Changelog

v0.18.681Fix: spawn posts no longer show a height of -1

• Almost every vehicle spawn in the game log carries a height of -1, which only means "put it on the ground". Spawn posts now show X and Y alone in that case, and the height only when the log gives a real one.

v0.18.680Vehicle spawns show their exact coordinates

• Every vehicle spawn post now shows exactly where the vehicle appeared, as X and Y (and its height), next to the nearest town and the map pin, so admins can find a vehicle or remove it.
• Before, a vehicle spawn only showed coordinates when the server's location format was set to coordinates. If you set vehicle spawns to Approximate or Hidden under Location Visibility on the dashboard, that still applies.

v0.18.679Fix: the base parts table pairs built and taken down

• On the Base Inspections page, a part built and later taken down now shows on one line. The game logs a gate as built on a gate but taken down from a fence, and drops the level from watchtower parts when they come down, so they used to show on separate lines.

v0.18.678Base inspections show what was built at each base

• Every base card now has a Structures line: the fences, gates, watchtowers and flag poles standing there, and how many metal walls, wooden walls and barbed wire, counted from the last 30 days of logs as built minus dismantled.
• The dashboard Base Inspections page shows the same, plus a table of every part built or taken down at the base (frames, floors, stairs, platforms, roofs and the rest).
• Structures are shown for the inspector; they do not count towards the storage points.

v0.18.677Fix: a server whose RPT log never catches up no longer silences everything else

• One server's posts had stopped since 2026-09-08. Its game server writes 38 to 45 MB of RPT log every two hours (much of it one mod's debug line), about twice what .bOne could read, so .bOne treated every cycle as old backlog and announced nothing: no base pings, bounties, achievements, quests, Event Map or build history, though its kill and connect log was fully caught up.
• Each event now follows its own log: kills, connects, builds and everything from the admin log are live as soon as that log is caught up, however far behind the RPT log is. Loot and dynamic events from a lagging RPT log still wait.
• .bOne now reads up to four times more of a lagging log per cycle, and if a server is still behind after an hour or more, it skips ahead to the live end of its RPT log and says how much it skipped.
• New: .bOne notes in its log whenever it was too busy to answer for more than a second, so a command that times out can be told apart from Discord delivering it late.

v0.18.676Fix: a channel .bOne cannot reach is noted once an hour, naming the server

• When a server takes away .bOne's access to its Moderation Log, level-up or ticket log channel, .bOne now notes it once an hour as a warning that names the server, the same way the feeds already did. Before, every post logged an error that did not say which server it was, sixteen times in one day for one server's Moderation Log.

v0.18.675Base inspections and a trader panel

• New: /base, a register of bases for staff inspections. Each base card shows its storage counted in points against a cap you set, when an owner or member was last seen inside it, whether its flag is up, its status and notes. Mark Checked records what you counted; until a base is inspected, the card estimates its tents, barrels, chests, crates and shelters from the last 30 days of logs (an estimate that can run high, since a container moved is logged again, so inspect to confirm).
• Bases with something to look at are flagged: Abandoned? (no member seen for 21 days, or your own number), Over the storage limit, Flag lowered, Never checked. /base list issues_only:True shows just those.
• The dashboard has a Base Inspections page under Bases & Zones with every base, the same actions, and the storage rules (points per container, the cap, the abandoned days, the default radius). Each flag pole on the Base Pings page has Add to Base Inspections.
• New: /trader, a live panel showing each trader as open or closed. Staff press a trader's button to open or close it, the panel updates, and an announcement goes out pinging only the role you choose. Up to 10 traders, each on one of your servers. Also on the dashboard Traders page under Events.
• Two new Moderator Permissions: Base Inspections and Traders, off until you turn them on.
• /hug, /kiss, /punch, /crashout, /smd and /f__k are now /action hug, /action kiss and so on, the same messages and gifs. This made room for /base and /trader under Discord's 100-command limit.

v0.18.674Rotation: run several pools, each on its own schedule

• A server can now run up to 10 rotation pools side by side. Each pool has its own files, how many are live at once, and when it swaps: one pool of airdrops can swap at every restart while a pool of convoys swaps every 6 hours.
• Make one with /rotation setup pool:Convoys, or on the dashboard Rotation page pick A new pool when you set up. Your existing rotation carries on exactly as it was, as the Main pool.
• Every /rotation command has a pool: option for when there are several. /rotation status shows every pool at once, and /rotation now swaps them all unless you name one. New: /rotation rename and /rotation delete.
• A file can take turns in one pool only, so one pool can never pull out a file another pool has live. Deleting a pool takes its files out of the server at the next restart.
• Pools that are due at the same time swap together in one change to cfggameplay.json.

v0.18.673New: /rank shows what earned your level

• /rank shows your level, your place on this server and XP to the next level, plus your voice time, messages sent and emojis used, each with the XP it earned. Reactions, replies, GIFs, stickers and images show once you have some.
• Use /rank user:@someone to see another member. /level view now shows the same card.
• Counting starts today, so the breakdown fills in as people chat and talk; XP from before shows as its own line so it still adds up. When levels reset, the breakdown starts again too.
• Every message, reaction and minute in voice counts, even when its XP is on cooldown or that kind of XP is switched off.

v0.18.672Auto-bans respect what you just changed on the dashboard

• Fixed: after you released a zone or base ping auto-ban, or protected or whitelisted a gamertag on the dashboard, the bot could still act on its older copy for several minutes: it counted more offenses, made a released ban longer, and the ban showed as active again.
• Zone auto-bans, base ping auto-bans and PvE mode now check your latest dashboard changes before every automatic ban.

v0.18.671/shop always gets you to the store

• Running /shop with a delivery choice when you have nothing bought yet now gives you your store link, with a note that nothing is waiting, instead of "Nothing to deliver".
• The /shop delivery choices now say what they do: "Send what I already bought to my saved spot" and "Send what I already bought to where I am now". To buy something, run /shop on its own.
• If you have not linked a gamertag, commands like /shop, /spin and /bounty now just tell you to run /link set, instead of asking for a gamertag option those commands do not have.

v0.18.670Cleaner wording on the dashboard and in replies

• Text on the Punishments, Protected Gamertags, store, prize wheel and player profile pages, the /radio and /embed lists, the weapon jam summary and a few older changelog entries now reads in plain sentences.
• Empty boxes say what is missing instead of showing a dash: "Not set" for a radio frequency, "None" for a ticket with no priority, "No title" for a sticky message, "N/A" for an unranked player.

v0.18.669Accurate pictures on the event feeds

• Every picture on the world-event and vehicle feeds was replaced with the right one: the image from the DayZ wiki page for the exact thing that spawns, each one checked by eye.
• Heli crashes now show the wreck your map really has: the UH-1Y on Chernarus, the Mi-8 on Livonia and Sakhal. Police cars and police situations show your map's abandoned police car (Olga 24, Ada 4x4 or Sarka 120).
• Boat spawns show the rubber boat that actually spawns, not a wooden rowboat. Gunter 2, Sarka 120, Olga 24, Ada 4x4, M1025 and M3S spawns each show that vehicle.
• Military convoys, trains, Santa crashes and contaminated zones each have their own up-to-date picture.
• A vehicle the bot cannot identify (a mod, or a server's own custom event) shows no picture rather than a wrong one. You can still set your own picture for any feed on the dashboard.

v0.18.668No more backup files for every store delivery

• Store deliveries no longer leave backup copies of the store file (BoneStore.backup.json and dated copies) on your server after every purchase, or after the delivered items are taken out at a restart. The file is still swapped in safely: if a save fails, the previous one is put back.
• Edits you make yourself through .bOne (events, teleporters, base damage, gameplay settings) still keep a backup, so they can be undone.

v0.18.667Clear answer when cfggameplay.json has a typo

• When your cfggameplay.json has a mistake in it, teleporter setup, base damage, event rotation and the store now tell you the line, the column, what is wrong and what that line says, instead of a raw error. For example: line 120 has an extra "." after "custom/EventBooksCig.json",. Nothing is changed until the file is fixed.
• Fixed: removing a teleporter (or one expiring) while cfggameplay.json had a typo deleted its files but left them listed in the file, so once the typo was fixed the game looked for files that were gone. The teleporter is now kept until the file can be read.

v0.18.666Auto-ban unlinked: grace period in minutes

• The grace period for auto-banning gamertags that never link is now set in minutes instead of hours, on the dashboard (Server Config) and with /link admin autoban grace_minutes. Any whole number from 5 to 40,320 (28 days) works; 60 is an hour, 1,440 a day.
• Your current setting carries over unchanged; it just shows in minutes now.
• A grace period outside that range is now refused with a clear message, and nothing is changed. Before, the dashboard quietly ignored it and saved the rest of the form.

v0.18.665Quieter, clearer logs when a server takes permissions away from .bOne

• When a server removes .bOne's permissions for a channel, the feeds, leaderboard, online players board and online count now note it once an hour, saying the server took the permission away, instead of reporting an error every few minutes. Nothing changes on your server: give .bOne its permissions back and everything posts again on its own.

v0.18.664Cleaner kill feed and every game feed

• Every feed post now reads the same way: one headline saying what happened, to whom and at what server time (for example, RaidKing99 killed Sniper at 14:32:07), then the details side by side, then where it happened on one line.
• Kill cards: the weapon, distance and hit sit in one row; the killer and victim records sit next to each other; the shooter and victim positions share one Location line. A simple kill (a zombie, a bear, a fall) is now just two short lines instead of a screenful.
• No more "No further detail parsed" lines: details only appear when the game logged them.
• Joins, leaves, deaths, building, flags, stashes, chat, world events and cheat alerts all use the same layout, so a busy feed is much shorter.
• Base ping, zone, PvE and bounty alerts show their location on one line the same way.
• Nothing was taken away: every number and name the old posts showed is still there, and your location privacy settings work exactly as before.
• Fixed: the off-map alert wrote the player's exact position into its text, so it showed even where the feed hides locations.
• Fixed: a gamertag with odd characters could break the formatting of zone, PvE and bounty alerts and of cheat alerts.

v0.18.663Moderation Log: deleted messages from before a restart

• A message deleted by a moderator now shows who wrote it and who removed it even when it was sent before .bOne last restarted (it used to say only "Unknown"). If several people had messages removed in that channel at the same moment, the post says it could not tell whose it was rather than guess.

v0.18.662Moderation Log: everything about every action

• Every Moderation Log post now says who did it, read from Discord's own audit log: who banned, unbanned, kicked, timed out, renamed, changed roles or deleted a message, with their reason. Actions .bOne takes by itself say so.
• Every post now describes the person in full: their name, display name and ID, when the account was made (new accounts under 7 days are flagged), when they joined, their roles, their linked gamertags and how many warnings they have.
• Deleted and edited messages show the whole text, attachments, stickers, the message ID, when it was sent and the message it replied to.
• New: timeouts (and timeouts lifted early) are logged with when they end.
• New: bulk deletes, including /purge, are logged with who ran them, whose messages went, and a file of every deleted message.
• Joins show which invite was used and who made it. Leaves say whether the person was kicked or banned, and how long they had been here.
• Auto-mod, bot trap, account link and warning escalation posts carry the same detail, plus the rule, what was done, whether a gamertag has played on your server, and the latest warnings.
• Kicks and temp-bans that could not be fully undone now post the whole case (gamertag, server, who gave it, reason, start and end) instead of one line.

v0.18.661Fix: changing a whole big store at once

• Fixed: on the Store & Economy page, blocking a role, setting a price or limit, moving to an aisle or removing items failed for any selection of more than about 1,000 items, with a "something went wrong, try again" message. Any number of items now works in one go.
• New "Select all" button under the item list ticks every item in the store, every page included, and "Clear selection" unticks them all. The box at the top of the list still ticks just what is shown.
• If a dashboard form is ever too big to accept, it now says so plainly and that nothing was changed, instead of asking you to try again.
• Moving items to an aisle from the "Change many at once" bar now follows the same 30 character aisle name rule as everywhere else.

v0.18.660Dashboard: related pages together, with tabs

• Pages that belong together now sit in one section with tabs along the top, and the hub shows one card per section. Each card lists its tabs, so you can still jump straight to any of them. The sections: Store & Economy (now with Bounties, Modded Items, Loot Stock and Transfer Audit), Bans & Access, Bases & Zones, Cheat Detection, Staff & Roles, Join & Leave, Events, Maps & Feeds, Server, Channels and Tickets.
• You only see the tabs you are allowed to open.
• Heatmap, Leveling, Welcome, Goodbye and Player Reports now let you pick their channel right on the page, instead of sending you to Channel Management.
• The Whitelist page now adds and removes gamertags itself, and shows who is on the list once you check its status.
• Fixed: moderators given the Live Channels permission could not find the Live Channels page on the dashboard.
• Fixed: restoring a backup on the dashboard, in a server that has both the old Benches Bot and .bOne, could hand the server to the retired bot, which stopped its feeds until the next restart.
• Base Pings no longer points you to Server Config for its alert channel: it is set on Base Pings itself.

v0.18.659Fix: /remove auto-channels run from one of its own channels

• Running /remove auto-channels from one of the channels it removes used to end in an error, and you never saw what was removed: the reply went with the channel. The result now comes to you by DM instead (if your DMs are closed, the removal still finishes; it just can't tell you).

v0.18.658Store & Economy: everything on one page, and items edited right in the list

• The Store & Economy dashboard page now holds everything for your store and economy, and opens on your items. The Item Catalog is now its Add Items tab (with Pricing Defaults), Income is its Role Pay tab, and the suspicious transfer report is on its Cash tab. Old links to those pages still work and open the right tab.
• Change an item right where it is listed: click its name, aisle, price or quantity, type the new value, and press Save changes. Change as many items as you like first; they are saved together, and the page asks before you leave with changes that aren't saved.
• If someone else changes an item while you are editing it (with a /store command, or another admin), your save skips that item and tells you, so nobody's change is lost.
• Pricing Defaults can now update your store: change a price there and every item that still has the suggested price follows it. Prices you set yourself are kept. Untick the box to change only the suggestions for items you add later.
• Add Items shows only the items that are not in your store yet.

v0.18.657The XML Validator can Format and Compress too

• The XML Validator now has the same tools as the JSON one: Format, Compress, Copy, Clear and Load Sample (a small types.xml).
• Format puts each tag on its own line, four spaces a level. Compress puts the whole file on one line. Neither changes what the file says: comments are kept (including switched-off entries), and anything inside a tag, like <nominal>5</nominal>, stays exactly as written.
• Comment markers in both validators now show exactly as typed; the font was drawing them as arrows.

v0.18.656New JSON and XML validators, one step each

• The website has a new File Validators menu in the top bar, with a JSON Validator, an XML Validator and the Mission Folder Check.
• Each validator is one box: paste your file (or upload it, or drop it on the box) and it is checked straight away. If something is wrong, the line is marked in red in the box, the cursor jumps to the exact spot, and it tells you what is wrong and how to fix it. Fix it and it turns green as you type.
• The JSON Validator can also Format, Compress and Sort Keys, Copy, Clear and Load Sample. Formatting only changes the spacing: numbers, IDs and repeated keys stay exactly as you wrote them.
• It still knows DayZ files: types.xml, events.xml, cfggameplay.json, object spawner files and more get their DayZ settings checked too. Paste XML into the JSON Validator (or the other way round) and it says so, with a button that takes your text to the right one.
• Your files are checked on your own computer and are never uploaded.

v0.18.655Rotation set up in one step, and /mylocation links to the map

• Rotation is much quicker to set up: run /rotation setup and .bOne lists the event files in your mission's custom folder. Tick the ones that should take turns and you're done; it turns rotation on and swaps straight away. Add at_once: for how many are live at a time and swap: for when (every restart, or every few hours). The dashboard Rotation page does the same: press Find My Event Files, tick, save.
• You no longer type file paths. Several servers had rotations that never worked because a path was typed slightly wrong (missing the custom/ folder or the .json); setup only offers files that really exist, and recognises your old entries so they start ticked.
• Every swap now takes all of the rotating files out of cfggameplay.json before putting the live ones back, so a rotating file that had also been added by hand finally takes turns instead of staying on all the time.
• /mylocation now includes an Open on iZurvive link to where you are (and to your saved delivery spot), straight away, so there is no need to type the coordinates in yourself.

v0.18.654New: /player crossed, did two players cross paths?

