Changelog

Drop per-user layout editing (profile-layout API, drag handles, reset); keep bio, social links and featured badges as widgets. Two-column band grid, balanced columns, hide empty Packages, cap Achievements to 6 games with masonry cards and skip full lists for games over 200 achievements.

Replace the tabbed three-column form with a sticky section nav and full-width content. Themes get CSS-rendered previews from palettes the themes endpoint now reads from each theme file, with search and dark/light filters. Language gets a searchable grid. MCP gets stats, a copyable endpoint and compact key management. New strings live in locales/en/settings.json.

Fixes found while auditing:

• delete_account now verifies the typed account name server-side
• account deletion also removes claimed_orgs, org_claim_requests and mcp_api_keys
• saving a theme merged nothing and reset other settings (including Steam presence) to defaults; it now merges with stored settings
• mcp-keys-api rotated the CSRF token on every call, breaking a second create/revoke; it now accepts the X-CSRF-Token header
• MCP key and rate limits are constants shared by the page and server
• setTheme accepts reload:false to apply without a page reload

Footer: three flat tiers (link groups, stats strip shown only when the status API is OK, legal bar). Social buttons and stat tiles are flat fills, and the language and support buttons no longer inherit hard theme shadows. Project and Community headings are translated in all locales.

Header: rebuilt from nav-config.php with a Discover dropdown, search trigger, user menu and mobile toggle, driven by navigation.js. Header loop variables are prefixed nav so they no longer clobber page variables such as the $link closure in /changelog. Header menus close and return focus when a button inside them is activated.

PWA install: the floating install button is replaced by an Install app entry in the Discover menu's Tools group. It stays hidden until beforeinstallprompt fires, prompts only on click, hides after use and on appinstalled, and never shows in standalone mode. On iOS it toggles an Add to Home Screen hint. The update toast styles now inject with the toast and use theme tokens, and the slideIn keyframes used by two other toasts move to base/animations.css.

Themes: all 32 existing themes set tokens on html.<name>-theme instead of overriding components. Game Boy, Rust and High Contrast are rebuilt, the retro themes lose broken effects, AMOLED is flat colour, and the Game Boy sub-stylesheets are folded into one file. Eleven game-inspired themes are added (Fallout 76, Starfield, Blueprint, Control, No Man's Sky, Aperture Science, Red Dead Frontier, Mirror's Edge, Subnautica, Windows XP, Black Mesa), bringing the total to 43. Blueprint uses opaque surface tokens, a quiet canvas-only drafting grid, corner ticks and a solid tooltip.

Package page: the header kept three columns until 760px, so wide action buttons squeezed the title to one word per line near 768px. It now stacks the actions below 1000px.

Cleanup: changelog commit hashes use 7 characters, the admin .user-avatar rule is scoped to .user-profile-header, Global Stats credit links use --link for light-theme contrast, and obsolete footer and header rules are removed from the shared sheets.

Known and left alone: 311 declarations use the invalid rgb(var(--color-*-rgb) / x%) form site wide.

The page was ~6,000px of stacked bands, four near-identical bar charts and a full-width hero plus card grid. It is now three views sharing one shell, with each view loading only its own data.

Views

• Overview: live and last-24-hours stat rows, the live player chart, one daily chart with a metric selector (players, new, returning, returning share) and a compact most-played / rising leaderboard.
• Activity: growth stats with period deltas, longer online history, the daily chart with extra metrics (editor users, hours, peak), the retention curve (folded in from a standalone view that held a single chart) and the every-day table.
• Games: sortable, searchable, tag-filterable table with Show more, and the sbox.watch rising list.

Navigation

• Tabs are real links (?view=), enhanced to swap the panel from a ?partial=1 fragment with pushState, popstate and arrow/Home/End key support. The fragment is sent with X-Robots-Tag: noindex. Without script the links and a <noscript> rule still give the full game list.
• Each view has its own canonical, og:url and description. meta-tags.php takes an optional $pageMeta['canonical'] (a path with a single leading slash); pages that do not set it keep the existing strip-the-query behaviour.
• ?view=retention 301s to Activity's #retention section. Activity and Games are in the sitemap generator.

Data

• New players and sessions "today" do not exist upstream (history ends yesterday), so the page shows 24-hour totals and yesterday's new and returning players with the date. Returning share is returning / players per day.
• Rising is fetched once at the largest size and sliced for Overview so the views share one cache entry. The cached game list drops summary and orgTitle, which only the removed hero read.

