The manager could only ever see the external Swiss service. Every tournament
the player app's own engine ran was invisible here: standings came back empty,
pairings were read from a column that does not exist (swiss_api_round_id,
against a swiss_round_id column), and three of the fallback tables the service
queried have never existed in this schema.

The public live page was also fatal. The Swiss service wraps its rows in
{"data": [...]}; the standings view iterated the wrapper, so "data" + 1
crashed PHP 8 and printed a stack trace with server paths to anyone holding the
link. Two more views did the same thing to the native pairing shape, which puts
an object where the Swiss shape puts a name.

- NativeTournamentService reads the engine's rounds and computes standings,
  pairings and tiebreaks from them; LiveDataService is native-first throughout.
- display_errors is off in the image, so a fatal is logged, never rendered.
- Start no longer flips a tournament to in_progress and leaves it unpaired, and
  Generate Round no longer answers "no link to the Swiss system" for every
  tournament EL3AB runs. Both ask the player app's engine, authenticating with
  the service key both apps already hold.

Two controls on the live page were scenery. The player-compare selects were
filled from a class the players view no longer emits, and choosing two names ran
a function whose whole body hid the result; the player card modal needed a
data-player payload nothing rendered. Both now work off data already on the page.

Visually the page was rebuilt around what a spectator opens it for: the boards
and the leaderboard first (the share box and compare tool used to be pulled
above them on a phone by order:-1), a podium, avatars and form dots, board cards
that show at a glance which games are still running, a readable rounds timeline,
a knockout bracket with connectors, and a QR that leads the share card instead of
hiding behind a disclosure. Sections no longer render at opacity 0 when script
does not run.

tools/verify-cycle.mjs runs the whole cycle across both apps and checks the
manager reports what the players did; it passes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

- .htaccess: allow fonts.googleapis.com in style-src and
  fonts.gstatic.com in font-src for IBM Plex Sans Arabic
- Add empty org-applications.css/js so module assets don't 404
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Adds a new tournament workflow step between draft and start:
- draft → "فتح التسجيل" → registration (players can join)
- registration → "بدء البطولة" → in_progress

New route: POST /tournaments/{id}/open-registration
Sets status from 'draft' to 'registration' with audit log.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Local uploads were unreachable by the player app on a different domain.
Now uploads go to profile-images/branding/ bucket with upsert, producing
a full public URL that the player app can load directly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- last_seen → last_seen_at (explains why stats showed 0)
- country → country_code
- Updated searchPlayers select and individual view JS
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The notifications.data column is JSONB. Database::insert() already
json_encodes the full payload, so passing json_encode() double-encodes
it into a string. Mobile app expects a Map, not a string.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- getTargetPlayers now uses select=* (matches working players module)
- Removed moduleJS for compose/individual views (JS is inline)
- These views were referencing non-existent JS file paths causing 404s
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

csrfField() doesn't exist — the actual pattern is a hidden input
with name="_csrf" and value from Auth::csrfToken().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Moved level, coins, and created_at to PostgREST `and` operator so
  min+max ranges work together instead of overwriting each other
- Batch-insert campaign recipients (100/batch) instead of N HTTP calls
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Adds campaign management, demographic targeting, individual player
notifications, reusable templates, scheduling, and campaign history.
All notifications delivered via Supabase Realtime (insert into
notifications table).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Kong requires the apikey query param for public object access via img tags.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Kong gateway requires the apikey header alongside Authorization.
Without it, storage uploads fail with "No API key found in request".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Form now supports file upload (enctype multipart/form-data)
- Accepts PNG, JPG, WebP, GIF up to 10MB
- Uploads to Supabase Storage (assets bucket, ads/ prefix)
- Shows current image preview in edit mode
- Falls back to URL field if no file uploaded
- List view shows image thumbnails
- Added splash and between_games ad slots
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Supports the player app's in-game ad banner system.
New columns added to ad_campaigns table via ALTER TABLE.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The isStalemate() called the Stockfish API on every move just to check
if the opponent had legal moves — doubling API calls from 80 to 160 per
game. Now relies on the API returning no best_move as game-over signal.
Differentiates checkmate vs stalemate by eval magnitude.

