board's 14-hex diagonal, forcing the fallback path every time and potentially leaving HQs clustered. On maps under 400 tiles, the floor drops to 3.
• D-STATS — Server stamps its version in every response. POST /api/stats/game now returns serverVersion: '0.20.16'. The client logs that field in its [STATS] OK line so the user (and devs) can confirm at a glance whether the deployed server is current. The server also logs a REJECT 400 line listing each missing field on payload validation failures.
• D-STATS — Client logs the full stats payload. finalizeGameStats() prints the exact body before the POST and again on failure, plus a pre-flight warning when any required field is missing — so the user can paste a single F12 line that tells us whether their stats failure is a payload bug, a server reject, or stale-deploy.

If you reported "stats still not updating" after v0.20.15, the next time you finish a match please open F12 (DevTools), find the [STATS] lines, and share what you see — that single line will pinpoint the failure mode.

Found a deeper silent-failure mode that explains why some players' Dossiers still weren't updating after v0.20.13. The server's UPDATE player_stats query was a no-op for any user without a pre-seeded player_stats row — the transaction committed cleanly, the endpoint returned 200 OK, the client logged success, but zero rows actually changed. v0.20.13 fixed the client side; v0.20.15 fixes the server side.

• D-STATS — Upsert before update. The server now INSERT INTO player_stats (user_id) VALUES ($1) ON CONFLICT (user_id) DO NOTHING immediately before the UPDATE, guaranteeing a row exists. No more silent zero-row updates.
• D-STATS — Server observability. Every /api/stats/game POST now logs [stats/game] OK user_id=X callsign=Y result=victory faction=usa turns=15 on success and a WARN if the UPDATE somehow still affects 0 rows. Future regressions will be visible in pm2 logs hexarmy immediately.
• D-STATS — Client diagnostic logging. finalizeGameStats() now prints [STATS]-tagged console lines at every key checkpoint: entry, retry attempt, bail-out, and successful POST. F12 in any future "stats not updating" report will surface the exact failure point in seconds.

Same caveat as v0.20.13: matches that failed silently before this build cannot be retroactively recovered. From v0.20.15 forward, every match POSTs cleanly.

The faction maxDraft cap now applies to total alive units at any time, not just initial draft. Previously, New Zealand could draft 6 units, lose 2 in combat, then produce 4 more from a city — climbing to 8 alive units, blowing past the doctrine. That loophole is closed.

• D-36 — Production cap. When you open a city's production overlay, all unit cards are disabled if you're at or above your faction's cap. A red banner explains the cap (e.g. "Force cap reached (6 / 6). Lose a unit before recruiting more."). The actual produceUnit() function also rejects with a clear alert — defence in depth.
• The math. NZ caps at 6, USA at 7, all other factions at 8. Counts only alive player units (HP > 0). Killed units free up cap space immediately, so attrition replacements still work as intended.
• Why this matters for NZ. "Lean Volunteer Force" is now actually lean. You commit to 6 units, you lose them carefully, and every casualty is a real loss until the next opening. That's the doctrine working as designed.

Steam-authenticated games now correctly update your Dossier. A latent bug was silently dropping every game's stats on the floor: Steam auto-login completed and gave you a session, but the client-side playerAccount variable never refreshed, so finalizeGameStats() bailed out at its first guard and nothing got POSTed to /api/stats/game. Wins, losses, kills, damage — all lost.

• D-35 — Auto-login state propagation. The Steam autoLogin success path was calling a refreshAuthState() hook that didn't exist anywhere in the codebase, so the typeof === 'function' check silently skipped it. Now calls loadAccount() directly — which actually exists and correctly hydrates playerAccount, playerStats, and the rest of the auth-derived UI state.
• D-35 — Belt-and-suspenders retry in finalizeGameStats. If playerAccount is still null when a match ends (e.g. timing race where Steam autoLogin completed mid-match), finalizeGameStats() now does one loadAccount() retry before giving up. Last line of defence against silently-dropped match results.

If you played any matches between v0.20.7 and v0.20.13 via Steam, those games are not retroactively recorded — but every match from v0.20.13 forward will land in your Dossier the way it should.

Dossiers now load automatically every time you open the panel. No more clicking Search on an empty input to populate the list — the moment you click Dossiers, the panel fetches every public player (sorted by Top Wins by default) and shows you who's on the server.

• D-34 — Auto-load on open. Removed the cache guard that was suppressing reloads on subsequent opens. Each open now resets the search box, snaps to page 1, and re-fetches the current "all players" view.
• Sort persistence. Your selected sort (Top Wins, Top Kills, Top Streaks, Most Decorated, Recent) carries over between opens within a session. You only have to set it once.

HexArmy now distributes exclusively through Steam. The standalone-installer auto-update channel has been retired in favour of Steam's native update system.