• New for staff: /player crossed player:<gamertag> other:<gamertag> answers whether two players crossed paths, yes or no, and lists each time: when they were together (within 30 m), or when one turned up where the other had been within the previous 6 hours. That second kind is how someone supplies their own unlinked alt: drop a kit, log off, the alt logs in and picks it up.
• Each line says when, how close, and where, with a map link. It looks back 7 days unless you add days: (up to 30), and needs the Map permission; only you see the answer.
• It's a lead, not proof: the server log never shows items changing hands, and positions are logged about every 5 minutes, so a very quick meeting can be missed. .bOne starts keeping the position history today, so it can only look back to today.

v0.18.653Income rebuilt: pay Cash to roles, automatically or with /income

• Income is now role pay. Admins choose which roles earn how much Cash each payday and how often payday comes, then how members get it: Automatic (.bOne pays everyone with those roles every payday) or Claim (members run /income to collect). Set it up with /store admin income or on the dashboard Income page, separately for each DayZ server.
• A member with several paying roles is paid for every one of them, added together. Pay goes to their linked gamertag; members who haven't linked are told to /link set.
• Claim mode: you choose whether a member who misses paydays gets just one when they next claim, or saves them up to a limit you set. Automatic mode: optionally post each payday in a channel (how many members were paid, and how many need to link).
• /income shows every member what their roles earn and when the next payday is. The old hours-worked submissions and approvals are gone. If you had hourly rates set up, your roles and amounts were kept, but income is switched off until you check the amounts (they're now per payday, not per hour) and pick a mode.

v0.18.652Fix: restart reasons now survive a bot update

• Some restarts showed no reason in /logs restarts. .bOne notices a restart a while after it happens (often 10 to 15 minutes later), and if the bot was updated in between, it forgot why. It now keeps that with your server's saved settings, so the reason is still there however late the restart is noticed.

v0.18.651New: crash alerts, and why each restart happened

• When your DayZ server crashes, .bOne now tells you: an alert in your Server Monitoring channel (or the Moderation Log if that isn't set) saying it was a crash, not a planned restart. DayZ writes a crash report when it crashes instead of shutting down cleanly, and that is what .bOne looks for, so a normal restart never sets it off. Three crashes in three hours is called out as a crash loop, with what to check.
• /logs restarts and the Server Logs page now say why each restart happened, from the reason Nitrado records: your Nitrado schedule, .bOne's schedule, the restart button in the Nitrado panel, someone's restart command (with their name), an app, Nitrado host maintenance, or Crashed.
• Some servers restart themselves on a timer (often deathmatch or mod setups) without asking Nitrado; those show as restarted on their own, cleanly, never as a crash.

v0.18.650New: prove a gamertag is yours with emotes (optional)

• New, off unless you turn it on: Emote Proof for linking. With /link admin proof enabled:True (or the switch on the dashboard Account Links page), a member who runs /link set or uses the Player Hub isn't linked straight away. They are given two emotes, like Clap and Salute, to do in game as that gamertag within 30 minutes, and .bOne links them as soon as your server's admin log shows both. They get a DM when it goes through.
• Only whoever is playing that character can make it do the emotes, so nobody can claim someone else's gamertag to collect their Cash, rewards or roles. Links staff make with /link admin set or on the dashboard still go straight through.
• The emotes are ones a check of real server logs showed DayZ records. The log reaches .bOne every few minutes, so allow up to 10 minutes. /link status shows what you still have to do. Try it once yourself after turning it on: it relies on your server's admin log recording emotes, which most do.

v0.18.649New: player reports

• Members can now report a player to the staff: /player report with a reason and their gamertag (start typing to search players seen recently) or their Discord account, plus an optional screenshot or clip. Or right-click any message and choose Apps, Report to staff, which sends the message along with it.
• Only staff see reports. Each one posts in your Player Reports channel, or your Moderation Log if you have not set one, with Claim, Resolve and Dismiss buttons. Claim shows the others you are on it. Resolve and Dismiss ask for an optional note, and the member who reported it gets a DM saying it was dealt with, with your note. Your name is never shown to them.
• The same queue is on the dashboard, on the new Player Reports page under Moderation. Admins can handle reports straight away; to let moderators handle them too, turn on Player Reports on the Moderator Permissions page.
• To stop spam, each member can have up to 3 reports waiting and send one a minute. Nobody can report themselves.

v0.18.648New: busy-server ping, restart DMs and wipe dates

• New: a ping when your server gets busy. An admin runs /online-count alert players:30 and .bOne makes a role, then posts a Ping me button in that channel. When the server reaches 30 players, everyone who pressed Ping me gets pinged, so people who like a lively server can jump on. Nobody is pinged unless they chose it, and Stop pinging me takes them off. Members can also use /online-count notify.
• It pings once per busy spell: after a ping it waits until the count has dropped a little below the number before it can ping again, and it never pings more than once an hour, so a count hovering on the line stays quiet. Also on the dashboard, on the Live Channels page.
• The ping role can never be one that unlocks anything (extra permissions or access to a channel), because anyone can give it to themselves with the button. That is checked when you set it up and again every time someone presses the button.
• New: restart DMs. Any member can run /remind restarts to get a DM 5, 10, 15 or 30 minutes before each restart. It follows your restart schedule, or else the one in the Nitrado panel, so it works whichever you use. It sends a test DM first, so nobody signs up for DMs that can never arrive; when:Stop stops them. /remind list shows them.
• New: wipe dates. Admins set the next and last wipe with /wipe dates (or on the Server Config page, Backup & Wipe tab), with an optional time and a short note. Anyone can check with /wipe when, and /status shows the next wipe. Discord shows everyone the date in their own timezone. A wipe that goes through fills in the last wipe date by itself.

v0.18.647New: Loot Stock

• New dashboard page, Loot Stock (under Economy): which items your map is short of, straight from your server's own log. DayZ keeps a target number of every item on the map and tops it up when it falls below its minimum; your server writes down every item it is short of, and this page shows the latest figure for each.
• Items are sorted worst first: none on the map, below the level DayZ refills at, and below target. Each group explains what it means, and what to check in types.xml when an item stays empty (usually its usage and value flags, or a target higher than the map has room for). Search to find one item.
• It fills in as the bot reads your log, so give it a little while after a restart. Moderators need the new Loot Stock permission to see it.

v0.18.646Event Creation: see when events went off, and no surprise strikes on bases

• New: When Your Events Went Off. The Event Creation page (and /createevent, under When Events Went Off) now shows when DayZ actually started each of your events, straight from the server's own log: the time on the server's clock, when the bot saw it, how many times, and where. DayZ starts an event a while after the server comes back up, not the moment it restarts, so this is how you know it worked.
• New: placing an airstrike, gas strike, vehicle or horde within 200 m of a player base (a raised territory flag or a base ping) now asks first, with Place it anyway or Cancel. Nothing is written to the server until you choose.
• Scheduled Cleanups now explain what "waiting for server restart" means: the bot has not seen the restart yet. It notices when the server's new log appears, which can be several minutes after the restart.
• Fixed: a one-restart-only event created on the dashboard at the same moment the bot handled a restart could lose its cleanup and stay on the server for good. Both are now kept.

v0.18.645Step-by-step guide for verification

• New guide on the website: Docs, How Do I, "Make new members verify". Seven steps, from making the role to locking your channels and testing it with a second account.
• /help, /link admin verify and the dashboard Verification page all link straight to it.

v0.18.644Verification on the dashboard

• The dashboard has a new Verification page (under Moderation). Pick the verify channel, the role and where staff are told, choose what happens for each check, and press Save and post: it puts the Verify button up for you.
• The page lists recent verifications with the reasons anyone was flagged, and you can approve, kick or ban members waiting for approval right there. The alert in Discord updates to say who decided.
• A checklist at the top shows anything that would stop verification working, like the bot's role being too low, and warns if everyone can still see your channels without verifying.

v0.18.643Verification, made simple

• New members now verify with buttons: press Verify in your verify channel, then Verify me on the page that opens. The page shows the result live, and the role arrives within seconds. No commands to remember and no DMs.
• Admins set it up in one step: /link admin verify channel:#verify role:@Verified. It checks everything that would stop it working (like the bot's role being too low to give the verified role) and says exactly how to fix it, then posts the Verify button.
• One feature now covers new accounts, VPNs and members sharing an internet connection with someone else. For each, choose: ignore, let in and alert staff, hold for staff approval (the default), or block.
• Staff get one plain-language alert per flagged member, showing every reason and any accounts that look related, with Approve, Kick and Ban buttons right on it. A new Verification moderator permission controls who can use them; Kick and Ban there also need those permissions.
• The separate /automod gate is now part of verification. If you had verification switched on before, your choices are kept but it is switched off until you run the setup command once.

v0.18.642Game leaderboards reset; /game grind removed

• /game grind is gone. /bench lift, /range shoot and /beer drink are played one at a time again, each with its normal cooldown.
• Every bot-wide game stat has been reset to zero: bench, range, beer, expedition and casino points. All the game leaderboards start fresh.

v0.18.641Fixed: feeds silent on a server still filed under Benches Bot

• A Discord server whose saved settings still named the retired Benches Bot got no DayZ feeds at all, even with .bOne in it: Benches Bot no longer runs feeds, and .bOne left the server alone because it wasn't listed as its bot. Those servers now move to .bOne by themselves and their feeds start within a minute.

v0.18.640Bot Trap: clearer when it cannot ban

• When the bot cannot ban someone who posts in the Bot Trap channel, the mod log now says exactly why (usually: the bot's highest role is not above theirs), once, instead of a Ban Failed post for every message they send. Everything they post there is still deleted.
• To let the trap ban, move the bot's role above your members' roles in Server Settings, Roles. It tries the ban again on their next message a minute later, so fixing the role is enough.

v0.18.639Price list contents

• A shop price list posted in Discord that runs to more than one message now starts with a contents message: every category, how many things it holds and which page it is on. Tap a category to jump straight to its prices.
• Lists already posted get it on their next update, by itself: the messages are edited where they are and one more is added at the bottom.
• Fixed: if Discord refused part way through posting a price list, trying again could post a second copy of the pages that had already gone up.

v0.18.638K/D fixed, and better keyword replies

• K/D is now kills divided by all deaths, everywhere: /me, player profiles, the leaderboard, kill posts and /faction stats.
• Since 2026-09-20 it divided by deaths to other players only, but that count started at zero that day while kills went back months, so long-time players showed a K/D far too high. One player had 1,602 kills, 1,634 deaths and a K/D of 89; it now reads 0.98. Kills and deaths themselves were always right and are unchanged.
• Keyword replies: when one keyword sits inside a longer one that also matched, only the longer one answers ("good morning" no longer also fires "morning"). The same reply is sent once per message, and one message gets at most 3 keyword replies.
• Keywords saved with capital letters now fire, and a phone's curly apostrophes and quotes match keywords typed with straight ones. /keyword add no longer accepts a word that is only spaces.

v0.18.637New: DayZ File Validator

• A new File Validator on the website (Validator in the menu, or dayznerdsquad.com/tools/validator) checks DayZ XML and JSON files and tells you the exact line and column of each mistake, what is wrong, and how to fix it.
• Drop in files or a whole mission folder, or paste text and it checks as you type. Everything runs in your browser: nothing is uploaded, so big files are fine.
• It knows DayZ files: the right top element for each file, numbers that must be numbers, and the settings that are easy to get wrong in types.xml, events.xml, cfgspawnabletypes.xml, globals.xml, cfgeventspawns.xml, cfggameplay.json, object spawner, restricted area and spawn gear files.
• For a whole mission folder it also checks that every file cfggameplay.json and cfgeconomycore.xml point to is really there and spelled the same way, and lists which of Bohemia's standard files are missing.
• It replaces the old JSON and XML validators from Nerd Squad Labs: faster, with plain-English messages, and none of the settings to fiddle with.

v0.18.636Shop aisles: pick a category, then browse it

• The shop now opens on a front page of aisles: one tile per category, with a picture, how many things are in it and the cheapest price. Tap an aisle to see just its items. All aisles (or your browser Back button) returns to the front page, and the links at the bottom walk to the next aisle.
• Kits have an aisle of their own. Search still looks through every aisle at once, your cart keeps everything as you move between aisles, and a /buy link opens straight into the aisle holding that item.
• An aisle is an item's category, which you already set when adding items. The dashboard Store page (Items & Kits) has a new Shop Aisles panel: rename an aisle and all its items move with it (handy for the catalog's lowercase names), and use the arrows to set the order of the tiles. The Discord price list follows the same order.
• Fixed: on phones the shop page could be scrolled sideways by a pixel.

v0.18.635Reset everyone's level at once

• New /level admin reset-now puts every member back to level 0 and 0 XP right now. Type this Discord server's exact name to confirm; it posts in the level-up channel unless you set announce to no.
• The Leveling page on the dashboard has the same thing: Reset Everyone Now, with the same name check and a box for posting it.
• Roles members earned and Cash already paid are kept. If levels also reset on a schedule, the schedule now counts from this reset, so a reset by hand is not followed by another a day later. /wipe levels works the same way.

v0.18.634Live message previews, and faction stats with every member and the flag

• The Welcome and Goodbye pages now show the message beside the form, exactly as the bot will post it, with you standing in as the member. It redraws as you type, shows the drawn welcome card when that is on, and says what is wrong if a setting would be refused. Nothing is saved until you press Save.
• The Leveling page now previews the level-up message: the built-in one or the embed you pick, filled in for you, with this server's real role rewards and the Cash it would pay. Previewing never pays anyone.
• Previews look like Discord: mentions, emoji, bold and links, inline fields side by side, the thumbnail beside the text and big images full width, and a tighter layout on phones.
• /faction stats now lists every member, not just the first 40; a big faction continues in follow-up messages. It also shows the faction flag, with its picture. The dashboard Faction Stats shows the flag too.
• The welcome card checks the avatar picture before drawing it, so a broken download can no longer crash the bot.
• The Goodbye page no longer offers the drawn card, which only welcome messages ever used.

v0.18.633Heatmaps: any time window, radar and UAV looks, and a live preview

• Heatmaps can now cover any stretch of time from 5 minutes up, not just whole days: 5m, 1h, 6h, 1d, 7d and so on. /heatmap has a window option, and the auto-post has a schedule and a look-back you set the same way.
• With under an hour between auto-posts, the bot keeps one message per map and updates it, so a short schedule never floods the channel.
• The live players map can now show where players were over the last stretch (for example 15 minutes) instead of only right now, with older positions fainter.
• Choose how heatmaps look: Heat (the orange glow), Radar (a green screen with range rings and a sweep) or UAV (a thermal camera feed), and set the blip size. It applies to every heatmap on the server.
• New dashboard Heatmap page with a live preview: pick a look, drag the blip size, choose which data and how far back, and see the map redraw. With no data yet it shows example points so you can still judge the look. It also shows how far back each map's history really goes.
• Existing heatmap schedules keep exactly the timing they had. The heatmap settings moved from Server Config to the new page. In Discord: /setup heatmap-auto every: window:, /setup players-heatmap window:, and the new /setup heatmap-style.

v0.18.632Add .bOne button

• The .bOne page on the website now has an Add .bOne to your server button at the top and bottom, so you can invite the bot straight from there.

v0.18.631Server Tools link

• The Labs link at the top of every website and dashboard page is now Server Tools, and takes you to the server tools on DayZ Wiki 101.

v0.18.630Faction stats

• New /faction stats: every member of a faction with their kills, K/D, playtime and Cash, plus the faction's totals: average kills per member, the faction's K/D, total playtime, members' total Cash and the faction bank. Leave out the name to see your own faction.
• K/D counts deaths to other players, the same as everywhere else in the bot, and the faction's K/D is all its kills over all its PvP deaths. Cash is a member's wallet plus what they banked. Everything is for the server you pick.
• The dashboard Factions page shows the same stats for every faction, one section each.