Charts

• PlayerHistoryChart removes its resize listener once its canvas leaves the DOM, which tab switching would otherwise leak.
• The daily chart tooltip sits above the hovered bar, sizes to its content so it no longer wraps at the right edge, is frosted with a backdrop blur at the owner's request (a deliberate exception to the page's no-blur rule), and works on touch: a tap shows it and it lingers after the finger lifts.
• Stat values use the --fs-heading and --fs-figure tokens.

Tests

• Vitest covers filtering, sorting, the games table, the daily chart and touch. test_global_stats_grid and the new test_global_stats_meta cover the server side: view resolution, daily series, canonicals and descriptions.

Removes the unused platform-history view and the old page stylesheet.

Global Stats: platform reach row (unique players 24h/7d/30d, sessions, playtime) from stats/platform, and returning-player and editor-user charts, KPI and table columns from stats/platform/history.

Package page: Recommended Players and Play Modes in config details from Version.Extra, and the source stat on achievement cards.

Org page: all-time totals card from sbox.watch analytics/organizations.

thumbSources() now always returns the largest variant (Square 512, Wide 910) and no longer takes a target width, so org cards and other square thumbnails are no longer blurry.

cPanel cron mails any output, so staying silent when nothing changed turns the weekly run into a change alert.

Fetches the Facepunch api/list and reports added, removed and parameter-changed endpoints against a saved baseline. Whitelisted in .gitignore so the deploy ships it for the server cron.

Global Stats gets a Rising today band: the ten games gaining the most favourites and upvotes in 24 hours, from the dashboard endpoint sorted by change24h. sbox.watch redirects that endpoint unless it is requested as sort then pageSize with no kind, so the request is built in exactly that order. Cached for 15 minutes like the other digests.

Game pages show Favourites today and Upvotes today in the Player activity card, and each live server links to its sbox.watch page. Only canonical https://sbox.watch/servers/... addresses are kept; anything else (other hosts, javascript:, look-alike domains, trailing newlines) is dropped.

Unit tests cover the rising normaliser (bad idents, negatives, clamping, maps excluded), momentum parsing and the server link filter.

The page was a raw commit log: ten commits a page (splitting days), a commits-per-hour joke, a stats wall with a one-person contributor list, a Last updated line that never rendered, and a 2,262 line stylesheet inside the global bundle.

It now has a hero with a Latest card (the newest day's best changes), a four tile summary, a Highlights default view (features, fixes, performance, security) with Features, Fixes, Performance, Maintenance and Everything filters, search, clickable month columns that show quiet months as zero, and pages of eight days so a day is never split. Commit bodies become paragraphs and lists behind a native Details toggle; no JavaScript is needed. Filtered and paged URLs are noindex; legacy ?type= links still work.

Filtering, grouping, search, input validation and body parsing live in ChangelogFeed with unit tests. The stylesheet is a small per-page file and no longer part of the bundle. Radii are 4px at most, including the credits page role label.

The generator now maps the PatrickJnr git identity to Patrick Jr., so the stats show one author instead of two.

Credits is now About, Built by, Data & services, Technology, Thanks and an ownership statement, driven by backend/includes/credits_data.php. It no longer claims the project is open source, MIT licensed or open to contributions (the repository is private). Removed Redis, Fira Code, the build and lint tools and other things production does not use; added sbox.watch (with its attribution), sboxskins.gg, Ko-fi, Cloudflare, the front-end libraries and fonts that are actually loaded, and the profanity word lists with their licences (one is CC BY 4.0).

About: dropped the Redis, 'sub-200ms', '10-50x' and '10 specialized classes' claims and replaced the load-time tile with the language count. Legal: third-party list now covers advertising, Cloudflare, Ko-fi, sbox.watch and sboxskins.gg; the source code is described as private; log retention is 30 days (what the rotation script does, not 90); the IP wording says addresses are stored in full and only masked when displayed, as production has no SALT set. Last-updated date and version history brought up to date.

Translations: stale strings were removed from the 29 other locales so the corrected English shows instead, and the unused credits strings (including the old open-source ones) were deleted from all 30.

• Player activity card on game pages: rank, average and peak against the previous period, hour-of-day strip, update impact, session length, new and active players, 30 day approval trend and new vs returning players per day. Only a compact digest of the 200 KB analytics report is cached (15 min), and views tolerate digests cached before the new keys existed.
• Activity card on organization pages (peak 24h, members, last game update).
• Hourly averages keep two decimals so small games are not flattened; the chart uses decimal ticks under 4 players and draws sbox.watch history for those games as exact average plus hourly blocks up to the rounded-up peak, with the tooltip saying 'peak at least N'.