Also reduced max moves from 80 to 60 — bot games at these levels
should resolve well before that.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Part A - Bot Game Engine (BotGamePlayerService):
- Maps player ratings to 7 bot personalities (amina→grandmaster)
- Plays actual chess games move-by-move via Stockfish API
- Full FEN tracking, UCI→SAN conversion, PGN generation
- Game termination: checkmate, stalemate, 50-move, repetition, 80-move adjudication
- Stores complete games in existing `matches` table (pgn, moves JSONB, fen)

Part B - Game Viewer:
- Interactive chessboard (CSS grid + Unicode pieces)
- Move-by-move navigation (first/prev/play/next/last + keyboard arrows)
- Move list with click-to-jump
- Last move highlighting
- Auto-play mode (800ms per move)
- Uses chess.js for position replay from UCI moves

Integration:
- "لعب مباريات حقيقية" checkbox in bot testing panel
- "♟ عرض" (View Game) button next to each completed pairing with match_id
- Route: /tournaments/{id}/game/{matchId}
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1. Rounds tab now shows White | Result | Black columns with proper
   result badges (1-0, 0-1, ½-½) instead of raw enum strings.
2. BotSimulationService stores whiteName/blackName in results JSONB.
3. Fixed live-tournaments admin-controller and LiveDataService
   json_decode crashes on already-decoded JSONB arrays.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tournament_registrations.player_id had FK to profiles(id) which rejected
bot player inserts since bot UUIDs aren't real profiles. Dropped the
constraint so bot testing works.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1. pairings/results JSONB columns already decoded by Supabase — added
   is_array check before json_decode (same pattern as tiebreak fix).

2. Bot player_id was 'bot_xyz' string but column is UUID type — PostgREST
   silently rejected every insert. Now generates proper v4 UUIDs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Controller was passing the raw response body (which has data + roundNumber
keys) directly to the view. The foreach iterated over the wrapper object
instead of the standings array.

Also fixed field name mappings: Swiss API uses 'name' not 'player_name',
'gamesPlayed' not 'games_played', 'tiebreakValues' array not 'tiebreak'.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

If the Swiss tournament was already started (e.g. from a previous attempt),
don't fail — just update local status and proceed with round generation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The API rejects bodiless POSTs without Content-Type (415 Unsupported Media
Type) AND rejects Content-Type with literally no body (Body cannot be empty).
Solution: always send Content-Type, and for POST/PATCH/PUT with null body,
send empty object {} as body.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1. Content-Type: application/json only sent when body is not null.
   Swiss API rejects bodiless POST/GET with that header.
2. Controller start() now calls Swiss API /start endpoint.
3. simulateNextRound() auto-starts Swiss tournament if local status
   is still draft/registration.
4. generateRound response parsing fixed — data is in {round:{id,...}}.
5. getPairings response wrapped in {data:[...]} — now handled.
6. Pairing field names use camelCase (whitePlayerId not white_player_id).
7. Player ratings fetched from listPlayers instead of expecting them
   embedded in pairing objects.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1. ApiProxy was sending Content-Type: application/json on GET requests
   which the Swiss API rejects ("Body cannot be empty when content-type
   is set to application/json"). Now only sends Content-Type for
   POST/PATCH/PUT methods.

2. Players tab now reads bot name/rating from bot_metadata JSONB
   instead of non-existent player_name/rating columns.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Swiss API wraps list responses in {data:[...]}. Also added null checks
at each step and detailed error messages so failures are diagnosable.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Previously the bot testing section was hidden when swiss_api_tournament_id
was null. Now it always shows, and when you click "Fill with Bots" it
auto-creates the Swiss org/event/tournament on the fly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Supabase returns JSONB columns as native arrays, not JSON strings.
json_decode() on an array throws TypeError. Now checks if already array.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Views were referencing columns that don't exist:
- rounds_count → rounds_total/swiss_rounds
- entry_fee → entry_fee_coins
- prize_pool → prize_pool_coins
- start_date → starts_at
- end_date → registration_closes_at
- organization_id → org_id
- started_at → removed (column doesn't exist)

Also fixed start() to skip bot players (already registered via bulk import)
and not crash when player_id doesn't match a real profile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The store() method used column names that don't exist in the database:
- rounds_count → rounds_total + swiss_rounds
- entry_fee → entry_fee_coins
- prize_pool → prize_pool_coins
- start_date → starts_at
- organization_id → org_id
- swiss_org_id, swiss_event_id → removed (don't exist in table)
- created_by → removed (UUID FK to profiles, admin users aren't in profiles)