v0.18.629Get paid DayZ Cash for levelling up, and reset levels on a schedule

• Levelling up can now pay DayZ Cash. Turn it on per DayZ server with /level admin cash, or on the dashboard Leveling page. Set the Cash per level, and optionally an extra amount per level number so higher levels pay more (with 100 and 50, level 1 pays 100, level 5 pays 300, level 10 pays 550).
• The Cash goes to the member's linked gamertag, and the level-up message says how much they got. A member who has not linked is told to use /link. Every payment shows in the server's Cash log as Level-up reward.
• A custom level-up embed can show the payment with {cash}.
• Levels can now reset on a schedule: /level admin reset every_days:14 (or 2, or anything up to 365), or the Level Resets box on the Leveling page. Everyone goes back to level 0, the reset is announced in the level-up channel, and /level leaderboard shows when the next one is. 0 turns it off. Roles members earned and Cash already paid are kept.
• With both on, members earn the level-up Cash again after each reset.

v0.18.628Base pings keep pinging while someone stays inside

• A base ping used to alert once when someone entered and then stay quiet until they left and came back. Now it alerts again on every log update while they stay inside, marked Still inside, so you can see someone is still in your base. The server writes everyone's position to the log about every 5 minutes.
• Only entering counts toward auto-action bans. Someone who stays inside is not banned again on every update.
• Someone already inside when the bot restarts is shown as Still inside, never as a new entry.
• To get the old behaviour back for a base, untick Keep pinging on the dashboard Base Pings page, or use /baseping edit repeat:False. New base pings keep pinging unless you choose otherwise.

v0.18.627Keywords: choose how often each one can respond

• A keyword set to a member's username was working on pings, but it looked like it only answered replies. After responding, every keyword stayed quiet for 5 minutes across the whole server, so when people replied to that member all day, the replies used up the 5 minutes and a ping a moment later got nothing, with no sign why.
• Each keyword now has its own wait: /keyword cooldown word: seconds:, or the Waits column on the dashboard Keywords page. 0 means it responds every time. Every keyword keeps the old 5 minutes until you change it.
• /keyword list shows each keyword's wait.
• Fixed: when an admin's message looked like it broke an auto-mod rule (word filters also match inside longer words), auto-mod correctly left it alone, but it also stopped that message from triggering keywords or earning XP. It no longer does.

v0.18.626Bans now follow a player who changes their gamertag

• Fixed: a banned player could change their gamertag and join again, because the server's ban list only holds names. DayZ's log tags every player with an ID that belongs to the console account and stays the same through a name change, so the bot now remembers every name each account uses.
• When a banned player comes back under a new gamertag, the new gamertag is banned too and staff are told in the mod-log channel. The ban takes effect the next time they try to join; nothing can remove a player who is already on.
• It only bans when the account was seen using the banned name in your community and no other account has used that name. Otherwise staff get an alert to check by hand.
• The new ban lifts by itself when the original ban is lifted. If you unban the new name yourself, it is never banned again for the same reason.
• Choose what happens with /ban evasion or on the Server Config page: ban the new gamertag (the default), alert staff only, or off. /ban list shows which ban each new name follows.
• Fixed: /ban list showed "ends 56 years ago" next to permanent bans.
• Names are remembered from today onward, plus the last day of history the bot already had. For a ban from before that, the bot can only connect a new name to it if it saw the player under the banned name in that last day; a name it never saw cannot be connected.

v0.18.625Temporary events: what they really do

• Create Event's temporary option is now called One restart only, and says what it does. The event goes live at your server's next restart, and the bot takes it out of your server's files 15 minutes after that restart, so it won't come back after the restart after that.
• DayZ only reads event files when the server starts, so a temporary event stays in the game for that whole session. It does not disappear 15 minutes in; it is gone after the following restart.
• If you place two events on the same spot and only one is temporary, the other one keeps the event coming back every restart. The create message already warns when a spot is taken.

v0.18.624A Dashboard button, town names on the zone map, and your own link limit

• Every page of your server's dashboard now has a Dashboard button at the top, next to the logo, that takes you straight back to your server's dashboard home. It stays in place as you scroll, on phones too.
• The zone drawing map now shows town and city names, the same ones as the Event Map, so you can see where you are drawing. A Town names checkbox under the map hides them when you want a clear view.
• In multi-link mode you now choose how many gamertags (alts) each member can link, from 2 to 10. Set it on the dashboard Account Links page, or with /link admin mode choice:Multi-link max:. It starts at 5, the old fixed number, and lowering it never removes links someone already has.

v0.18.623The Online Players list is accurate again

• Fixed: the Online Players list kept players who had already left, sometimes for hours, until the server restarted. It happened most on busy deathmatch servers; one 10-slot server showed 38 players. A player who got a kill and left within the same half minute was put back on the list by the bot's own alert for that kill.
• The list now also checks itself against the player list DayZ writes to its log every few minutes, so anyone who left without the bot noticing drops off within about five minutes.
• If your online count or restart countdown channel was deleted, the bot now notices, stops trying to update it, and clears the setting so you can set up a new one with /online-count. It also never renames a channel that belongs to a different Discord server.

v0.18.622Moved to a new Nitrado server? One click points the bot at it

• If your server moved to a new Nitrado server, the .bOne team can now find its new Service ID from your Nitrado token and set it in one click. Before, the bot kept asking Nitrado about the old server, and every feed stayed silent.
• The server scan now tells a Service ID that no longer exists apart from trouble on Nitrado's side, and lists the game servers your token owns.
• Fixed: the scan expected the bot to post in your online players and restart countdown channels. It only renames those, so it now checks the bot is allowed to manage them instead.

v0.18.621More one-click fixes from the .bOne team

• When someone can't get into the dashboard, the .bOne team can now see in one step which servers' dashboards their account can open and why, and whether they have signed in with that account. Most often they are signed in with a different Discord account.
• The .bOne team can test your server's FTP login without changing anything. It says whether the address, the login or the mission folder is the problem, and can fill the login in from Nitrado when the saved one is wrong.
• The server scan now checks that the bot can actually post in each channel your feeds use, not only that the channel exists.
• If every keyword was switched off with the master switch, the .bOne team can switch them back on. Keywords you turned off one by one stay off.

v0.18.620Faster answers when something is not working

• The .bOne team can now scan your server for problems in one click: the bot's permissions, roles it can't hand out, settings pointing at deleted channels, feeds with nowhere to post, your Nitrado connection, missing slash commands, and recent errors. Each problem comes with what to do about it.
• New one-click fixes from the .bOne team: clearing settings for channels that were deleted, and finding your mission folder again after a host moves or reinstalls your server.

v0.18.619A new dashboard, built for your screen

• The dashboard now has two layouts: one that uses the full width of a desktop or laptop screen, and one made for phones. It picks the right one for your device; the link at the bottom of every page switches between them, and Automatic view puts it back.
• Long pages are split into tabs (Store, Server Config, Channel Management, Punishments, Teleporters and more), so you see one part at a time instead of scrolling through everything.
• Long lists come in pages with a search box: player Cash balances, and the Item Catalog, now 48 items a page with category and "not in the store yet" filters instead of one enormous page.
• Settings sit side by side on a wide screen. On a phone, buttons are easier to tap, text boxes no longer make the page zoom in, and long lists of checkboxes fold away behind a one-line summary of what is switched on.
• Account Links now explains how to make players link their gamertag, and links to Auto-Ban Unlinked Players on Server Config.
• Fixed: on a phone, Leveling's XP settings showed number boxes with no labels.

v0.18.618Keyword pictures: upload them straight from your computer or Discord

• On the dashboard Keywords page, the Image field has an Upload button: pick a picture from your computer and it is ready to use, with a preview. No need to host it somewhere first and paste a link.
• In Discord, /keyword add and /keyword image take an image_file: upload the picture with the command and .bOne keeps its own copy, so it keeps working long after Discord would have expired the original.
• The Keywords table now shows each keyword's picture instead of a View link.
• Fixed: in the Embed Builder, uploading a picture after a save that showed an error used to fail every time.

v0.18.617Faster fixes from the .bOne team

• The .bOne team can now fix common problems on your server in one click, without waiting for a bot restart: re-register missing or outdated slash commands, refresh member and role data, make a dashboard change take effect straight away, or restart a DayZ feed that has stopped. If something looks stuck, ask us.

v0.18.616Dashboard sign-in: always know which Discord account you are using

• If you open the dashboard and it shows no servers, it now tells you exactly which Discord account you are signed in as (name, @username, ID and picture) and explains the most common cause: your browser is signed in to a different Discord account than the one you use in your server. One tap on "Sign in with a different Discord account" lets you switch.
• Discord's own sign-in screen now always appears when you log in, so you can see which account you are about to use before you continue.
• /dashboard now tells you the exact Discord account to sign in with.
• General Settings has a new Check Dashboard Access tool: paste someone's Discord ID to see whether they are in your server, what access they have and why, and whether that account has ever signed in.
• Add as Admin now tells you when someone already has the role instead of showing an error, explains in plain words when .bOne can't hand out a role (and how to fix it in Server Settings, Roles), and tells you which account the new admin should sign in with.

v0.18.615Dashboard access for a specific account, on request

• The .bOne team can now give one specific Discord account admin access to your server's dashboard, even if that account is not the one in your Discord server (for example, when someone's browser keeps signing them in with a second account). It only applies to your server, and that account still cannot hand out roles that carry Discord Administrator. Ask us if you need it.

v0.18.614Fixed: newly promoted admins being locked out of the dashboard

• Fixed a bug where someone given an admin role (or the .bOne Admin role) could still be refused access to their server dashboard, saying they were not an admin. The dashboard was reading a cached copy of that person's roles from before the role was granted, so a freshly promoted admin looked like they had no access. It now always re-checks their current roles from Discord, so a role you just gave someone works right away.

v0.18.613Keywords: fire on an @mention, and send an image with the response

• Fixed keywords that were set to a member's username not responding. When someone @pings a user, the message only carries a hidden mention tag, never the name you typed, so a keyword set to that name had nothing to match. Keywords now also check the names of anyone pinged in a message, so a keyword set to a username fires when that user is mentioned.
• Keywords can now carry an image. Add one with the new image option on /keyword add, or set/change/remove it on an existing keyword with /keyword image (use "none" to remove); the image is shown under the response whenever the keyword fires. You can also manage it from the dashboard Keywords page.
• Tip: set the keyword to the plain username (no @ and no surrounding underscores or other formatting), otherwise it will only match if someone types those exact characters.

v0.18.612Verify: an IP / VPN check to catch alts, even on a fresh Discord account

• Added /link verify. A member runs it and gets a DM with a link to a verification page; opening the page records their connection and checks it for a VPN or proxy, and matches it against other accounts that verified from the same connection. This is the real anti-alt anchor: a Discord account is disposable, but a home connection is the same across accounts.
• Set it up with /link admin verify (off by default). You pick the role a member gets when they pass, and, separately, what happens when the connection is a VPN/proxy versus when it was already used by another account: allow (verify anyway), alert staff, or block (do not verify). Flags post to your mod-log channel; the member is never told they matched another account.
• VPN detection uses every source available: AbuseIPDB (already set up) flags datacenter/hosting connections and Tor, and proxycheck.io adds dedicated VPN/proxy detection once its free API key is added. With no keys it still records the connection and catches same-connection alts.
• Honest limits: this catches the easy majority (a rejoiner on the same home connection) and flags VPN users, but a determined evader on a VPN and a different device can still get past, since Discord gives a bot no way to tie a truly fresh account to an old one. Privacy: the page shows a consent notice, the IP is visible to staff only, and it is kept only for a bounded window.

v0.18.611New-account gate: screen fresh Discord accounts joining the server

• Added an optional new-account gate to help mitigate alts joining to grief or evade a ban. It screens every member who joins by how old their Discord account is; a throwaway account is almost always only days old.
• Set it up with /automod gate. Off by default. You choose the minimum account age, and what happens to a too-new account: alert staff only (the safe default), quarantine (assign a restricted role you set up), or kick (they can rejoin once the account is old enough).
• Either way it posts a heads-up to your mod-log channel with the account age and what was done, so staff can make the call. Bots are never gated, and a quarantine role can never be an Administrator or otherwise dangerous role (that is refused).
• Honest note: Discord gives a bot no IP or device, so a determined evader on a brand-new account with all-new details still cannot be tied to their old one; this raises the cost at the door and surfaces the suspicious joins. It is the first of a few planned anti-alt layers.

v0.18.610Leveling overhaul: every Discord activity earns XP, all admin-configurable

• XP no longer comes from chat messages alone. Every trackable Discord activity now earns XP: text messages, replies, GIFs, stickers, emojis, image or file attachments, reacting to messages, and time spent in voice channels. One message can earn several at once (a reply carrying a GIF earns Text message + Reply + GIF).
• Every source is fully admin-configurable per server: turn each one on or off, set its XP range per earn, a per-player cooldown in seconds, and a daily XP cap. Set a cooldown or cap to 0 to remove that limit. Configure it all on the dashboard Leveling page (a row per activity) or with /level admin config source:<activity>.
• Voice XP is earned per minute spent in a voice channel with at least one other person, ignoring the AFK channel and anyone deafened, so it rewards actually hanging out, not idling alone.
• The spammable sources (emojis, reactions) ship with sensible cooldowns and daily caps by default so levels stay meaningful; you can loosen or tighten any of it.
• Existing setups carry over: your old chat XP rate and cooldown become the Text message source automatically, and everyone keeps their current level and XP.

v0.18.609Wipe the leaderboard or everyone’s levels for a fresh season

• The /wipe command is now split into three: /wipe server (the old map wipe: deletes every base, stash, and vehicle, exactly as before), /wipe leaderboard (reset this server’s kill, death, distance, and playtime stats), and /wipe levels (reset every member’s level and XP for the whole Discord). If you used /wipe before, it is now /wipe server.
• /wipe leaderboard clears one server’s leaderboard back to empty; new stats start counting again from the next kill. It only touches the bot’s stats, never the DayZ server itself, so it works even without FTP.
• /wipe levels resets everyone back to the starting level and 0 XP across the whole Discord (levels are one total per member, not per server). XP starts building again from the next message and DayZ activity.
• Both are admin-only and irreversible, so each makes you type the exact name to confirm first (the server’s name for the leaderboard, this Discord’s name for levels), the same safeguard the map wipe already uses.

v0.18.608New detector: an account that just joined the Discord running straight to a base

• Added a New-Account Base detector to /detect (and the dashboard Detection page). It watches for a gamertag whose linked Discord account joined the server recently connecting and heading straight to a known base (a territory flag or an admin base ping) within minutes, the classic sign of a banned player back on a fresh account who already knows where everything is.
• It is OFF by default. A genuinely new player invited to a friend’s base looks the same, so like every other detector this is a lead for staff to review, not proof, and each server’s admins turn it on if they want it.
• When on, it posts to the same private suspicion-alerts channel as the other detectors, with how new the account is, how long after connecting they reached the base, and which base. Tunable: how recently the account joined, how soon after connecting counts as a beeline, and how close to a base counts.
• It only fires on a connect the bot actually saw this session, so a long-standing player wandering near a base is never flagged.

v0.18.607Alt check now shows when a member’s gamertag went straight to a base

• /altcheck discord:@user now also checks where the member’s linked gamertags have actually been in game. If a gamertag’s recorded movement came within 250m of a known base (a territory flag or an admin base ping), the lookup shows it, and how close it got.
• This is the other half of the ban-evasion tell: a brand-new Discord account whose gamertag is already sitting on a base did not wander there by luck, it knew exactly where to go. When the account is also brand-new, the lookup calls that combination out.
• It uses the base locations the bot already tracks per server, so no setup is needed. Read-only: it only reports what staff see when they run the lookup, it never acts on anyone by itself.