Integrates two operations of the public sbox.watch API (no key, no published licence or rate limit), server side through a new SboxWatch client.

activity-history gives platform and per-game history from before Explorer's collector existed, back to September 2025, which refills the Global Stats chart and the game Player History widget and adds 1y and All ranges to Global Stats. Our own data stays authoritative: the history API only uses sbox.watch when its series reaches meaningfully further back than ours (more than 10 percent of the range, at least an hour, or when we have nothing), one source per response, and says which in source and attribution. 90d maps to their 1y trimmed to 90 days. As the collector accumulates, sbox.watch is used for fewer ranges on its own.

packages/{game|map}/{ident} gives liveServers, which Explorer has no equivalent of, shown as a Live servers card on game and map pages. Playtime, users and sessions are not repeated; Facepunch's UsageStats already supply them. Dashboard, search, organisations, analytics and the server directory overlap existing data or would need new pages and are left alone; docs/SBOX_WATCH.md records why.

Caching is CacheManager::getOrSet per key (lock plus early expiry) with a seven day last-good copy as the stale fallback: history 5 min (24h), 10 min (7d), 30 min (30d), 6 h (1y, all); packages 5 min; a 404 is cached for the same TTL. Resilience: 3 s timeout, no retries, no redirects, 1.5 MB cap, a circuit breaker (3 failures pauses upstream for 2 min) and a budget of 30 upstream requests a minute site-wide, so arbitrary valid idents sent to the history API cannot be used to hammer them. The client builds sbox.watch's canonical URL (the default range=24h is omitted and range precedes game); anything else gets a 301 that the client deliberately does not follow.

Data is validated before use: idents (anchored with \z), allow-listed ranges and kinds, a fixed host, numeric points capped at 2000, server names stripped of control characters and clipped, escaped at output; addresses and upstream URLs are never stored or shown.

'Data provided by sbox.watch' links to sbox.watch under the Global Stats chart and the history widget when the series came from them (with a note when partialCoverage means older totals may omit games), in the Live servers card, and on the Credits page.

Tests: test_sbox_watch.php covers the normalisers and the source rule; test_sbox_watch_cache.php runs the client against a mock upstream that also enforces the canonical URL (hit, miss, 404, stale fallback, breaker, timeout, redirect, size cap, budget, and five concurrent processes causing one refresh); two chart tests cover the source being passed through. Checked locally against the live API and with sbox.watch unreachable.

Game package pages get a Play button next to View on sbox.game. It links to steam://run/590830//-rungame org.package, the same launch sbox.gg uses, and lets the browser hand the steam:// URL to Steam, with no dialog or custom launcher. It is drawn only for packages of type game and only when the identifier is valid, and it is hidden on touch-only devices (hover: none and pointer: coarse), where Steam cannot launch it.

steamLaunchUrl() in helpers.php builds the link and validates through PackageValidator, which is also what the API uses. That validator's $ anchor accepted a trailing newline, so 'a.b\n' passed; it now anchors with \z. The s&box app id lives in one SBOX_STEAM_APP_ID constant, and the three places that carried 590830 as a literal (auth callback, steam_functions twice, the inventory URL) use it. The English label is common.play; other locales fall back to English.

test_steam_launch.php checks the exact URI for pcjr.emojislots and facepunch.sandbox, more valid ids, 22 malformed or hostile ones, the view wiring, the touch-device rule, and that the app id literal stays in constants.php.

sitemap.xml is now a sitemap index over sitemap-pages, -games, -orgs, -news and -jams. Games list every public game as /org/ident/ with its Updated time as lastmod (2007 of them), orgs are the ones that have a listed game (1174) and take their newest game's time, news is the platform posts and jams the current jam idents. Pages gain /forum and /ugc/charts/game|map, which were routable but missing.

Each section is built independently. If an upstream fetch fails the earlier file for that section is kept and still listed, and a section with no data and no earlier file is left out of the index, so an API outage at deploy time no longer ships a sitemap with holes. Files are written atomically, split at 50000 URLs into numbered files, and stale chunks are removed. Idents are validated, private games skipped, and the type list keeps its existing filter.