Also:
- Time control is now a proper dropdown with all 14 enum values grouped
  by category (bullet/blitz/rapid/classical)
- Format dropdown now uses correct enum values (swiss_to_bracket, team_battle
  instead of invalid group_stage)
- Swiss API tournament creation limited to formats it actually supports
  (swiss, round_robin) — other formats use local bracket/arena engines
- Insert failure now shows error instead of fake success message
- On success, redirects to the new tournament page instead of list
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Adds a complete bot testing system to the Arbiter Tools tab:
- Fill tournaments with bot players (8-128) with realistic Arabic names and
  bell-curve rating distribution
- Auto-play individual rounds using ELO probability simulation
- Simulate entire tournament with progress bar UI (sequential AJAX)
- Cleanup bots with one click
- Bot players marked with 🤖 badge in players list

New files: BotSimulationService.php, _bot_testing.php, migration 005
Also updates EL3AB_PLAYER_APP_DATA.md with domino/ludo/theme/tournament schemas
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Auth::csrfField() doesn't exist — replaced all 24 occurrences across org modules
with the correct <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">.
Also fixed org-leaderboards index.php which was actually the org-board view (using
$org variable that wasn't passed by the index action), renamed it to org-board.php
and created a proper index.php for global rankings. Fixed org_members column name
(user_id → player_id) in org-applications controller.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Full public-facing live tournament system:
- Public pages at /live/{slug} with no auth required
- 5 visual themes (default, neon, minimal, royal, arena)
- Live standings, pairings, bracket with auto-refresh polling
- Countdown timer, player roster, results feed, timeline
- Prize display, announcements feed, photo gallery
- QR code sharing, social share, embeddable widget
- SEO meta tags (OG, Twitter Cards, JSON-LD)
- Tournament ad slots with impression/click tracking
- Analytics tracking (views, sections, referrers)
- Admin config panel: visibility toggles, custom CSS, slug management
- Mobile responsive with dark/light mode support
- Print-optimized view

New DB tables: tournament_announcements, tournament_ad_slots,
tournament_page_views, tournament_media
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Update variables.css surfaces to match brand navy (#152132)
- Add sidebar-bg and input-bg CSS variables with fallbacks
- Add "Reset to Brand Identity" button in branding settings
- Add resetColors controller action that reverts all colors to
  their default_value from platform_theme
- Reset live DB colors to brand defaults
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add 18 org ecosystem modules: frames, invites, applications, chat,
  treasury, challenges, achievements, transfers, recruitment, events,
  content, leaderboards, partnerships, loyalty, rosters, training,
  media, spotlights (controllers + views + CSS assets)
- Add core services: SupabaseStorage, OrgPermissions, ThemeService
- Add migration 003 (23 new tables, RLS policies, indexes)
- Fix games edit not saving (wrong column names: icon→icon_url,
  matchmaking_config→config)
- Fix branding colors not reflecting (added ThemeService to inject
  DB theme colors as CSS variable overrides at render time)
- Update permissions.php with new module access for admin/org roles
- Update sidebar with org ecosystem navigation section
- Add 120+ new routes for all org modules
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

API returns {bots: [...], count: N} not a flat array.
Also fixed pool stats mapping (pool_alive/pool_idle) and portrait URLs
to use full Stockfish API base URL.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- ads: remove non-existent columns (advertiser, placement, cpm, title, body, click_url, image_url), use actual schema (campaign_type, target_slots, target_games, budget_daily)
- moderation: resolution→action_taken, resolved_by→reviewed_by (UUID), resolved_at→reviewed_at
- tournaments: el3ab_tournament_players→tournament_registrations, swiss_tournament_id→swiss_api_tournament_id
- players: remove email from insert (not in profiles), banned_at removed, use ban_expires_at
- notifications: remove is_broadcast (not in schema), detect broadcast by null user_id
- settings: is_editable→is_secret, handle JSONB value column
- auth: last_login→last_login_at
- Created el3ab_tournament_rounds table on server
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Table renames: transactions→economy_transactions, organizations→el3ab_organizations
Column fixes: user_id→player_id, last_active_at→last_seen_at, reported_id→reported_player_id,
organizer_id→created_by, actor→actor_id, entity_type→resource_type, entity_id→resource_id
Schema match: economy_transactions uses type credit/debit + reason + source_id,
audit_log uses actor_id/resource_type/resource_id/details,
org_members uses player_id, ad_campaigns uses spent_total.
Created admin_users, approval_requests, workflow_rules tables on server.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>