v0.18.606Alt check can now find a member’s alternate Discord accounts

• Added /altcheck discord:@user. It finds other Discord accounts that are likely the same person, useful for spotting ban evasion by someone rejoining on a new account.
• The strongest signal is a shared linked gamertag: if two Discord accounts have ever linked the same gamertag, they are almost certainly one person, and the lookup marks those as confirmed.
• Weaker lookalike signals are shown for review, not as proof: a reused avatar image, a near-identical name (it sees through leetspeak like C00lGuy and fancy-text unicode), and accounts created around the same time.
• To have something to match against, the bot now quietly remembers a light fingerprint of each member as they join or change their name or avatar: when the account was made, its avatar images, and its names. No IP, email, or device is used or available.
• The account-creation date of the looked-up member is shown too, so a brand-new account joining right before trouble stands out on its own.

v0.18.605Alt check now shows every account linked to the same Discord

• Every gamertag a player links to their Discord with /link is now remembered forever, across every server, even after they unlink it. This builds a permanent record of which accounts belong to the same person.
• Added a per-account search to /altcheck: /altcheck account:<gamertag> shows not just the behavioral log signals, but all accounts confirmed to belong to the same Discord, anywhere. The same lookup is on the dashboard Alt Check page.
• If one gamertag was ever linked to two different Discord accounts, the lookup connects them all, so a shared or handed-off account surfaces the whole web of alts.
• The confirmed-alt lookup works even without FTP, since it reads the link records, not the server logs.

v0.18.604A stuck server poll can no longer freeze that server forever

• Fixed a server going silent indefinitely if one poll got stuck. A rare stalled network read (a Nitrado download that stops sending data mid-stream) could hang a single server’s poll forever; the safeguard that skips a slow poll could not cancel it, so that server’s feeds stayed frozen until the bot restarted. One server had been stuck for about five hours.
• A poll that runs far past any reasonable time (30 minutes) is now presumed dead, abandoned, and the server is re-polled so its feeds come back on their own.
• Also put a hard limit on reading a Nitrado download’s response so a stalled one fails and retries in seconds instead of hanging.

v0.18.603Auto-ban players who never link a Discord account

• Added an optional, per-server rule: a gamertag that connects to your server but never links a Discord account with /link is banned after a grace period you set. Off by default. Turn it on with /link admin autoban or on the dashboard Server Config page.
• It only counts connections from the moment you enable it, so nobody already playing is banned just for being unlinked; players are warned partway through the grace period; staff (protected) gamertags are never touched; and the ban lifts automatically the moment they run /link, since linking works even while banned.
• The ban shows in /banlist like any other and can be lifted manually with /ban remove. If a ban fails to reach Nitrado it is retried, and it never records a ban that did not actually take.

v0.18.602Nitrado alerts now tell you the right Service ID

• When the bot cannot reach Nitrado for a server, the alert now asks your token what it actually owns and names the correct Service ID, instead of telling you to go and double-check it. A wrong Service ID stops every log-based feature, and it never fixes itself, so it used to look like a bot that was set up correctly and simply did nothing.
• It tells the three cases apart: a Service ID your token does not own (it names the right one), a token that cannot list anything at all (the token is expired or wrong, not the ID), and a token that works but owns nothing (it belongs to a different Nitrado account).
• If the Service ID is correct, the alert stays exactly as it was, so a genuine Nitrado outage is never reported as a typo.

v0.18.601Your own event names no longer get filtered out

• Fixed custom events being dropped for having an ordinary word in their name. The filter that keeps routine server population out of the Custom Event feed was matching anywhere in the name, so an event called something like Static_NPC_SurvivorM_Mirek was thrown away because of the word "Survivor" in it. It now has to match a known routine name in full, so an event you named after whatever it spawns comes through.

v0.18.600Choose whether the bot comes back to a delivery

• Added a setting on the Store page: "What Happens After a Delivery". Leave it on and a delivery is taken back out 15 minutes after the next restart, which is how it has always worked. Turn it off and the bot writes the delivery once and never touches that file again, so the items stay on your server until you remove them yourself.
• With it off, the bot keeps no record of the delivery and skips the file entirely on every later pass, including the tidy-up sweep, because that sweep is itself a write to the file you asked it to leave alone.
• Purchases are marked as delivered straight away when the setting is off, so nothing sits on "on its way" waiting for a clean-up that is never coming.
• Created events and teleporters already had their own version of this choice; store deliveries were the one thing with no way to make them permanent.

v0.18.599Custom events show up now, whatever you call them

• Added a Custom Event feed that reports any event on your server the bot does not already have a dedicated feed for, under that event name. Modded events, seasonal ones, and ones you add later all show up with no waiting on an update, because nothing has to be added to the bot for a new name to work.
• This includes events the bot creates for you: a Gas Strike made with /createevent was spawning and being reported nowhere, because the bot only recognised a fixed list of event names and its own were not on it.
• Route it like any other feed with /channel create, the dashboard Channels page, or /setup auto-channels. Custom events also get their own colour and marker on the Event Map.
• Routine server population that is not really an event (traders, vendor stalls, named survivor NPCs) stays out of the feed, so this does not turn into noise.

v0.18.598Store deliveries land at your feet, and only spawn once

• A store delivery now lands inside a 1.5 metre circle around the spot you picked, however many items it holds. Big orders used to spread out on a grid that grew with the count; a 99 pile ammo order came out as a 9 by 9 metre field with items 6 metres from the middle, which read as the delivery having been scattered rather than dropped.
• Fixed deliveries that could spawn again at every restart. A delivery is written to your server straight away, but the note telling the bot to clean it up 15 minutes later was saved a moment afterwards, so a restart landing in between kept the items and lost the note. The note is now saved before the delivery is reported as sent.
• Every restart now also checks the delivery file itself and takes out anything left in it that has already spawned, so a delivery that slipped through earlier clears itself instead of coming back forever. Anything ordered since the restart is left alone, and anything you placed in that file by hand is never touched.
• A purchase left stuck on "on its way" by one of those lost deliveries is now marked as delivered, so it stops sitting in the owner inventory.

v0.18.597The Event Map drags properly again

• Panning the Event Map is much smoother. Every mouse movement was resizing every blip on the map, even though panning never changes their size; on a busy map that was more work than a frame has time for.
• Fixed the map refusing to drag at all. Letting go of the mouse outside the map left it thinking a finger was still down, so every press after that zoomed instead of dragging, until you reloaded the page.

v0.18.596Your location is yours again

• /mylocation is now only visible to the person who ran it. It was posting your live in-game position, the nearest town and a map link to the whole channel, which on a PvP server told everyone exactly where to find you.
• Nothing else changes: the buttons, saving your delivery spot and the distance comparison all work the same, just privately.

v0.18.595Level-ups can use an embed you built

• The level-up message can now be any embed you designed in the Embed Builder, picked on the Leveling page. That means colour, image, thumbnail, author, footer, fields, custom emoji and buttons, instead of the one fixed message it had before.
• Your embed can say who levelled and to what: {user}, {username}, {level}, {oldlevel}, {server} and {roles} are filled in for the player each time, and your saved embed is left exactly as you wrote it.
• Pick nothing and it keeps the built-in message. Delete the embed you picked and it goes back to the built-in one rather than going quiet.
• Fixed: changing the chat XP rate used to silently clear your chosen level-up embed.

v0.18.594A goodbye channel, and a welcome you can actually shape

• New Goodbye Message. Route a Goodbye channel the same way you route any other feed, and people leaving are posted there and nowhere else. Joins, nickname changes and role updates stay in the moderation log, which is unchanged.
• The welcome message can now set a footer, an author line, its own thumbnail, and up to five extra fields; the member count line can be reworded, and the icon in front of the title can be turned off. Everything that was already there still works exactly as before.
• The goodbye message has all of the same settings, on its own page, because it is the same message aimed at a different moment.

v0.18.593Created events now say so in the log

• Creating an airstrike, gas strike, vehicle or horde now records a line in the bot log saying what was created and where. Only failures were recorded before, so a report of "it did not work" could not be told apart from nobody having tried.

v0.18.592It worked, so it now says it worked

• Fixed a crash that could report a store delivery or a created event as failed after it had already been written to your server. The items or the event were really there; only the message was wrong.
• The same fault could lose the bookkeeping that removes a created event after the next restart, leaving it in place with nothing tracking it.

v0.18.591Indoor loot points were pointing the wrong way

• The "Indoor loot points" lookup on the Who Was Here? page was reading each building's rotation out of the wrong place, so the spots it reported were turned the wrong way around the building. On the real Chernarus files that put them an average of 5 metres out, and up to 60 metres in the worst case, which for most buildings means the wrong room or outside the wall.
• Fixed by reading the rotation the way DayZ itself writes it, checked against every building on Chernarus and Livonia.
• Nothing was ever built or teleported to those spots. The lookup only ever reported them, which is why this was a wrong answer on an admin page rather than anything placed in your world.

v0.18.590No more calls to servers that left

• The startup mission-file check no longer connects to the FTP of a server whose Discord removed .bOne. Its settings stay on disk after a removal, so the check had been dialling former customers on every restart and failing with a login error.
• A server switched off with the developer kill switch is left alone by that check too, which is what "go fully quiet" should have meant all along.

v0.18.589Pictures on the world-event feeds

• Heli crashes, military convoys, police situations, trains and airdrops now show a picture, and a vehicle spawn shows the actual car, boat or police car that spawned.
• New Feed Pictures section on Channel Management. Every one of these is filled in for you, and you can replace any of them with your own image or turn it off.
• Contaminated areas have no picture until you set one; there is no artwork for a gas zone, and a gas mask would be a picture of something else.
• A cycle that spawns two different vehicles at once shows no picture rather than the wrong one, and a modded vehicle nobody has art for simply gets none.

v0.18.588The shared kill feed is gone

• The shared kill feed hub has been removed. The switch for it is gone from Server Config, and nothing is sent anywhere outside your own Discord.
• Your own kill feed is untouched. This only removes the shared channel several communities could opt into; your kills post to your own channels exactly as before.

v0.18.587Give a role to everyone

• New Give a Role to Everyone page on the dashboard. Adds one role to every member of your Discord in one go, or takes it back off everyone. Anyone who already has it is skipped, so running it twice costs nothing and changes nothing.
• It refuses any role that would hand your server away: anything with Administrator, Ban Members, Manage Roles and the like, the .bOne admin and mod roles, and any role sitting above .bOne own. Bots are left out unless you ask for them.
• Big servers take a few minutes because Discord limits how fast roles can change; the page shows progress as it goes and you can leave it running.

v0.18.586Global ranks that are actually global

• Global ranks now cover every server, with nothing to switch on. They were opt-in, and almost nobody had opted in: the rank was worked out from 4 of 37 servers, so it covered about 2,000 players out of 7,000 while calling itself global, and the other 5,000 were shown no rank at all.
• Nothing about another community is shared to make this work. A rank is a position and a total; no names, no stats and no server ever crosses between communities, which is why this did not need to be a choice.
• Ranking got 14 times faster at the same time, measured on real data, so covering every server costs less than the old partial version did. Players on the same score now share a place, instead of one of them arbitrarily reading a place lower.
• The Global Ranks switch is gone from Server Config, because there is nothing left to switch.

v0.18.585Finding the kill feed switch

• The Server Config tile now says it holds the kill feed sharing switch, so you can find it without opening every page looking for it.

v0.18.583Random loot presets, without the file surgery

• New Random Loot Presets page. A preset is a named bundle of items with a chance each, so "every police car spawns from this short list" is written once instead of copied into every spawnable type by hand.
• The page gives you the exact line to paste into cfgspawnabletypes.xml for every preset, because a preset nothing points at spawns nothing and the file itself gives no hint of that.
• Your comments survive an edit. Saving over a preset replaces it where it sits and keeps whatever you wrote above it, instead of reformatting the whole file.
• A chance has to be a probability. Typing 30 when you meant 30% is refused, rather than written as a 3000% chance the game accepts without complaint.
• Attachment presets work too, not just cargo.

v0.18.582The whole shop, in three columns

• The shop price list now shows every item, not about 1,400 of them, and it is far more compact. Prices are whole numbers in the shop, so the pointless ".00" on every line is gone, and the list is laid out in three columns instead of one long strip.
• A 1,426-item shop, the biggest on any server, now fits in 8 messages with everything in it. Shops up to about 2,800 items fit too.

v0.18.581Shop prices posted to Discord

• New shop price list in Discord. Pick a channel on the Store page or run /store pricelist post, and the bot posts your prices there so players can read them without opening the shop.
• It keeps itself up to date. When you change a price or add an item the posted message is edited in place, so it stays where it is instead of turning into a pile of reposts.
• A stocked shop holds around 1,900 items, which no single post can hold, so you can name the categories you actually sell and get a complete list of those. If it still does not fit, it says how much it is showing rather than pretending that is everything.

v0.18.580Atlas mode stops crawling

• Atlas mode on the Event Map is no longer slow. It was drawing every point of the layer at once, thousands of them, and keeping them all on the page through every pan and zoom. It now draws only what is on screen and tops out at 2,500 dots.
• When there is more in view than that, it says so and the dots are spread evenly across the area instead of piling into one corner, so what you see still has the right shape. Zoom in to see the rest.

v0.18.579Tighter number checking

• Internal: the check that reads a number out of a form box now refuses anything that is not actually a number, rather than letting the likes of an empty list quietly become a zero. Nothing you type behaves differently.

v0.18.578One teleporter, several doors

• A teleporter can now have several entrances leading to one place, so a bunker with seven doors is one teleporter instead of seven. Add them on the Teleporters page, up to 8 doors in total; removing the teleporter removes every door with it.
• A two-way teleporter always returns players to the first entrance, whichever door they used. The file format has no way to record which door someone came through, and the page says so.

v0.18.577Say what the loot setting actually does

• The rotation loot setting now says what it does rather than what it is for: "spawns only 10-15 of its objects each rotation". Read as "vary the loot" and ticked on a base layout, it would have spawned 12 of 800 objects and left the base all but gone for that cycle. Nothing was ever written to your file, so turning it off restores everything on the next rotation.
• Fixed: a rotation entry using that setting could be removed by hand from the Custom Files list, which is exactly what that list is supposed to refuse.

v0.18.576A blank box is not a zero

• Leaving the X or Z box empty when making a sign or a base ping is now refused instead of being read as zero, which quietly put the thing in the far corner of the map.

v0.18.575Indoor loot points on the lookup page

• The Who Was Here page can now show the nearest building to a spot, which way it is facing, and the real loot points inside it, each with a map link. Reads your server files and changes nothing.

v0.18.574Fresh loot each rotation, and feed pictures

• A rotating site can now carry different loot each time it appears. Set how many objects out of the pool file should spawn and the bot picks a fresh random subset on every rotation, so the same crash site is worth visiting twice.
• Feed messages can show a small picture in the corner. Off by default; you can use your own server icon, which costs nothing extra because it is already in every feed message, or give a picture of your own.

v0.18.573K/D counts fights, not respawns

• K/D now counts only deaths to other players. Dying to infected, falling, starving or resetting no longer counts against you. In the logs about 92 in every 100 deaths are not to a player, so the old number mostly measured how often someone respawned rather than how often they lost a fight.
• The kill card now shows the deaths the ratio actually used, so the two numbers agree. Your total deaths are still counted and still shown on your profile.

v0.18.572A role and a private channel per faction

• New /faction admin discord. Gives a faction its own Discord role and a private channel only that faction can see, and removes both again when you ask or when the faction disbands. Staff only, since creating roles and channels is an admin job.
• Safe to run twice: it adopts what it already made rather than making a second one, and if a role with that name already exists that the bot did not create, it stops and tells you instead of handing someone else's role to a faction.

v0.18.571Your own feed colours

• You can set your own colour for any feed type on Channel Management. Leave a type on Default and it keeps the colour the bot ships, including if that colour is ever improved later.