--verify checks every static page and a sample of each dynamic section against a running server. --out is now a directory. Generated sitemap-*.xml files are gitignored like sitemap.xml.

test_sitemap.php runs the generator against a mock API: sections, filtering, lastmod, and the outage fallback.

sbox_docs gains action=refresh with target all|docs|api. It clears the cached doc pages and index, re-reads the index, and re-downloads the API schema when asked. It needs an admin per-user key or the master key, is limited to one run per five minutes across all callers, and writes a refresh_docs audit entry (admin_id 'master' for the master key).

DocsService::clearCache built its keys from the full link path (/dev/doc/x.md) while fetch() caches under the slug (x.md), so the existing admin clear_doc_cache never removed a cached page, only the index. It now strips the prefix. McpAuth::isMaster() records that the request used the master key, since that key has no Steam identity and mcpIsAdmin() is false for it.

test_docs_refresh.php covers the key fix and the cooldown.

Pages with no package, profile or post to look up all shared the homepage's description in search results and link previews. A page can now set $pageMeta = ['title' => ..., 'description' => ..., 'keywords' => ...] before including meta-tags.php.

Global Stats polled /stats every thirty seconds for three numbers. That endpoint also fetches and sums two hundred games, and reports a smaller "estimated" total when stats/platform fails, which the page then wrote over its own. /stats/live returns just the platform's players, editor users and 24-hour peak, cached for thirty seconds, and answers 503 rather than an estimate when the platform call fails.

The y-axis split the data's own maximum into five, so a 556-player peak labelled its gridlines 111, 222, 334, 445. It now steps on 1-2-5 (0, 200, 400, 600), whole numbers only.

The x-axis placed evenly spaced labels from the first sample to the last, so the 24h chart read "04:06 PM ... 04:06 PM" at its two ends. Ticks now sit on calendar boundaries in the viewer's time zone (6 PM, 8 PM, midnight labelled with the day), stepping through hours, days and months to the largest that fits the width.

The tooltip listened for mouse events only, so a phone had no tooltip at all. It now uses pointer events; a touch keeps its tooltip for a few seconds after the finger lifts, since the pointer leaves the instant it does.

load(null, { silent: true }) is the periodic refresh: no spinner, no draw-in animation, and a failed refresh leaves the chart already on screen alone.

Both consumers (the per-game widget and /global-stats) get all of this.

The admin page and scheduled-refresh both spawn tools/collect-player-history.php and aggregate-player-history.php, but /tools/* is gitignored and neither file (nor any table definition) was ever committed, so nothing in the repo could create or fill the data the API and charts read.

• PlayerHistory owns the schema (with unique indexes), the sweep, the writes and the roll-up
• a run shares one minute, so a game missing from a run that happened is zero and a missing run is a gap
• an incomplete sweep records nothing instead of dropping every game on a failed page to zero; one collector at a time; skipped inside the minimum interval so cron and scheduled-refresh cannot double-sample
• hourly/daily averages divide by the runs that happened; pruning is aligned to whole hours/days so a half-pruned hour is never rolled up wrongly

Add package/leaderboard/{v}/{ident}/{board}/u/{userid}/{scope} and jam/{ident}/entry/{package} behind validated path builders, with REST routes and docs. The authenticated Facepunch endpoints stay unwired.

The summary was worked out from the first 50 reviews. It now reads the exact Count for score 1, 2 and 3 from package/reviews, and the list can be filtered by verdict server-side with an optional score parameter.

score is validated to 1-3 and dropped otherwise. The count requests use take=2 because upstream rejects take=1 and omits Count.

A jam page shared on Discord or Twitter used the site's default og-image, so Game Jam 1 and Tech Jam were indistinguishable in a link preview. meta-tags.php already honours an image for a news post; the jam branch now does the same, and game-jams.php hands it the wide art of the jam's first winner with an alt of "My Summer Cottage: Tech Demo - Game Jam 1 winner". A jam with nothing awarded yet, like the running one, keeps the site image.

The hub cards said "Prizes" where the feature card and every detail page said "Prize pool". They all say "Prize pool" now.

The category badge and prize chip on a winner card sit over whatever artwork the entry shipped. At 65% black the white text could fall under 4.5:1 on a bright thumbnail - Terrain Pro's is a rainbow - so the scrims are 82% now, which holds the text at roughly 13:1 whatever is behind it.

Measured the rest rather than assuming: every piece of text these pages draw clears WCAG AA against its composited background, the muted 11px labels included, at 5.2:1 and up.