• Steam players see no change. Updates continue to arrive automatically through the Steam client.
• Standalone installs (pre-Steam) keep working at their current version. The in-game "Update Available" modal has been removed; existing installs will no longer prompt to download updates. To receive future updates, install HexArmy through Steam.
• Server cleanup. The legacy /api/version and /updates/ endpoints have been retired. The Tauri custom updater code (Rust + JS modal) is gone too — one update channel, one source of truth.

Three-part fix so Steam-authenticated players appear in the Personnel Dossiers panel as soon as they sign in — not only after they finish their first match.

• D-34 — Default Dossiers list now includes Steam users with zero games. The browse list previously hid any account with games_played = 0. Steam players who launched the desktop app and signed in but hadn't completed a match yet were invisible until you searched their callsign. The filter now also lets through any account with a linked steam_id, so Steam players appear immediately.
• D-35 — Pre-existing accounts that link Steam are now retroactively visible. The Steam login UPDATE branch did not flip profile_public from FALSE to TRUE, so any account created before Steam auth shipped (or with a manually-set FALSE) stayed hidden even after linking a Steam ID. The UPDATE now sets profile_public = TRUE on every Steam sign-in, mirroring the new-account INSERT.
• D-36 — Clear server warning when STEAM_WEB_API_KEY is missing. Without the key, every Steam sign-in returned HTTP 500 silently. The server now prints a multi-line warning at boot if the key is unset or doesn't look like a 32-char hex string, explaining the downstream effect on Dossiers visibility.

Five tactical bug fixes reported from playtest. Map clarity, production rules, faction limits, and the Infantry Veteran promotion all tightened.

• D-29 — Minimap during draft. The minimap could leak into the draft screen on some transitions. Now hard-guarded: renderMinimap() early-returns during draft, and the container is explicitly hidden the moment the draft phase starts.
• D-30 — Production on occupied hex. You could buy a new unit on a city tile while the capturing unit was still on it, stacking two units on one hex. Now blocked: produceUnit() checks for an existing unit and shows "A unit is already on this city. Move it off the city tile first."
• D-31 — New Zealand draft cap. NZ's "Lean Volunteer Force" doctrine declares a 6-unit max but the cap was hardcoded to 8 in three places. The faction's maxDraft modifier is now actually honoured in the draft logic, count display, and disabled-card state. NZ caps at 6, USA at 7, everyone else at 8.
• D-32 — Field Manual right-click claim. The manual said you could deselect with right-click, but right-click was never wired up. The hint now reads "Click an empty hex or press ESC."
• D-33 — New movement rule: attacking now requires at least 1 MP. A unit that has fully exhausted its movement points can no longer also attack on the same turn. This adds a meaningful tactical decision: do you advance into striking range now and shoot, or close the gap and finish next turn?
• D-33 — Infantry Veteran "Assault" promotion reworked. The old description ("Can move AND attack, +1 ATK, +1 HP") was a no-op — units already could move and attack. The new "Assault" is a real combat promotion: +2 ATK, +1 HP, and the ability to attack even with 0 MP remaining (one attack per turn). It's the only way to fully advance AND strike in the same turn — turning Veteran infantry into the backbone of the assault wave.

Steam players now appear in Dossiers. When you launch HexArmy through Steam, the game silently authenticates your Steam ticket against Valve's Web API, creates (or refreshes) your server-side dossier, and surfaces you in the global Dossiers panel. No login form, no second password — just play.

• D-STEAM — Steam ticket auth. New POST /api/auth/steam-login endpoint validates Steam auth-session tickets via ISteamUserAuth/AuthenticateUserTicket. Returns a session cookie identical to email/password login.
• D-STEAM — User schema. users table gained steam_id, steam_persona_name, steam_avatar_url, steam_last_seen. Steam users default to profile_public = TRUE so they appear in Dossiers immediately.
• D-STEAM — Callsign collision handling. If your Steam persona name is already taken by another HexArmy player, the system appends your SteamID3 suffix (e.g. Andrew_4321) so you don’t collide.
• D-STEAM — Profile enrichment. GetPlayerSummaries pulls your Steam avatar URL on first login and refreshes it on every launch. Surfaces nicely in Dossier cards (UI work pending follow-up).
• D-FOG2 — Faction reveal modal trap fixed. The "Intelligence Report" modal can now be dismissed by clicking the dark backdrop, pressing Escape, or by the ACKNOWLEDGED button (now always visible — max-height capped to viewport with internal scroll).
• D-FOG2 — AI counter-attack crash fixed. A defIsHuman is not defined ReferenceError was breaking the AI turn whenever an AI attack landed AND the player’s counter-attack also hit. The two stat-tracking variables are now hoisted to function scope.
• D-FOG2 — AudioContext double-close guarded. Closing the faction reveal music context twice no longer throws InvalidStateError.
• D-FOG2 — Player-owned cities never fall under fog. The structure-vision pass now force-rebuilds its cache on every visibility update, so captured cities and ally cities stay visible even when units move away.