v0.18.570Player Hub on the dashboard, and parity is done

• New Player Hub page on the dashboard: post the button panel players use instead of commands, and see which channel it is in. It posts exactly the same panel the Discord command does.
• That was the last feature the dashboard did not have. Everything the bot can do from a command can now be done from the website too.

v0.18.569Server logs on the dashboard

• New Server Logs page on the dashboard: your restart history, and a download button for the current ADM and RPT logs. The Discord command has to cut a big log down to fit an attachment; the page gives you the whole file.

v0.18.568Recruit the people actually near you

• New /faction nearby. A faction leader or co-leader sees who is playing near them right now and can offer an invite with a button, instead of asking in chat and hoping. Only players the bot has actually seen in the last 10 minutes, who have linked their Discord and are not already in a faction.

v0.18.567Ring player spawns

• New /teleport spawns. Work out a ring of fresh spawn points around any centre, preview how many you get and how many were skipped as water, then apply it.
• It edits only the fresh-spawn section of your server's existing spawn file, keeps your hop and travel tuning exactly as it was, and saves the old file as a backup. If the file is missing, or has been hand-edited so there is no fresh section to replace, it refuses rather than rebuilding it.

v0.18.566A gas wall around a zone

• New Gas Ring on the Zones page. Rings a circle zone's edge with overlapping gas areas to make a contaminated perimeter, using about a tenth as many areas as filling the whole zone would.

v0.18.565Base ping alerts say who they tagged and why

• A base ping alert now says who it tagged and why, for example "linked to UNSACREDxLEGEND, CartelZ's leader". If a ping ever looks like it reached the wrong person, the gamertag beside the name tells you straight away that the gamertag is linked to that Discord account, instead of leaving you to rebuild the base ping and find it still happens.

v0.18.564Links survive inside a ticket

• Auto-mod no longer deletes links inside a ticket. If you block Discord invite links so nobody can post scam links in public, someone can still open a ticket and send you their server; the link survives where only you and they can see it.
• Spam, Mass Mentions and Censored Words still apply inside tickets, because those protect the people reading them. Every check now has an In Tickets box on the Auto-Mod page if you want it the other way round.

v0.18.563Words on the map

• New Signs on the teleport page. Write words on the map out of objects, the same way the QR board draws a code. Letters, digits and basic punctuation, up to 4 lines, and one size control that scales the letters and their spacing together so the text stays readable from palm-sized to landmark.

v0.18.562The missing-classname warning can actually run

• Creating an event can warn you again when a spawn names something your server does not declare in types.xml, which DayZ otherwise drops silently. That check has never actually been able to run: types.xml is about 850 KB on every map and hosts will not send a file that big in one transfer, so it failed every time without saying so.
• It now reads the file in pieces. If your host will not resume a transfer, you get the same silence as before rather than a wrong answer.

v0.18.561Walls and fences along a path

• New Walls and Fences section on the Teleporters page. Give a path as a list of waypoints and the bot places a run of wall pieces end to end along it, each one turned to face along its leg and sitting on the ground.
• You give the length of one piece yourself, because that is a property of the model and cannot be read from its name: Land_Castle_Wall2_30 is actually 20 m long. Pieces with no ground under them are left out and counted rather than dropped into the sea, and on a map with no ground data the form asks for a height instead of guessing.

v0.18.560Roughly where, and infected by name

• Feeds can now show roughly where something happened, instead of the old all or nothing. A new Place Name Only setting, per event type, shows "450 m NE of Kabanino" with no coordinates and no map link, so a public feed can say what is going on without handing out a grid reference. It sits next to the existing hide switch on Channel Management, and a type you have hidden stays hidden.
• Infected are named properly in the feed and on the Event Map. A kill by ZmbF_VillagerOld_Green now reads "Infected (Villager Old Green)" instead of leaking the model code as "Infected (F Villager Old Green)", and an infected the name list does not know is described instead of showing its raw classname.

v0.18.559Feeds stop pinging everyone

• Feed posts no longer ping everyone in the channel. A busy server posts thousands of kills, hits and connects a day, and anyone who had not muted the feed was notified for every single one. Feeds now post silently and still show up in the channel exactly as before.
• The alert types still notify, because being interrupted is the whole point of an alert. You can set any event type either way, per server, on Channel Management or with /channel notifications.

v0.18.558Too big to read is not the same as broken

• The Custom Files check no longer calls a file broken when it is only too big to read. Your host will not send a file over 640 KB in one piece, and a big base file is usually well past that, so the check now says the file could not be checked and shows its real size instead of reporting good JSON as broken.

v0.18.557Live channels on the dashboard

• New Live Channels page on the dashboard: the two voice channels whose name carries live information, how many players are online and how long until the next restart. Pick a channel per server and it updates straight away instead of waiting for the next sweep.
• That completes the four things the dashboard only had in Discord: welcome messages, sticky messages, invites and these live channels are all on the dashboard now.
• Internal: .bOne now has one source of truth for where each DayZ mission file lives, built from a reference database and checked against the paths already proven in production.

v0.18.556Sticky messages and invites on the dashboard

• New Sticky Messages page on the dashboard: the notice that keeps itself at the bottom of a channel. Add, edit and remove them from a table instead of /sticky, and saving posts it straight away so you can see what you wrote.
• New Invites page on the dashboard: who has brought members into the server, and how many each. Discord shows the top 15; this shows everyone, including people who have since left.
• Deer Isle servers now get place names in every feed instead of raw coordinates, and off-map detection knows the island's edge. Terrain checks and the Event Map still need data this map does not have yet, and the bot now says so plainly instead of erroring.

v0.18.555Welcome messages on the dashboard

• New Welcome Message page on the dashboard. The title, message, colour, banner image and the three switches (avatar, member count, drawn card) were only ever settable with /welcome; they are now a form, with a Reset button. Both places follow the same rules, so nothing can drift between them.
• Teleport markers now name the fix. Paste a DayZ Editor object name and .bOne tells you the game object to use instead, or tells you it is a model with no classname at all, rather than leaving you to guess.

v0.18.554Atlas mode on the Event Map

• New Atlas mode on the Event Map. Toggle layers for loot buildings, crash sites and vehicle spawns, animal territories, fruit trees and contaminated areas, drawn from the game's own data. Chernarus only for now; other maps show no Atlas button rather than an empty map.

v0.18.553Every server checked on its own schedule

• Servers are now checked on their own schedule instead of all together. One check used to cover every server in turn, and if that took longer than the interval the next one was skipped entirely, so every server waited for the slowest. Measured on your servers before this: a server waited 98 seconds between checks at the median, over 10 minutes at the 90th, and 54 minutes at worst. A slow server now only delays itself.
• That is what leaves a Live Players map empty while people are on the server, and what makes kill feeds and online counts arrive minutes late. Each server keeps the 30 second cadence it was always meant to have, with the same limit on how many are contacted at once.

v0.18.552Feeds post normally again

• Fixed feeds going quiet, introduced by 0.18.551 earlier today and live for about 25 minutes. That release stopped announcing anything read after a pause in polling, and judged a pause by the time since the last check of that server, with the threshold set at 2 minutes. A server is actually checked every 3 to 4 minutes when the bot is looking after many of them, so ordinary events were treated as old news and never posted. Nothing was lost from stats, Cash or the map; only feed messages in that window were skipped.
• The pause a server is put in after repeated failures from the game host is now recognised directly, rather than guessed from elapsed time, so the join-kill and duplicate-login false alerts that 0.18.551 set out to stop stay fixed.

v0.18.551No alerts from log the bot reads late

• Alerts and detections are no longer raised from a stretch of game log the bot reads late. After repeated failures from the game host it pauses polling that server for a few minutes, and everything it then read was treated as if it had just happened: a player who logged in and killed someone twelve minutes later was flagged for a join kill, and logins minutes apart were flagged as duplicates. Those events still count towards stats and Cash; they are only no longer announced.
• The restart countdown channel now steps in 10 minute increments instead of 5. Discord allows two channel renames every ten minutes, and the old steps sat at that limit for a quarter of the run up to a restart, logging rename failures for nothing. Under ten minutes it reads "Restart in under 10m".
• Restoring a cfggameplay.json backup now names the entries that stop being listed. Anything registered by hand after the backup was taken is not in it, so a restore quietly stopped the game loading it; you are warned before, and told which ones afterwards, with a pointer back to the Custom Files check to register them again.

v0.18.550Config restore, in-game messages, staff log and more

• Server Config: a cfggameplay.json Backups section lists the copies .bOne keeps of that file, and Restore puts one back. The file it replaces becomes the new backup, so a restore can be undone the same way. Entries the store, teleporters, QR boards and rotation manage stay as they are now, so those features keep working. Takes effect at the next restart.
• New In-Game Messages page: the lines players see in chat, from the mission db/messages.xml. See what is there in plain words ("every 10 minutes, 2 minutes after a player connects"), add a welcome or a repeating notice, or remove one. Your own notes and comments in the file are left alone.
• New Staff Log page: who ran which admin command in Discord and who changed what on the dashboard, with what they passed. Anything that looks like a token or a password is recorded as hidden. Filter by person or by where it happened. Kept 90 days.
• Store page: put items in the order you want. Each item has up and down arrows, and each category can be sorted by price or by name. The order shows everywhere: Discord, the shop page and the dashboard.
• The shop and the Item Catalog now show the game's own description of an item, so a player can read what a thing is before buying it. The catalog search reads the description too, so "scope" finds optics whose names never say it.
• /online-count restart-setup creates a voice channel that counts down to the next restart, using your restart schedule or else the one in the Nitrado panel.
• New Off-Map detection: players outside the map's own edge are flagged. That ground is where Underground and Skywalk can measure nothing, since the terrain map ends at the boundary. Alert only, never bans, and a wide margin so a swimmer past the edge is not flagged.
• Fixed four Chernarus place names that had lost their spaces ("BelayaPolyana" now reads "Belaya Polyana"), so feeds and /player name those places properly.

v0.18.549Restricted areas registered, custom entries removable

• Server Config, Custom Files: restricted-area files in custom/ are now recognised (including ones drawn only as polygons) and get a Register button. The file is checked first (area name, boxes or polygons, safe positions) and added to playerRestrictedAreaFiles; it applies from the next restart.
• Server Config, Custom Files: the check also lists what cfggameplay.json loads from custom/, with Remove on each entry. Remove takes it out of its list and leaves the file in custom/, so Register can put it back. Entries the store, teleporters, QR boards or rotation manage are marked and left to those features.
• Bounties: killing your own faction mate no longer fulfils a bounty on them, so a faction can no longer cash out a rival bounty on one of its members.

v0.18.548No bans for old kills, and team-kills called out

• Automatic bans (zone, base ping and PvE mode) are no longer handed out for kills the bot reads long after they happened, as when the server log is held up; those kills are still reported.
• Kill cards say when a player killed a member of their own faction, and those team-kills no longer pay kill or hit Cash.

v0.18.547The armband wait follows the player

• Faction armbands: leaving and rejoining a faction, or joining another one, no longer resets the 6-hour wait for a free armband.

v0.18.546Held store purchases, drawn base outlines, PvE mode and faction flags

• Store: a purchase now waits in your inventory until you send it. At checkout pick your saved spot, where you are now, or keep it; send kept items later from the shop page or with /shop deliver. A delivery is never written while the server is restarting, and it arrives after the restart that follows. Admins see every waiting purchase on the Store page and can take one back, which refunds what was paid.
• Base pings can be drawn as an outline on the map (Base Pings page: Draw a Base, or Redraw on any base), so an L-shaped compound no longer alerts on the empty ground beside it.
• PvE mode (Zones page): players may only kill each other inside zones that allow PvP. Choose what breaking it costs: an alert, a temporary ban that grows each time, or a permanent ban (needs the Bans permission). Every breach is posted to the alert channel.
• PvE penalties start 30 minutes after PvE mode is switched on or changed. The game log reaches the bot a few minutes late, so kills from before the change are posted but never punished.
• Factions: each faction can fly one flag no other faction flies (/faction flag), and its members get the matching armband delivered free once every 6 hours (/faction armband). Factions also show a level from 0 to 3 by member count; admins set the counts.
• Factions: leaders can invite players (/faction invite) and write a bio (/faction bio) shown on /faction info.
• /zone list shows drawn zones properly instead of "X: undefined", and lists Alert and PvP zones.

v0.18.545Time Alive is exact to the second, even on busy servers

• Kill cards could still show "Time Alive: 0s" after 0.18.543. Most servers hand their game log to the bot about five minutes at a time, and that fix only covered deaths read within the same half minute. Time Alive now comes straight from the times written in the game log, so it is exact to the second however the log arrives.
• The same goes for the "online for" and "offline for" times on join and leave messages, and for playtime Cash, which is paid from the time online.

v0.18.544Every player kill gets its own card with the weapon picture

• When several players were killed between two checks of the server log, their kills were packed onto shared cards, and a shared card never shows a weapon picture. Now every player kill with a picture gets a card of its own, so busy PvP servers see the gun on every kill.
• Kills by zombies, animals and traps, and kills with a weapon the store has no picture of, still share a card as before.

v0.18.543Time Alive and time online come from the game log

• Kill cards could show "Time Alive: 0s" for a player who had really been alive for a while. When several deaths arrived in the same check of the server log, they were timed by when the bot read them rather than when they happened. Every event is now timed from its own line in the game log.
• The same fix covers the "online for" and "offline for" times on join and leave messages, and playtime Cash, which is paid from the time a player was online.

v0.18.542Auto-mod can be switched off in chosen channels and categories

• Auto-mod checks can now be switched off in particular channels or whole categories while they keep working everywhere else. For example: block links across the server but allow them in #media, or turn every check off for the Staff category.
• Works for all five checks, one at a time or all at once, with /automod exempt add, remove and list, or from the new "Where Checks Are Switched Off" section on the Auto-Mod dashboard page.
• Threads and forum posts follow the channel they are in, and each check is separate: allowing links in a channel still filters banned words there. Messages in a channel where spam checking is off do not count toward a flood anywhere else.

v0.18.541Kill cards with the weapon, and a big round of fixes

• Kill feed: every PvP kill now shows the round, damage and body part of the killing shot, both players' K/D, killstreak or deathstreak and rank on this server, how long the victim had been alive, and the Cash the killer earned.
• Kill feed: the weapon used now appears as a large picture on the card, cut straight from the store's own item art.
• Kill and death feeds: the shooter's position is shown alongside the victim's, a death shows the whole exchange of hits before it, a run of quick suicides posts as one, and bear traps, vehicles, fuel pumps and grenades are named correctly instead of "unknown".
• Who Was Here? (Punishments page): give X, Y and a radius to see who built or placed things there in the last 30 days, and who was last seen there in the last 7. Player Lookup now shows a last position up to 30 days old.
• Territory Flags (Base Pings page): every flag raised or lowered in the last 30 days, the ones no base ping covers listed first. Members of a base's own faction no longer set off its base ping or auto-ban.
• /status and /restart-schedule status show the next restart, counted down live. Restarts can now carry a message to players.
• Detection: Headshots can finally fire on real logs, Skywalk no longer flags hill walkers or swimmers, Camping measures real time in place, and Teleport no longer fires on every respawn.
• Store: 58 vanilla items no longer refused as unknown, purchase limits per player, free gifts, copying a store to another server, a Discord boost discount, and deliveries kept away from other people's bases.
• Mission files: XML comments are no longer read as live content, a stray byte-order mark no longer breaks rotation, base damage and the store, and every editor now keeps timestamped backups.
• New admin tools: gas zones, clearing zombies and event spawns in a radius, a QR code builder, spawn gear presets, priority queue and timed priority, auto-whitelist on /link, and paying Cash to a whole role at once.
• Tickets auto-close when left open too long, and one deleted by hand no longer locks its opener out. Bounties pause while the target is offline and announce when they expire.
• Cash changes made by hand are now logged, and travel Cash is no longer paid for respawning.
• Removing a server also clears its trap placements, so a reused server id cannot blame a trap on the old server's players.