The four jam detail pages all rendered their winners as one flat row list, so Game Jam 1's £10,000 first place looked exactly like its £1,000 fifth, and Tech Jam's ten equal categories looked like a ranking they are not. jamIsRanked() tells the two apart - a jam is ranked only when every awarded category is titled "1st", "2nd" and so on - and the winners now render through views/partials/jam-winner-card.php: a podium of three for a ranked jam with the runners-up smaller beneath it, or an even grid of category cards for a jam like Tech Jam. Each card carries the entry's wide art, its category and prize, its org and its player and favourite counts, so a finished jam's page finally answers "who won, and was it any good" without a click. The grids use auto-fill rather than auto-fit, or a two-entry runners-up row would stretch each card wider than the first place above it.

The hub listed its four jams as text rows that said less than the detail pages did. They are cards now - status, theme, dates, prize pool, entries, how many categories were won, and for a ranked jam the game that won it. The running jam keeps its feature card and drops out of the list below, which is headed "Other jams" while one is live. The hub header was a hand-rolled .jam-hub-head; it is the site's .page-hero now, like every other page and like the jam pages it links to.

The detail pages never showed when a jam ran. The facts bar leads with "Ran 16 Feb - 17 Mar 2024" (or "Runs", live), and the hero icon follows the state instead of showing an hourglass over a jam that finished two years ago.

Removed: the dimmed winner-art backdrop behind the hero. At 12% opacity under the announcement banner it read as a rendering fault rather than a flourish, and the winner cards already carry that art at full strength. On the live jam, the prizes-and-votes grid was two equal columns, which left a 665px hole under the short prizes card; the prizes column is capped at 22rem now and the vote tally takes the rest.

Also: the newer half of the stylesheet had drifted off the design system - var(--border-color) is not a token anywhere in this codebase, so every rule naming it was silently falling back to a hard-coded rgb(); text was dimmed with opacity instead of --text-muted; font sizes were rem values between the --fs- steps. All of it now names tokens. A winner card with no package URL renders as a div rather than an <a href="#">, and .jam-winner__jam meets the 24px touch target it missed at 18px.

Verified at 1400, 820 and 390: no horizontal overflow, no heading-level skips, no console errors, every image has alt text. Load-more still pages 24 at a time and the countdown still ticks.

Game Jam III rendered all 179 entries at once: 480 package cards, 589 images, 954KB and three and a half seconds. The community vote card added another 80KB by rendering all 118 entries with votes so that a details element could hide most of them.

Entries now render 24 at a time. The Show more link carries ?show= and works on its own, and a small script fetches the same URL, swaps the grid in and updates the button and the address bar so the page never reloads. Sorting by most played, most favourited, newest or A to Z is a link rather than a script, so it survives with JavaScript off and each order has its own URL. The vote card now lists forty entries at most and says how many more are on sbox.game.

The hub was a live jam card and a four-row list, which said nothing about the jams as a whole. It now opens with what the four jams add up to - £135,000 in prizes, 478 entries, 20 categories won - and a gallery of the twenty winners across every jam, each with its thumbnail, category and prize, newest jam first. Winners come from Categories[] .Winner rather than the entry lists, which is the only source that has all of them.

Jam pages link to the jam before and after them, so the four are browsable without going back to the hub each time.

New styles follow the 4px radius the rest of the site uses and the card bodies are padded, both measured rather than eyeballed: the winners gallery, entry controls and jam navigation all sit 17px off the card edge at 1400px.

Forums. The index listed thread and post counts and nothing else, so a forum with 489 threads looked the same as one with 29. Each forum now shows its newest thread with who replied last, the page opens with the six most recent threads across every forum, and the header states the 2,635 threads and 12,417 posts the whole board holds.

Thread lists gained sort controls covering the four orders the API takes - latest reply, newest, most replies, most viewed - along with the author's avatar, when the thread started, and a last-reply column that links straight to the final page rather than the first.

Thread pages gained numbered posts with per-post anchors, a highlight and a badge on whoever opened the thread, an edited marker where the edit came more than a minute after the post, a back link to the parent forum, and a windowed pager at the top and bottom instead of bare previous and next links.

The forums are now reachable from the rest of the site: a top-level nav entry, the five newest threads on the homepage, and a card on player profiles showing threads that person started or replied to. There is no endpoint for a user's posting history, so that card reads the active thread listings and says so rather than implying it is complete.