Smaller-screen polish across the entire game. Game setup, faction selection, theater of operations, draft, multiplayer lobby, and the in-game HUD now fit cleanly at 1280×720 minimum. Specifically tuned for Steam Deck (1280×800) and 14-inch laptops (1366×768) where panels and headers used to crowd the map.

• New short-screen breakpoints at 820px and 720px height — reduces top/bottom HUD bar height so the map keeps real estate on the Steam Deck and on 14″ laptops.
• Tightened 1280px-wide breakpoint — left/right sidebars now scale down sooner, font scale tuned, fewer pixels wasted on chrome.
• Faction selection / Theater of Operations — header and grid spacing now use viewport-relative units so the map preview never gets pushed off-screen.
• Draft screen — title and budget rows now scale; unit grid stacks to a single column at ≤1100px width so cards aren’t squeezed into 4-letter labels.
• Multiplayer lobby — left panel width now fluid; both column headers scale.
• Modals (intel, Field Manual, medals, stats) — max-heights now relative to viewport; medal-layout left column shrinks at narrower widths.
• Home screen panels — padding and section headers now scale with viewport so the home overlay no longer clips on short screens.

Routine version bump — no functional changes. Carries forward all v0.20.4 victory-condition polish (D-25 through D-28) and v0.20.3 fixes. Issued to keep the auto-updater channel and installer artifact aligned with the current build.

D-25 — HQ Takeover Elimination Fix: HQ Takeover victory mode no longer eliminates a player when all their troops are destroyed if their HQ still stands. Only capturing the HQ eliminates a player in this mode.

D-26 — Advance-on-Kill City Bypass Fix: Units no longer advance onto enemy cities with active defenses (HP > 0) after killing a defending unit. The attacker stays in place and the log reports “city defenses hold.”

D-27 — Disband Units on Elimination (HQ Takeover): When a player is eliminated in HQ Takeover or Infantry Only mode, all their remaining units are disbanded and removed from the battlefield.

D-28 — Neutralize Cities on Elimination (Military Annihilation): When a player is eliminated in Military Annihilation mode, all their cities, HQ, and camps revert to neutral ownership and can be captured by remaining players.

Replaced all Canvas 2D hand-drawn unit sprites with an image-based PNG sprite system using ctx.drawImage(). Units now load pre-rendered 256x256 artwork from /sprites/units/, enabling realistic painted-style graphics that Canvas primitives cannot achieve.

• Tank: Sherman/T-34 style with rounded turret, sloped hull, detailed running gear, muzzle brake
• Infantry: Standing soldier with M1 helmet, rifle with bayonet, belt and buckle detail
• Artillery: Towed field gun with split trail legs, spoked wheels, curved gun shield, long barrel
• Recon: Open-top WW2 Willys Jeep with windshield, spare tire, grille slats, headlights
• Anti-Air: Half-track with twin upward AA barrels, ammo magazine, open fighting compartment
• Jet: Swept-wing fighter (MiG/F-86 era) with glass canopy, intake ring, team roundel
• Helicopter: Attack helicopter with tandem cockpit, stub wings, rocket pods, chin turret, rotor disc
• Engineer: Soldier with yellow hard hat, tool belt with pouches, wrench and shovel
• Ship: Naval destroyer with superstructure, gun turrets, funnel, mast with radar, bow wave
• Submarine: Cigar hull with conning tower, periscope, dive planes, wake bubbles
• Radar: Truck with large parabolic radar dish, feed horn, signal waves, flatbed detail
• Bomber: Multi-engine wide-wing aircraft with glass nose, 4 engine nacelles, propeller discs
• Sniper: Prone soldier in ghillie suit, scoped rifle on bipod, boonie hat
• Paratrooper: Soldier descending with parachute canopy, suspension lines, panel detail
• Missile: TEL truck with ballistic missile on angled launch rail, nosecone, rear fins
• Mortar: Mortar tube on baseplate with bipod, ammo crate with standing rounds

Every unit sprite in the 3D isometric prototype has been completely redrawn with realistic, organic shapes replacing the blocky rectangular primitives:

• Curved geometry — All primary shapes now use quadratic Bezier curves for natural, organic silhouettes instead of flat rectangles
• Multi-tone shading — Each unit features 3-4 tonal layers (shadow, body, highlight, specular accent) for depth and volume
• Sub-component detail — Rivets, hatches, wheel hubs, lug nuts, panel lines, glass reflections, scope lenses, and weapon details
• All 16 unit types — Tank, infantry, artillery, recon jeep, anti-air, jet, helicopter, engineer, ship, submarine, radar vehicle, bomber, sniper, paratrooper, missile TEL, and mortar

Units now stand out clearly on all terrain types — especially forests and mountains — with a new 3-layer visibility system:

• Ground Shadow: Wider, softer elliptical shadow anchors units to the terrain
• Base Plate: 3-tone olive drab platform under every unit, visually separating it from terrain decorations like tree canopies and rock spires
• Team-Color Rim Glow: Colored ring (green for player, red for AI) around the base plate for instant team identification at a glance