v0.18.540The bot now knows the shape of the map

• Underground and Skywalk detection now measure against the real ground height of Chernarus, Livonia and Sakhal instead of guessing it. Diving in deep water no longer looks like clipping under the map, a player tunnelling inside a mountain is now caught at all, and walking up a hill is no longer mistaken for floating.
• Creating an event warns you when the spawn lands on top of one that is already there, when the height you typed puts it underground or hundreds of metres in the air, and when the vehicle or infected it spawns is missing from your types.xml (DayZ spawns nothing at all in that case, silently). The event is still created either way; these are notes, not refusals.
• Store deliveries of several units now land spread around the drop point instead of stacked on one spot, so each one can be picked up.
• The store can no longer be broken by its own success: once a spawner file approaches the size your host silently truncates downloads at, new purchases roll over into a fresh file that is registered automatically. Before this, a busy server would eventually have had every purchase fail.
• A file too big for your host to send in one piece now says exactly that, and nothing is written, instead of failing with a raw error.
• /classname now shows how the vanilla economy treats an item on your map: how rare it is, how many exist at once, how long it lasts, and how often it restocks.
• Livonia and Sakhal town names are much more complete (34 to 61, and 13 to 51), so feeds and alerts on those maps name a real place far more often.

v0.18.539Trap feeds now name who is suspected of placing the trap

• When a player is hit or killed by a trap, the feed now says who most likely put it there: their name, the trap, when they placed it, and how far from the victim it was.
• It is a suspicion, not a fact, and the wording says so. DayZ never records which specific trap went off, so the bot names the closest trap of the same kind that someone placed there beforehand. If several players have traps of that kind in the same spot, the alert says that too instead of sounding certain.
• A trap picked back up by its owner is forgotten, so it can never be blamed for a later explosion, and placements are remembered for a week, which covers the real gap seen between arming a minefield and someone walking into it.
• Trap hits and kills are now labelled as traps. Bear traps were being reported as animal attacks, because the name starts with 'Bear', and landmine kills had no category at all.
• Fixed a real bug this turned up in the live feeds: on hits from anything that is not a player, the body part was being glued onto the attacker name, so alerts read 'hit by Infected into Torso' with the Body part field left blank. 722 of 25,032 hits in a single day were affected.

v0.18.537YouTube creator alerts: livestreams and community posts

• /creator link platform:youtube now links a YouTube channel, the same self-service way Twitch and TikTok already worked. Paste your handle (like @YourName) or your channel link ; the bot confirms which channel it found before saving it.
• You get an alert when you go live, with the stream title and thumbnail, and another when you post on your Posts tab, with the text and picture from the post itself.
• Video and Shorts uploads are deliberately not alerted on, only lives and posts.
• Live checks run every 2 minutes, community posts every 15. Posts already on your page when you link are counted as seen, so linking never fires a burst of alerts for old posts.
• Same approval rule as the other platforms: since anyone can type any channel, a freshly linked creator posts without a ping until an admin approves them with /creator admin approve.

v0.18.536Clear alerts on the developer diagnostics page

• Every alert on the diagnostics page now has a Clear button: log errors, log warnings, data findings and code-pattern hits. Each section also has a Clear all.
• Clearing only hides what is there at that moment. If the same thing happens again it comes straight back, marked as new since you cleared it, so nothing is lost by tidying the page up.
• A data finding that gets fixed is forgotten entirely, so if that problem ever returns it shows as a fresh alert.
• A new Cleared section lists what you hid and when, with Restore on each and a Restore all.

v0.18.535FTP setup warns when it cannot find the address you typed

• Saving FTP details now checks the address exists. If it cannot be found, the details are still saved (a brief network hiccup should not stop you setting a server up), but the reply says so and tells you to look for a typo. A missing dot in the address is the usual one, and it made every Event Creation fail on one server today.
• The warning about a partner Discord invite that can no longer be read now names the invite, so it is clear which partner to ask for a fresh link.

v0.18.534Event Creation now says what is wrong instead of failing blankly

• Reported today: creating airstrikes, gas strikes, vehicles or hordes failed on one server with an empty error page. The cause was that server's FTP address, which had the server's name saved in it instead of a real address, so the bot could not connect.
• Every create, remove and zombie-count change now explains the actual problem in the page banner: an address that does not exist, a refused login, a server that cannot be reached, or a mission folder that is wrong. The same wording shows in Discord.
• /setup ftp refuses an address that is not an address, naming what to enter instead, so this cannot be saved in the first place. Pasted URLs, folder paths and user@host are pointed out too.

v0.18.533File Drop takes files up to 1 GB, and resumes if the connection drops

• A File Drop link now takes a single file up to 1 GB. A big file goes up in pieces small enough to get through, with a progress bar showing how much has arrived.
• If the connection drops, the page retries on its own. If the page is closed, opening the link again and picking the same file carries on from where it stopped instead of starting over.
• Every piece is checked when it arrives, and a file named .zip still has to really be a zip. The link still works exactly once.
• The File Drop page shows an upload while it is still arriving: the file name, how much is in so far, and when the last piece came in. Uploads left unfinished for a day are cleared away.
• A folder is still packed into one .zip in the sender's browser, now up to 512 MB.
• File Share, added earlier today, has been removed again; File Drop covers what it was for.

v0.18.532New: File Share, private download links for big files

• The developer panel has a new File Share page, the other direction from File Drop: it sends a file to someone instead of receiving one. Put the file in the share folder on the server, create a link, and send it; they download with no account.
• Files of any size work, since downloads do not have the 100 MB limit that uploads through the site have.
• A link lasts 1 hour, 1 day, 3 days or 7 days, and shuts off 15 minutes after the first complete download. An interrupted download can be resumed or started again before then, and a link can be revoked at any time.
• The page lists each link with its status and download count. The file always arrives as a download to save, never opened in the browser.

v0.18.531File Drop takes any file, or a whole folder

• File Drop links used to accept a single .zip only, so anything else was refused with "Only .zip files are accepted." A link now takes any file type.
• Drag a folder onto the upload page, or use the new Choose folder button, and the sender's browser packs the whole folder into one .zip, keeping its layout. Picking several files at once works the same way. A single file is sent exactly as it is.
• The size limit is now 95 MB, and it holds. Uploads used to travel in a form a third larger than the file, so anything over about 75 MB was cut off before it reached the bot even though the page said 100 MB.
• Downloads from the dev panel always come down as a file to save, never opened in the browser, since an upload can now be any kind of file. A file named .zip still has to really be a zip.

v0.18.530New: stop a role from buying certain items or kits

• On the dashboard Store page, tick the items, pick a role and press Block role; Unblock role reverses it. To cover a whole category, filter to it and select all first. Each kit has its own Block and Unblock. Every item and kit lists the roles blocked from it.
• In Discord: /store admin role-block role:@Role item:<item> (or kit:<kit>), with unblock:True to allow the role again.
• In the shop, a blocked item still shows, marked "Not available to your role", with no Add button. Checkout refuses it too, so an old cart or a stale page cannot get it through.
• It goes by the roles of whoever opened the shop link. Staff buying for someone else's gamertag are checked against their own roles. Roles are read fresh from Discord each time; if Discord cannot be reached, anything role-restricted is held back until it can, and everything else sells as normal.

v0.18.529Fixed: false "Nitrado Connection Failing" alerts, and kill feeds stalling while the bot caught up

• Several healthy servers were reported as "Nitrado Connection Failing" a few minutes after the bot restarted. Nitrado was fine. The bot was catching up on a large server log, and anything it read that took longer than its time limit was thrown away, so it started again from the same place every 30 seconds and never finished. While that went on, the kill feed on those servers was not read at all, each attempt counted as a failure, and after six the bot backed off for minutes at a time.
• Catching up now keeps its place between attempts and finishes, the kill feed always gets its own time, and catching up is no longer mistaken for Nitrado failing. A Nitrado that cannot return anything at all in the time still counts, so real outages are still reported.
• An outage that has already been announced is not announced again every time the bot restarts. You still get "Nitrado Connection Restored" when it clears.
• /setup nitrado and the dashboard now refuse a Service ID that is not a number, and save nothing when they do. A server had been saved with the Service ID "Gg" and was reported as failing ever since.
• After a server restart, the bot sometimes kept reading the old script log until the next restart. It now finds the new one.
• Application questions never reuse the number of a deleted question, so an answer from a form someone still had open cannot be filed under a different question.
• The diagnostics page no longer warns about feed events being dropped on servers the bot does not poll.

v0.18.528The raid schedule is now just "damage ON at this time, OFF at that time"

• Base and container damage are scheduled with switch points: damage ON at a day and time, damage OFF at another, every week. A weekend raid window is two of them, /basedamage set state:ON day:Friday time:1759 and /basedamage set state:OFF day:Sunday time:2359, and it can span as many days as you like. Times can be typed as 17:59, 1759 or 5:59pm.
• Gone: the day lists, the separate start and end times, and having to enable a schedule after building it. Adding a point turns the schedule on. also_containers (or also_bases) changes both at once, and the timezone can be given with your first point.
• /basedamage enable and disable are now resume and pause, since "disable" read as "turn base damage off". unset removes a point by its day and time; status lists your points and says what is in force now and until when.
• The dashboard page is now called Raid Schedule: one form to add a point, and a list for bases and one for containers, each saying what is happening right now.
• Existing schedules keep working exactly as they did and are shown as switch points; they are saved in the new form the first time you change them. One small correction comes with that: a window that ended at 23:59 now runs to midnight, which is what it meant, instead of leaving the last minute of the day raidable.
• Worth a look if you set one up before: under the old schedule, windows marked ON did nothing, because ON was already the default outside every window. A schedule built only from ON windows left bases raidable all week. The page and /basedamage status now show exactly what is in force.

v0.18.527Fixed: one stuck server could stop every feed on every server

• Feeds stopped today at 16:31 for every server the bot watches, and stayed stopped. One server stopped answering partway through its turn, and because the bot finishes a full round of servers before starting the next one, the round never ended and nothing after it ran. A server that was added later that afternoon never got a first reading at all, which is how it was spotted.
• A server now gets five minutes to answer. If it has not, the round carries on without it and every other server keeps its feeds; that server is left alone until it comes back, rather than being read twice at once and losing events. It is named in the log the moment it happens, with how long it eventually took, which is what was missing today.
• Two things behind it are bounded now too: a single feed message to Discord gives up after a minute instead of waiting forever on a rate limit, and a restart no longer waits on stuck background work before saving everything it has queued.
• Also corrected: yesterday's change that made saving a server's data quicker decided whether another bot had written the file by looking at the file's timestamp. Two saves in the same instant can carry the same timestamp, so in rare cases a change made on the dashboard could have been overwritten. It now compares the file's actual contents, which cannot collide.

v0.18.526Fewer failed commands, and no typing to confirm a vehicle wipe

• /vehiclewipe start no longer asks you to type the server's exact name first. It still needs Administrator, it still only takes effect at your next restart, and /vehiclewipe cancel still switches the vehicles straight back on.
• Commands that sometimes came back with "This interaction failed" should do so far less. Saving a server's data re-read the whole file from disk, copied it in memory, and wrote it back out with indentation; on the largest server that was close to a second during which the bot could not deal with anything else, including Discord's answer to a command someone had just run. Saves now skip the re-read when nothing else has touched the file, and the files are written without the indentation (the biggest drops from 11.8MB to 4.3MB). Same data, same protection against two bots writing at once, about half the pause.

v0.18.525Fixed: mission file tools failing on Xbox servers

• Create Event, /rotation, /teleport, the store's object spawner, base damage scheduling, server wipe and /altcheck all work on your server's mission files. The bot only ever learned whether a server was PlayStation or Xbox from Nitrado, so a server whose Nitrado token had expired kept looking in the PlayStation folder. On an Xbox server nothing is there, so all of those failed with "No such file or directory". It turned up live today when Create Event tried to add a vehicle spawn on a Sakhal server.
• The bot now finds the mission folder by looking at the server's own files over FTP, which keeps working when the Nitrado token does not, and remembers where they are. That happens once at startup for every server that does not know yet, as soon as FTP details are saved, and again before Create Event writes anything. Renamed missions (like "empty.sakhal") and PC servers are recognised too. Nothing to do on your side.

v0.18.524/logins: check older logins, and see what each session did

• /logins (developer only) has a Check Older Logins button. It checks each IP behind a login or failed attempt from before AbuseIPDB was switched on, once, and shows the result on every card from that IP marked as checked later, because it's the IP's reputation today, not when that login happened. An IP that's been reported since flags its old logins. It runs in the background, checks up to 200 IPs per click, and stops on its own if AbuseIPDB's daily limit runs out.
• Failed login attempts show the same reputation check in a new Reputation column.
• Each login now has an Activity this session list: every dashboard page that session opened and every change it made, newest first, with the server name, and anything refused or failed marked. Only the page address and the result are kept, never what was typed into a form, and a page reloaded over and over counts as one line. It starts with this update, so earlier logins have no activity to show.

v0.18.523Resend a ticket panel; /logins shows more and gets device data right

• Ticket Panels on the dashboard now has a Resend button on every panel. It posts a fresh copy at the bottom of the panel's channel with the same settings and removes the old one, so there's no deleting and setting it up again. If the old message can't be removed you're told, and both buttons keep working until you delete it. For the original panel from Quick Setup, Ticket Setup's Post Panel already posts a fresh copy.
• /logins (developer only) now shows what a login's IP was actually reported doing on AbuseIPDB: the three latest reports, with the date and the reporter's country. It also shows AbuseIPDB's own country for the IP next to the location lookup's, flagged when the two disagree, and whether the IP is on AbuseIPDB's list of known-good networks.
• /logins also shows the exact operating system (Windows 11 or 10, the macOS or Android version), the phone model, CPU architecture and full browser version for Chrome, Edge and Opera, and flags a browser that reports it is being driven by automation software.
• Fixed: device data could land on the wrong login. Nine logins showed another device of the same account (an iPhone login listing a desktop graphics card), and logging back in within a day sent no device data for the new login at all. Every login is now tied to its own session. Older logins whose device data contradicts their own browser are marked as possibly another device's, rather than shown as fact.
• Fixed: a Tor login got a red Tor tag but didn't count as flagged. The red border, the Flagged Logins count and the Flagged only filter now all use one rule.

v0.18.522/logins: IP abuse scoring switched on for real, with more detail

• The developer-only /logins page has shown an AbuseIPDB abuse score since August, but no API key was ever configured, so not one of the 200 recorded logins actually got a score. It's configured now, and every new login is checked.
• Each login also shows the rest of that same check: whether the IP is a Tor exit node, what it was reported for (for example SSH, Brute-Force, Port Scan), how many different people reported it and when it was last reported, and what kind of network it is (datacenter, home ISP, mobile). A Tor login gets a tag on its card and alerts the security channel, the same as a VPN or datacenter IP already does. Logins recorded before today show none of this, rather than a guessed "No".

v0.18.521New: /game grind plays bench, range and beer for you, fast

• /game grind runs /bench lift, /range shoot and /beer drink back to back, a round of all three every 3 seconds, with no 15-second cooldowns in between. One message keeps a live tally: lifts made, hits, beers, the best of the run, and any new records or big moments. Press Stop whenever you want to end it and you get a summary of the whole run. Only you can stop your own grind.
• Every play counts on the normal bot-wide leaderboards, exactly as if you'd typed the commands. Injuries still apply: if your bench gets injured or your weapon jams, that game sits out and comes back by itself when it heals while the others keep going. A grind stops by itself after 14 minutes (Discord only lets the bot update its reply for 15); just run /game grind again to keep going. One grind per person at a time. (Typing /grind in Discord finds it too.)

v0.18.519Bot trap works without a DayZ server

• The bot trap no longer needs a DayZ server or Nitrado set up. /channel create and /channel set used to ask for a DayZ server before anything else, so on a Discord server with none connected they refused with "No DayZ server registered yet", even for the bot trap, which has nothing to do with the game server. Channels that belong to the whole Discord server (Bot Trap, Moderation Log, Welcome, Suggestions, Giveaways, Achievements, Level Up and the ticket log) now skip that step, and on a Discord server with several DayZ servers they no longer ask which one.
• The trap itself (instant ban for anyone but staff who posts there) never depended on the game server. /setup bot-trap and the dashboard's General Settings page could already set it; General Settings now lists the bot trap in its description so it's easier to find.