One batch of ten calls feeds all three of those, cached for fifteen minutes. Only /forum itself is allowed to pay for a cold fetch; the homepage and profiles render from cache or skip their block, because Facepunch serialises concurrent thread listings and fourteen of them took fifteen seconds. The index and the homepage previously warmed two different cache keys, so the homepage block could never have populated.

Global Stats. Eight equal-weight metric cards opened the page with no sense of which mattered, and four unrelated sections followed with no headings between them. The page now leads with five headline numbers - players now, 24h peak, in the editor, players per day and new players, the last two carrying their week-on-week change - with catalogue size demoted to a single quiet strip. Everything below is grouped under Right now, Growth, Retention and Top games, with jump links in the header. Every id and class the page's scripts bind to is unchanged; the metric card styles they replaced are deleted.

Padding and radii. The new cards inherited no body padding, so icons and text sat flush against the card border, and the new sheets had invented pill shapes and 7 to 14px corners. Radii now come from --radius-sm like the rest of the site, which caps at 4px; the only exception is the 50% on avatars, matching the site's existing use.

A single day's cohort was too small to read: facepunch.sandbox's was 39 players, which put a 0.0% on both the day-7 and day-30 tiles and left gaps in the bars that looked like missing data rather than churn.

Retention now pools the seven daily cohorts ending 35 days back, which is the oldest window where every cohort still has a full day-30 point. Pooling is weighted properly - day N is the sum of returning players over the sum of cohort sizes, not an average of ratios - so sandbox reads 305 players instead of 39 and the curve stops flickering between zero and one player.

Each package curve now draws the platform curve behind it as a dashed line and each tile says how far above or below average it sits, which is the only way a number like 14.8% means anything. The chart gained a percentage axis, a flat marker for days nobody came back, and day labels every five days instead of thirty crowded ones.

The seven upstream calls go out in one parallel batch and cache for six hours, including the empty answers, so a package with no cohort pays the cost once.

Stat names are humanised from their raw idents, a prefix every stat in a package shares is dropped, and the card lists the four largest with the rest behind a disclosure. The old 'N more stats' link pointed at the package page, which shows the viewer their own stats - on someone else's profile it led nowhere useful.

The api/list sweep turned up five public endpoints nothing on the site read. Four now render; the fifth is confirmed dead upstream and is not worth another attempt.

Forums. forum, forum/{slug}/threads and forum/thread/{id}/posts are fully public and had no presence here at all. /forum lists the 18 real forums grouped by category, a forum lists its threads, and a thread renders its posts with each author linked to their existing profile page. The index also carries 4,722 auto-created per-package forums (Parent "p"); those are filtered out of the index because almost all are empty, and surface instead as a Discussion tab on the package page, which only appears when that package actually has threads.

Post bodies are Trix HTML written by other people, so they go through a new sanitiseForumHtml(): a DOMDocument pass with a tag allowlist, an attribute allowlist of href/src only, http(s)-or-relative URL checks, and rel/target forced on links. Everything else, including the data-trix-attachment payloads and any class or event handler, is dropped. The posts endpoint returns no thread title and no forum, so listings cache each thread's title and forum as they are rendered and the thread page reads that back, falling back to an excerpt of the first post when nobody has browsed the listing yet.

Per-user package stats. package/stats/2/{ident}/u/{steamid} is public and returns a full per-stat breakdown. It fills a new In-Game Stats card on player profiles for that profile's three most-played packages, and a "Your stats in this game" table on the package page for the signed-in viewer. Values outside a readable range are shown as an em dash with a count of how many were suppressed: facepunch.sandbox reports damage_taken as 6.8e38, which would otherwise wreck the column.

Review by steam id. package/reviews/{ident}/{steamid} gives one user's review directly, so the package page can show the viewer their own review without paging the whole list.

Retention. stats/platform/retention and package/{ident}/retention share one partial. Two upstream quirks drive the shape of it: a day with no returning players omits Users and Retention entirely rather than sending zeroes, so bare {"Day":3} rows are read as 0% instead of being skipped, and the curve stops at day 30, so the default cohort is 35 days back to keep a day-30 milestone. Cohorts under 20 players are not drawn at all; facepunch.walker's cohort is one person and produced a flat 0% curve that looked like a bug.

Not wired: package/leaderboard/{v}/{ident}/{stat}/u/{id}/global and /country answer 200 with an empty body even where the user is rank 1 of 1, /friends is 401 and version 2 does not exist. player/{id}/feed is 404 for every id tried. The existing package/{ident}/leaderboard/{stat} call already returns what those promised.

formatRelativeDate() takes a prefix argument now; it hardcoded "Published", which reads wrong on a forum reply and on a stat timestamp. Existing callers are unaffected.

The jam list already holds the theme, prize pool, entry count, deadline and full timeline, and jam/{ident}/voting holds the live tally. All of it was being thrown away after the one bit the badge needed, so the package page now shows the rest.

packageJamStanding carries the jam's facts and its current and next timeline step, worked out from dates rather than the Phase number, which has gaps. jamPackageRanks reads the package's position out of the tally by reusing jamTally, so competition ranking - two entries tied on twelve votes are both second and the next is fourth - is the same rule the jam page already uses.

The detail page gains a rail card - placing, theme, phase, what happens next and when, entries, prize pool - and its chip now reads "Game Jam III · 1st in Best Game" while voting is open. Package cards and org cards get a badge too.

The voting call is the only new upstream request, so it is made only when a package is actually in a live jam with community voting, and only by the detail page: fetchPackageJams takes withRanks, and the grids leave it off. The jam list and entry index are memoised per request, so a page of forty cards costs one lookup rather than forty. Measured: 0.004s warm for the detail page, 0.001s for forty cards. The jam page suppresses the badge on its own grid, where every card is an entry in the jam being viewed.

Live check: limestudio.roundbound reads 1st of 48 in Best Game on 40 votes, phase Building, next Nominations, theme One More Round, pool £50,000.

The package payload carries nothing about jams, so membership has to come from the jam endpoints. Two sources are needed, not one: the entry search (package/find/2?q=jam:X) is incomplete - Game Jam III reports 76 entries but returns 53, and seven of Tech Jam's ten category winners are absent from it entirely, because winners were not always tagged as entries. Category winners are therefore read from the jam list itself, which is already fetched and costs nothing extra, and unioned with the search results. A package that won a category it was never listed in still gets its badge.

packageJamStanding is pure so tests/test_jams.php can pin the rules without the network; the ident->jams index is built once and cached for an hour, since entries only move while a jam is live.

Verified against the live API: limestudio.roundbound resolves to a Game Jam III entry, gbonn.surreal to a Tech Jam "Best Least" winner, and a package in no jam to nothing.

The page had not changed since May, and several things on it were wrong:

• It advertised AND, OR, NOT, phrases and parentheses. Facepunch's search has none of these, so the syntax panel and the script that validated it (advanced-search.js, loaded on every browse page and used by nothing else) are gone.
• "101 results found" for car was a count of what had been grouped; the real total is 3,704. It read a total key the fetch never returned.
• It asked Facepunch for 500 packages per search, which takes ~10.7s upstream, to show 10 per type. It now asks for 200 (~1.7s).

The page now uses the browse layout: the same header, search box and type chips, the organization matches as a row (with an exact organization match first when the query is one), then one row of the standard package cards per type, each with "See all" into /t/{type}/?tags={query}. The number of cards follows the grid so every breakpoint shows full rows. ?type= goes straight to that listing.

That listing now says what it is: "Models matching "car"" instead of "Browse Models", and type names come from the translations, so /t/vsnd/ reads "Browse Sound Files" rather than "Browse Vsnds". Addons, collections, decals, entities, terrain materials and tutorials get English names.

search-results.css and advanced-search.css keep only the rules other pages still use.

Global Stats worked out "Playing Now" by paging through every game - four requests, about 2.5 seconds - and adding up UsersNow. Checked against stats/platform that missed about 8% of players, everyone in a game with no public listing, and it had no way to see the editor at all.

Worse, the live counter that polls /api.php/stats every 30 seconds summed only the top 200 trending games, so two seconds after the page loaded its all-games figure was swapped for a smaller one. Both now read stats/platform, the platform's own count, with the old sums kept as the fallback and is_estimated saying which one a caller got.

The page gains "In the Editor" - 122 against 108 playing when checked, more people building than playing - and a 24h peak that is there on load rather than waiting for the chart script to fill it.

The new "Last 90 days" section is from stats/platform/history, which gives daily unique, new and returning players, peak concurrency and playtime. It shows the trend the old page could not: daily players down from about 5,500 in June to about 2,000, new players from ~450 a day to ~40.