v0.18.518Pick the emoji on your embed buttons

• Every button on an embed you build can now show an emoji of your choice: link buttons, role buttons and player-action buttons. In /embed create there's a new Button Emoji box when you add a button; on the dashboard's Embed Builder each button has an Emoji box. Paste any one emoji (like 🛒), or use one of your server's own emoji by typing :its_name:. Leave it blank for no emoji; existing buttons stay exactly as they are.
• Player-action buttons start with that action's usual emoji filled in (🛒 for Store, 💰 for Balance and so on), which you can change or clear. If you enter something Discord won't accept on a button, like a symbol that isn't really an emoji or another server's emoji, you're told straight away rather than the embed failing to send later. If one of your server's emoji is deleted after you use it, the button still posts, just without it.
• Also fixed: the bot only learned your server's emoji when it started up, so an emoji uploaded while it was running didn't work in embeds (as :name: or on buttons) until the next restart. It now picks up new and deleted emoji straight away.

v0.18.517Reaction roles on any message, not just panels

• Reported: /reactionrole addrole with an ordinary message's ID said there was no panel. It now works on any message in your server, such as your rules or welcome post. Copy the message ID (or the message link) and run /reactionrole addrole message_id:<it> emoji:<> role:<>; members who react with that emoji get the role, and lose it when they remove their reaction. You can run it from any channel; the bot looks in that channel first, then the rest of the server.
• The message itself is never edited or replaced, the bot only adds its own reaction to it. Removing a role only takes the bot's reaction off, never anyone else's, and once a message has no reaction roles left it stops being tracked. The dashboard's Reaction Roles page does the same, with the message's ID or link in the Message box.
• It only finds messages in channels both you and the bot can see, and only in your own server. A message in a thread, or in a very large server, is easiest to add by its link (right-click the message, then Copy Message Link).

v0.18.516New: /vehiclewipe clears every vehicle without touching bases

• New /vehiclewipe command for admins. /vehiclewipe start confirm_name:<your server's exact name> switches the vehicle events in your server's events.xml off, so the next restart clears every vehicle on the map while bases, stashes and everything else stay put. Once that restart has happened, the bot switches the vehicle events back on by itself and posts in the channel you ran it from; vehicles then spawn fresh on the restart after that. Add restart_now:True to restart straight away instead of waiting for your next one.
• Only vehicle events that were switched on get switched off and back on, so anything you already had off (no boats, say) stays off, and wreck events like heli crashes and police cars are left alone. /vehiclewipe status shows where a wipe is at, and /vehiclewipe cancel switches the vehicles back on straight away. It needs FTP, Nitrado and your map set (/setup map). Checked against the real Chernarus+ and Livonia files; on any other map it tells you if it finds no vehicle events rather than guessing.

v0.18.515Security fixes: player positions, Cash, and role rewards

• Player positions are now private. /player locations and /player track need the Map permission, the same one the dashboard map has always needed, and only the person who ran them sees the result. Before this, anyone could run them and they posted every online player position into the channel, which on a PvP server shows exactly where people and their bases are. /activitylog recent still works for everyone but no longer shows position lines unless you have Map. /player online is unchanged.
• Moderators now need the Store & Economy permission to add, take or set Cash in a faction bank, or to put a Cash prize on a wheel segment. The dashboard already worked this way; the Discord commands had been skipping the check, so a moderator trusted only with factions could create unlimited Cash for members to withdraw. If a moderator tells you they are being refused, grant them Store & Economy, or keep those actions with admins.
• Role rewards can no longer be pointed at a role with admin-level powers unless you are a full Discord Administrator. This covers auto-role, link-role, ban-role, player-role, level-up roles and achievement roles. Without it, someone holding the .bOne admin role (but not Discord Administrator) could have the bot hand them real Discord admin. @everyone is refused for everyone. Nothing changes for server Administrators, or for roles with no special permissions.

v0.18.514The casino is back, for points only

• /casino is back with six games: coinflip, dice, roulette, slots, high-low and blackjack. It plays for points that are worth nothing and cannot be spent, traded or turned into Cash; they exist purely for the leaderboard, the same way /bench and /beer work.
• There is no bet to place. Each play rolls its own random stake, anywhere from 10 to 10,000, so no two wins come out the same size. Win and you score the stake times that game payout; lose and you score nothing. Your points never go down.
• The riskier games pay more when they hit (a single roulette number pays 36 times, three 7s on the slots pays 55 times), but every game averages out to about the same points per play, so none of them is the one you are supposed to grind.
• See where you stand with /casino leaderboard, or pick Casino Points in /leaderboard. /casino stats shows your points, win rate and biggest win. There is a 15 second cooldown shared across all six games.

v0.18.513Item names now come from DayZ itself

• Item names are now read straight out of the game files, so they match what a player sees in their inventory: 1,937 items, covering 99.8 percent of everything a store can stock. The previous update managed 296 by reading the DayZ wiki; this replaces that entirely.
• It also gets names the wiki simply did not have: ACOGOptic is the ATOG 4x32 Scope, SodaCan_Cola is Nota Cola, ImprovisedSuppressor is the Plastic Bottle Suppressor, and Epinephrine is the Epinephrine Auto-Injector.
• The game gives all 41 armbands the single name Armband, which is fine in an inventory tooltip but unusable in a store list where the name is also what /buy matches on. Variants keep their colour or faction, so you get Armband (Black) and Armband (Chernarus) rather than 41 identical rows. No two items can end up sharing a name.
• The Refresh item names button on the Store page works the same way: it shows you every proposed change first and nothing is touched until you confirm. Almost everything is now marked Verified rather than Tidied.

v0.18.512Items can now use their real in-game names

• Item names were built by reshaping the classname from types.xml, which cannot produce a real name: DayZ calls AKM the KA-M, Mosin9130 the Mosin 91/30, Izh18 the BK-18, and FAMAS the LE-MAS. The bot now carries the real names for 296 items and uses them everywhere an item is shown. Colour variants follow their base, so AK101_Black reads as KA-101 (Black).
• New items added from the Item Catalog get the real name automatically. For items already in your store there is a Refresh item names button on the Store page. It shows you the full list of proposed changes first and nothing is touched until you confirm, because /buy and /store item-remove look items up by name.
• The preview marks each proposed name as Verified or Tidied. Verified means it came from real DayZ game data; Tidied means the bot reformatted the classname because no verified name exists for that item yet. Roughly 300 of the items a typical store stocks are verified today, and the rest still show a readable name rather than a raw file name.

v0.18.511Fix: store item pictures were not loading for players

• The pictures added in the previous update were not actually reaching players. The address they load from was set up for the admin pages and quietly required an admin login, so on the player store page every picture was redirected to a login screen and showed as broken. Item pictures no longer need a login.
• They are still only served from the pictures already downloaded, so opening the store page can never make the bot go fetch from the source site. That keeps a busy store from getting the bot temporarily blocked there, which would take pictures away from every server at once.

v0.18.510The player store now shows a picture for every item

• Item pictures were showing on the admin side (Store Items and Item Catalog) but not on the store page your players actually open, which showed name and price only. Every item tile now shows the item, and so does every kit, using the first item it contains.
• Items with no artwork available no longer leave a hole: they fall back to an icon for their category, so a tile is never blank. This matters more than it sounds, since a little under half of the items stocked across servers have no picture available at all.
• Pictures load as you scroll rather than all at once, which keeps a large store fast to open. They are also served through the bot itself rather than hotlinked, so they cannot break if the source site blocks them.

v0.18.509Edit an embed you already posted, instead of posting it again

• Custom embeds could only ever be re-sent: fixing a typo meant deleting the live message and posting a fresh one, which broke every saved link, pin and jump anyone had to it. There is now an Update Posted button on the dashboard Embed Builder, and a matching /embed update id:<>, that edits the message already sitting in your channel. Its reactions, its pins and its place in the channel all stay exactly where they are. It also means an embed posted before a bot-side rendering fix can pick that fix up without being reposted.
• If the original message has since been deleted, or belongs to a different bot, it posts a fresh one instead and tells you that is what happened rather than quietly reporting success.
• Removing a mention from an embed and then updating it now clears the notification line too. Previously an edit left the old one in place, so that person kept being pinged by every future edit.
• The dashboard was showing a raw emoji code (something like <:bb_warn:1524...>) in the notice it gives when a reaction role panel or a suggestion had to be reposted. That code is a Discord-only format; it now reads as plain text on the web page.

v0.18.508Server emojis and member mentions render properly in embeds

• Typing one of your own server emojis as a shortcode, like :yourEmoji:, into a welcome message, ticket panel, reaction role panel, sticky message, suggestion or a custom embed was showing up as plain text. That shortcut is only converted by Discord when a person types it into the message box; a bot has to send the full emoji itself. It now does, matched against your own server emojis. Anything it does not recognise is left exactly as you typed it.
• The welcome message was showing a raw ID number instead of the new member. A mention placed inside an embed only shows a name when Discord already knows that person, and somebody who just joined is exactly who it does not know yet. The mention now rides on the message itself, so it shows their name and actually notifies them, which is what {user} always promised to do.

v0.18.507Fixed /help failing on four of its categories

• Picking Setup and Configuration, Automation and Tickets, Server Tools or Games and Economy in /help was failing outright, because Discord counts its size limit across the whole message rather than per section. Splitting a long category into several sections made it larger, not smaller, so three categories that used to work were broken by the split. Each category now shows one page at a time with Back and More buttons, so nothing is cut and nothing is too big to send.

v0.18.506The Event Map stops re-downloading the whole map every time you move it

• The map tiles behind the Event Map were being sent with an instruction telling your browser never to store them, so it threw them away and downloaded all of them again on every page load, every pan and every zoom. That is roughly 5.6 MB each time, which is exactly why the map felt like it was being throttled. Tiles are now cached properly, so the map downloads once and is reused.
• The same problem was quietly affecting every static file on the site, including the fonts on every page, which were set to be kept for a year but were being re-downloaded on every single page view. All of them are now cached as intended.

v0.18.505Store and Item Catalog pictures load properly again

• Item pictures were being sent at their full original resolution, up to 6 MB each, into thumbnails only a few dozen pixels wide. A single Item Catalog page asked the browser to load over a gigabyte of images, which is more than it will hold, so the pictures never finished drawing and every tile just stayed a black square. Pictures are now resized before they are sent, around 97 percent smaller, and they look the same at the size they are actually shown.
• Internal: a half written or malformed cached picture could take the whole dashboard process down, because the image decoder aborts instead of reporting an error. Pictures are now checked for damage before anything tries to decode them.

v0.18.504Fixes now actually reach .Brick when they ship

• .Brick runs from inside the main bot folder, so every deploy was correctly updating its files but never restarting it. It kept running whatever it had loaded at its last manual restart, which meant fixes could sit on the server unused. Deploys now restart it along with everything else.

v0.18.503Fewer wasted calls to Nitrado, and a safer page-comment strip

• When a Nitrado log download fails, the bot no longer retries up to nine times for a single failure. That was making rate-limiting worse rather than better.
• Internal: the page-comment strip now falls back to its safe mode for script types it cannot verify, instead of shipping an unverified result.

v0.18.502Cash rewards now need the Store & Economy permission everywhere

• Setting a Cash reward on the prize wheel, on a quest, or in a faction bank now requires the Store & Economy permission, the same as it already did for Cash zones. A moderator granted only one of those features could previously create Cash out of nothing, which is spendable on real in-game items. Editing everything else about those features is unchanged.

v0.18.501Shop prices and saved locations no longer get reverted

• Fixed shop item prices, kits, saved player spawn locations and chat levels being silently reverted when the two bot processes saved at the same time. Editing prices on the dashboard now sticks.

v0.18.500A kick can no longer lift a permanent ban, and .Brick economy balances are safe on restart

• Fixed a case where kicking someone who was already permanently banned quietly unbanned them five minutes later. Permanent bans are now tracked properly, and are never auto-expired.
• Fixed a .Brick issue where casino, Grit and expedition balances could be erased when the bot restarted. Those balances are now loaded on startup, and the bot refuses to overwrite a file it never loaded.

v0.18.499Closed a way chat could fake in-game events, and a log line that could freeze the bot

• Fixed a hole where a player could type a specially crafted chat message and have the bot treat it as a real kill. That could award Cash, change kill stats, and even get another player auto-banned from the DayZ server. Every chat channel and spacing variant is now covered.
• A single malformed line in a server log could freeze the bot for minutes. Log lines are now length-capped in both log readers, not just one.

v0.18.498Closed a Cash duplication hole, and fixed a punishment DM that could double-charge

• Fixed a way a moderator could create Cash out of nothing by using a reserved word as a gamertag. Reserved words are now refused everywhere a gamertag is accepted, not just in one command.
• A very long punishment reason no longer causes an error after the punishment has already been applied. Previously a long reason on a fine would show an error after the balance was taken, so retrying charged the player twice. Long reasons are now shortened in the DM instead.

v0.18.497Fixed /help silently doing nothing, and closed an @everyone loophole

• /help was quietly broken: picking Games and Economy (and, on servers with longer names, Automation) did nothing at all, because the page was a fraction over Discord’s size limit once your server name was added to the footer. Long categories now continue onto a second page instead of failing.
• The @everyone role can no longer be set as the .bOne admin or moderator role. Doing so would have quietly given every single member in the server full bot-admin access, including the wipe command, and would also have made everyone immune to being warned, kicked or banned.

v0.18.496Closed two more ways a role reward could hand out real Discord powers

• Level-up role rewards and custom-achievement role rewards can no longer be pointed at a role carrying elevated Discord permissions, unless a full server Administrator sets it. The same protection already covered the admin, moderator, auto and linked role settings.

v0.18.495Docs: a new How Do I section, and some corrections

• New How Do I page in the docs, organised by what you are trying to do rather than by command name. It answers things like renaming a server, banning someone with a reason, or announcing when a creator goes live, and gives you the exact command for each.
• Documented several commands that were missing from the docs entirely, including /quickstart, /creator, /restart-schedule, /start and /stop.
• Fixed two wrong instructions in the docs that pointed at a command and a page that do not exist.

v0.18.494You can finally rename a DayZ server

• New: rename a server from Discord with /setup server-rename, or from the Server Config page on the dashboard. Only the name changes ; economy, stats, punishments, zones and channels all stay exactly where they are.
• Until now the only way to fix a server name was to remove it and add it again, which permanently deleted everything tracked for it.

v0.18.493Players are now told why they were punished

• Anyone warned, kicked, fined, temp-banned or banned now gets a DM explaining what happened, why, who actioned it, and when it expires. Previously only kicks and the automatic zone/base-ping bans sent one, so most punishments left the player guessing.
• Added an optional reason to /dz-ban, which is what the player sees in that DM.
• Admins who would rather not send these can turn them off per server.

v0.18.492Every icon now renders correctly on .Brick

• All 89 custom icons the other bots use are now uploaded to .Brick and render properly in its messages. Before this, anything .Brick posted showed the raw icon text instead of the picture, because Discord only draws an icon for the bot that owns it.

v0.18.491Factions removed from .Brick

• The Factions feature is no longer part of .Brick ; its command and dashboard page are gone from .Brick servers. Factions is unchanged on the DayZ bot.

v0.18.490Support for .Brick, and a dashboard that matches your bot

• The dashboard now recognises .Brick servers, so they can log in and manage their settings here like any other server.
• Each server now only sees the sections that apply to it. A .Brick server no longer shows DayZ pages it has no use for, and DayZ servers are unchanged.
• New Casino page for .Brick servers, covering the global chips opt-in.