• Two single-series charts rather than one stacked. New players are 2-8% of daily players and would be an invisible sliver on the same bars; a second y-axis would invent a relationship between two scales.
• Plain HTML columns, not a stretched SVG, so the rounded ends and axis text stay crisp. The whole column is the tooltip target, and every value is also in the table behind "Every day as a table".
• The range ends at midnight so the last bar is a finished day, not a partial one reading as a collapse. Week and month comparisons only ever compare complete windows of the same length, and say nothing otherwise.
• Phones get the last 30 days; 90 columns at that width are hairlines.

Facepunch's public API has carried jam data all along - timelines, prize ladders, winners by category and a live community vote tally - and nothing on the site read it. Game Jam III is running now (building until 25 Sep, results 3 Oct), so this is the moment the page is worth most.

/game-jams lists every jam and features the live one. /game-jams/{ident} shows the phase timeline with how far through the current phase it is, what each place pays or who won it, the community vote ranked, and every entry through the existing package cards.

Not /jam or /jams: sbox has organisations with both idents, and a route here would have shadowed their pages. /game-jams is free.

Some decisions the data forced:

• One upstream call serves both pages. The jam list is byte-for-byte what jam/{ident} returns for each jam, so the detail page reads from the list, and a real jam cannot 404 because a second call failed during an outage.
• Timeline state comes from dates, not the Phase number. The numbers have gaps (1, 2, 4, 5, 6, 7) and the older jams skip steps, but every step has a date.
• Seven of Tech Jam's ten winners were never tagged as entries, so they showed as bare idents. The missing winners, and only those, are fetched through the existing package batch.
• Entries are filtered by the jam's own Query rather than a string built here, so a change to how Facepunch tag entries is followed automatically.
• Vote ranks are competition ranks with ties ordered by ident, so the list does not reshuffle on every cache refresh.
• The public list can be shorter than EntryCount (44 of 64 for Jam III), and the page says so rather than implying the grid is everything.

fetchCachedEndpoint() is the fetch-fresh-else-serve-stale shape that fetchPackageStats already used, pulled out because every new endpoint wants it. The platform stats fetchers beside it are used by the next commit.

tests/test_jams.php covers the timeline, relative dates, ranking, ties, unlisted entries and prize shapes: 42 checks.

tippy-init.js warned "Library not loaded" on every page. It was the one entry in theme-manager's vendor list with a real consumer, and emptying that list left the initialiser, frontend/css/vendor/tippy.css and 55 title attributes on a package page all shipping with nothing to drive them.

Loaded in the footer above tippy-init.js rather than through the vendor loader, because that one injects asynchronously and would race it; defer keeps document order. The plain UMD build, not -bundle, because -bundle only adds tippy's own stylesheet, which would land after ours and undo the skin. Popper is a separate global either way. Both pinned with integrity - they are third-party and executable.

tippy.css only ever held the skin, which nobody noticed because it was never exercised: with arrow: true the arrow needs the geometry from the core stylesheet or it does not render at all. That structure now sits above the skin in the same file, so the colours still win.

The .gitignore change is why that file was awkward to commit: `vendor/` matches at any depth, so it swallowed frontend/css/vendor along with Composer's directory - the explicit fontawesome line below it was a workaround for the same thing. Anchored to the root it actually meant.

Verified in Chrome against a package page: tippy and Popper both defined, 65 elements initialised, the native title removed so tooltips do not double up, and the box measured 97x36 with a 4px radius and a drawn arrow.

The leaderboard is reworked and profiles move onto the shared surfaces, finishing the v2 pass over the public pages.

Fixes found while sweeping the result: the news list claimed the feed had ended while posts were still unreachable, and its layout is now one wide post over rows of three as the live site has it; one page width throughout; a brand blue that actually passes AA; the no-radius-over-4px rule enforced rather than just stated; media named as upstream sends it, so a 404 upstream stops being reported as ours; the award index unstuck; and every page given a real title.

v2 stops being opt-in. The package rail gets one inset rather than several competing ones, and its changelog link goes somewhere real.

The chart pages, the homepage below the hero, and global stats are rebuilt on the same card language, so the four highest-traffic pages now read as one site.

Pages disagreed about where content starts. Every page now shares one header and one measure, and the tops line up rather than each page beginning at its own offset.

The news article pages are rebuilt on the v2 language and the news list is paged instead of loading everything at once.

Releases 2.0.0.

The site had grown several competing sets of sizes, weights and corner radii, so two pages built a month apart did not look related. This introduces the kit every later page is built from: a single type scale, a single radius scale, and shared surface tokens.

The package and organisation pages are rebuilt on it as the first v2 view, and every public page is then measured and corrected against it rather than adjusted by eye.