v0.18.489Moderation records no longer lost between the two bot processes

• Temp-bans, kicks, fines, warnings and zone/base offence records are now merged per record across both bot processes instead of one overwriting the other. Previously an admin lifting a ban at the same moment the bot issued one could drop the new record while its in-game ban had already applied, leaving a temp-ban with nothing left to lift it.
• Pages served by the site no longer include any leftover developer notes, including notes at the end of a line of code which were still being sent before.

v0.18.488Adversarial review: 10 real defects closed, two of them security

• Position feed: an infected or weaponless kill no longer posts a phantom position for the victim at the KILLER’s coordinates. Every such kill was publishing a location the named player was never at, into the feed and the Player Activity Map.
• Cash: a moderator with only the store permission can no longer send a protected admin’s Cash, nor route any other player’s Cash into their own balance. Paying on a player’s behalf to a third party still works exactly as before.
• Roles: pointing auto-role or linked-role at a role carrying elevated Discord permissions is now blocked for non-Administrators, matching the existing rule on the admin and moderator role fields.
• Feeds: a channel id belonging to a different guild is now refused instead of posted into, so a stale or imported id can no longer leak one community’s player locations into another’s Discord.
• Trusted logins: removing a trusted login source now sticks instead of reappearing on the next save.
• /crime now reports the fine actually taken rather than the full roll, so a player with less than the fine no longer sees a larger number than they lost.

v0.18.487Flag feed: log lowers as well as raises, and show which flag

• The territory flag feed now records a flag being lowered, not just raised. Before, only raises were caught and a lower was dropped entirely.
• Each entry now shows the flag type in plain form (for example Flag Bear, with the raw id kept alongside), who changed it, and the server time it happened.
• Note: standard DayZ only writes a log line when a player RAISES a flag (which resets the territory timer); a flag coming down on its own timer is not logged by the game, so there is nothing to feed for that. Manual take-downs and servers with expanded logging that emit a lower line are now fed correctly.

v0.18.485Hardening: internal ports no longer listen on the public interface

• The dashboard and the health-check endpoint were listening on every network interface, so the server firewall was the only thing between them and the internet. Both now listen only on the machine itself, which is where the web server already talks to them. Nothing changes for anyone using the site.

v0.18.484Security round 2: creator alerts, session revocation, private channels and more

• Anyone could make the bot ping @everyone by linking a streamer they do not own to /creator link, since linking only checks the handle exists. Alerts from a self-linked creator now post without a ping until an admin approves them with /creator admin approve. Creators linked before this keep pinging, so nothing goes quiet unexpectedly ; /creator admin list shows which are approved.
• Revoking someone dashboard sessions could be silently undone by the other bot process and come back valid after a restart. The shared settings file is now merged properly, and a revocation can never move backwards.
• A moderator with Channel Manager could make any channel public, including staff channels they cannot see. They can now only change channels visible to them.
• A moderator with only the Zones permission could attach a Cash reward when drawing a zone, which is minting currency. That now needs the Store and Economy permission, matching the other two ways to create a cash zone.
• Removing someone from a ticket accepted a role instead of a person, which could expose a private ticket to the whole server. It now only accepts a real member.
• Private links (burn notes, shop, spin) could end up written into the bot log and forwarded to a Discord channel when a page errored. They are now masked.
• /work, /beg and /crime now draw their payout from a cryptographic random source, matching the prize wheel.
• A single unusually long line in a server log could stall the bot for up to a minute. Long lines are now skipped.

v0.18.483Security: six holes closed, including one that let any player get another player banned

• The serious one: typing a fake server log line into in-game chat made the bot treat it as real. That could mint Cash, fake kill stats, claim another player bounty, and worst of all trigger a zone auto-ban on whoever the message named. Chat text is now blanked out before the log is read, so nothing typed in chat can ever be read as an event.
• Reminders could ping the whole server. /remind needs no permission, and the reminder text was posted as a normal message, so anyone could schedule an @everyone. Reminders now only ever ping the person who asked for one.
• The .bOne Admin role could be pointed at a role carrying real Discord Administrator and then granted to yourself. Only a full server Administrator can do that now.
• /heatmap had no permission check at all: any member could render player location maps, even on a server that had deliberately hidden locations, and force the image into a staff channel. It now needs the Map permission.
• Two autocomplete dropdowns leaked admin-only data to anyone who typed the command: the list of ban-protected staff accounts, and any other member linked gamertags. Both now return nothing unless you have the matching permission.
• Fixed the admin cash commands autocomplete, which never appeared because it was wired to the old command name.

v0.18.482Fix: some Cash leaderboard entries showed a long number instead of a name

• A few players appeared on the Cash leaderboard as a raw 18-digit number instead of their name. Those balances had been created by typing an @mention into a player field back when those fields accepted any text, so the mention itself got saved as the gamertag. They now show the person name.
• This can no longer happen: since the Discord-first economy update, typing an @mention resolves to that person linked gamertag, and someone with no gamertag linked is refused outright instead of having a balance created under their ID.

v0.18.481New: Cash leaderboard

• Added a Cash ranking to /leaderboard, alongside Kills, KDR, Distance and Playtime. It shows the top 25 players, or however many there are if fewer, and is per DayZ server, so a guild running two servers gets two separate rankings.
• Banked Cash counts toward the total and is shown next to it, so someone keeping their money in the bank is not ranked as if they were broke.
• Players are listed by their Discord name where they have linked one, matching the rest of the economy, and by gamertag where they have not.
• The auto-updating Leaderboard channel includes it too, at the usual top 5 alongside every other category.

v0.18.480Fix: garden plots showed up as "Nameless Object" in the placement feed

• Garden plots were being detected and posted the whole time, but DayZ does not give them a display name, so every one appeared as "Nameless Object" and nobody could tell what it was. They now read as "Garden Plot".
• Fixed for any item with the same problem, not just garden plots: when DayZ gives no name, the feed now works one out from the item id instead of printing a placeholder. Checked against every configured server, where garden plots are currently the only item affected.

v0.18.479Fix: missing placement events on servers set up before the Placement feed existed

• Placed items (tents, barrels, fireplaces, kits) used to appear in your Construction channel. On 26 August they were split into their own Placement feed, but nothing was created for servers that were already set up, so those servers just stopped seeing them. Six of eighteen live servers were affected, one of which was losing them entirely rather than posting them somewhere unexpected.
• If you have not set up a Placement channel, placements now go back to your Construction channel, which is where they went before the split and where you originally asked for them. Nothing changes if you have set one up.
• The diagnostics page no longer reports those servers as dropping events when they are not.

v0.18.478Quieter logs when Discord is slow, and no more wrong-platform base damage writes

• When Discord takes longer than its own three second limit to accept a reply, the command fails on their side and there is nothing the bot can do about it. It was making that worse: one expired command wrote four log lines including a full crash trace, then tried to reply a second time, which could never work and made another slow request while Discord was already struggling. It now records one short line and goes straight to the direct message fallback, so you still hear about it.
• Measured on the live bot before changing anything: across 411 slow replies the bot own work took 81ms typically, while Discord side of the round trip took just under a second typically and up to 3.5 seconds. The server was idle and there was no rate limiting, so the delay is Discord end.
• Base damage schedules no longer guess whether a server is Xbox or PlayStation. A newly added Xbox server could write to the PlayStation folder for the first few minutes and log a confusing file not found error until the log feed worked the platform out. It now waits for that instead. Servers set up with FTP but no Nitrado token keep the old behaviour, since the platform can never be detected for them.

v0.18.477Fix: store purchases failing because Nitrado database logins were saved as FTP logins

• Nitrado gives you two sets of credentials that sit next to each other and look almost identical: FTP (port 21, username like ni13319848_2) and a database (port 3306, username ending in _DB). Saving the database pair in the FTP form breaks the Corna Store and nothing else, because everything else reads through the Nitrado API and keeps working, so the server looks perfectly healthy until a player tries to buy something.
• /setup ftp now refuses those credentials up front and tells you the exact username to use instead, rather than saving them and failing at someone purchase weeks later.
• The diagnostics page flags any server that already has them saved, so an existing broken setup gets found without waiting for a failed purchase.
• A purchase that cannot be delivered now says the server file access needs an admin to check it, instead of showing a raw error like read ECONNRESET (control socket). Cash was already refunded automatically in every case and still is.

v0.18.476Security follow-up: the comment stripping now covers every page, not just the public ones

• A re-audit of yesterday’s fix found it incomplete. It cleaned the main public pages, but missed the shop, spin and player-profile pages, which build their own page shell, and missed any page with styling written directly into it, which included the developer diagnostics and login pages.
• Those are the pages that actually carry player data, so they were the ones that mattered most. Stripping now happens once on the finished page instead of in each individual stylesheet, so every page is covered, including any page added later.
• The public player profile alone went from 87 KB to 64 KB.

v0.18.475Security: the public site no longer ships its own source comments, and private links stay out of search

• Every public page was serving the comments from its own stylesheets and scripts: 253 KB of the 1451 KB the site delivered, including dated internal engineering notes, references to specific past bugs, and quoted user feedback. Anyone using View Source got a running commentary on the project. Comments are now stripped from what is sent to a browser, while staying in the source where they belong. The public site is also 269 KB lighter.
• robots.txt said Allow: / , which invited search engines to index private links. A shop, spin, burn-note or file-drop link IS its own password, so an indexed one is a private single-use link republished permanently in search results. Those, plus player profiles and the whole dashboard, are now excluded both in robots.txt and with a noindex header for crawlers that ignore it.
• Public player profiles keep working exactly as before for anyone given the link ; they are just no longer discoverable through search, which also removes the easiest way to walk a whole community roster by following the other player names each profile lists.

v0.18.474New: sticky messages

• New /sticky set|remove|list. A sticky message sits at the BOTTOM of a channel and re-posts itself as people talk, so it never scrolls away the way a pinned message does. Good for rules, support hours, or a link people keep asking for.
• One sticky per channel, with an optional heading. /sticky set uses the channel you run it in, or name another with the channel option.
• It re-posts at most once every 15 seconds, so a busy channel does not get spammed and Discord does not rate-limit the bot. During a fast burst the notice may sit a few messages up ; it drops back to the bottom on the first message after that.
• Removing a sticky also deletes the copy sitting in the channel, not just the setting behind it.
• Admin-only by default, like every other management command. Grant it to your .bOne moderator role from the Moderator Permissions page if you want moderators managing them.

v0.18.473Clearer answer to "can players really create and delete channels?"

• Discord's Integrations page lists every .bOne command as available to @everyone, which reads alarmingly like players can create, edit and remove channels or delete a radio frequency. They cannot: .bOne checks its own permissions on every command before doing anything, and a player gets a private 'you do not have permission' reply instead.
• Commands are registered that way on purpose, so that someone holding only your .bOne Admin role can use the bot without also being handed Discord's full Administrator permission.
• The Moderator Permissions page now explains this directly, including how to restrict the commands in Discord's own Integrations screen if you would rather they did not show up for regular members at all.
• Added a permission test suite covering the whole boundary, so a future change cannot quietly open channel management, radio frequencies, bans, zones or the economy to non-admins.

v0.18.472Cash now talks about people by their Discord name, not their console gamertag

• Balances and payments were confusing because everything was labelled with a PlayStation/Xbox gamertag, which is often nothing like the name people know each other by. Cash replies now tag the Discord account instead: "@Bob sent Cash to @Steve" rather than two console names nobody recognises.
• Anywhere you pick a player, you can now start typing their Discord name, nickname or ID and pick them from the suggestions ; the old gamertag still works if that is what you know. This covers /pay and the admin /dz-store cash-give, cash-take and cash-set commands, which had no suggestions at all before.
• /pay's recipient field is now called to_player rather than to_gamertag, since it no longer has to be a gamertag.
• If you pick someone who has not linked a gamertag yet, the bot now says so by name instead of quietly creating an empty balance under whatever was typed.
• Your balance still tracks your in-game character (that is the only thing the DayZ server itself reports), so a player with two linked gamertags still sees which one a balance belongs to.

v0.18.471Fix: a Discord outage no longer floods the bot log with thousands of identical errors

• When Discord's own gateway has a bad day it refuses connections in a tight loop while the bot reconnects by itself. Each refusal was recorded as a separate internal error: one real incident produced 4,319 identical lines in a single day, which was 95% of every error the bot had ever logged, and it also set off the developer error alerts. Repeats are now counted and reported once per five minutes instead, while the first one, and any genuinely different failure, still appears immediately.

v0.18.470Fix: typing quickly in a command no longer logs an internal error

• Every keystroke in a slash-command suggestion box opens a new request and Discord throws the previous one away, so anyone typing faster than the reply leaves one behind. The bot was recording that as an internal error and counting it toward the developer error alerts, even though nothing was wrong and the suggestions you actually saw were correct. It is now recorded as the routine thing it is, while genuine suggestion failures still surface as errors.

v0.18.469Fix: a diagnostics warning that told you to fix something that was not broken

• The health check warned that "onlineplayers" events were being silently dropped and that setting a default channel would catch them. Neither was true: the Online Players feed is opt-in and simply does nothing until you give it a channel, so there was nothing being dropped and a default channel would not have changed anything. On the live data that was three servers getting a misleading finding.
• The list of event types that deliberately never fall back to your default channel now lives in one place, so the feed itself and the health check can no longer disagree about which ones those are.

v0.18.468Fix: long lists could cut an ID in half, and faction names had no length limit

• /embed list and /giveaway list cut off mid-entry when long, which could show half an ID: the exact number you then type into /embed send or /giveaway reroll. They now drop whole entries and say how many were left out.
• Faction names and tags could be saved from the dashboard at any length, while Discord caps them. One over-long name broke /faction info for that faction and could break /faction list for the whole server. Both are now capped on the dashboard too.

v0.18.467Fix: Base Damage status showed 1970, and Event Channel Routing was missing most event types

• The Base Damage page reported "Last written to the server" as either "1/1/1970" or "never", and was never right. It was reading a yes/no value as if it were a date. It now shows the queued state and the live state in plain words, the same way /basedamage status does in Discord.
• Event Channel Routing on the Server Config page only listed 20 of the 56 event types, so most behaviour-detection alerts and dynamic-event types could not be routed from that page at all, even though the page itself tells you to set the Heatmap channel there. It now lists every type.

v0.18.466Fix: settings the dashboard accepted that Discord would have refused

• A store item saved with a fractional quantity or price broke checkout for everyone who put it in a cart, with only a generic error and nothing to point at the cause. Both now have to be whole numbers, as they always have been in Discord.
• Cash rewards could be saved as negative numbers from the dashboard. They then silently never paid, while both the page and /store admin config kept showing them as live settings. Only the starting balance was previously checked.
• Removing a keyword’s channel restriction reported success even when the keyword did not exist or was never restricted to that channel. It now tells you what actually happened.
• Saving a behaviour detector with an invalid threshold showed an error but had already turned the detector on or off anyway, and that change stuck. A rejected save now leaves the detector exactly as it was.
• /warn could skip its "is this person a protected admin" check entirely if Discord failed to look the member up at that moment. It now refuses and asks you to try again, matching every other punishment command.

v0.18.465Fix: duplicate ticket panels, blocked applications, and hidden alt-check results

• Re-running Ticket Quick Setup posted another copy of the panel every single time on servers run by .bOne, which is most of them. It was checking whether a panel already existed using the wrong bot's identity, so it never recognised its own panel.
• A player who already had an open ticket could not submit a web application at all, being told they already had a ticket open. A web application never creates a ticket channel, so it is no longer blocked by one.
• Creating a ticket panel in web-application mode without picking an application reported success and posted an Apply Now button that failed for every player who clicked it. It now asks you to pick one.
• The Alt Check page silently hid results: on a scan finding more than three account clusters, everything in the fourth and beyond disappeared from the page entirely, while the same scan in Discord showed them.

v0.18.464Performance: the bot should feel noticeably more responsive

• Every 30 seconds the bot was re-reading and re-parsing every single server's data file just to check one field: measured on the live host at nearly half a second of the bot being completely frozen, twice a minute, in both bot processes. It now only re-reads a file that has actually changed. This is the most likely cause of commands occasionally taking seconds to respond.
• The Live Players map image posted to Discord was being rendered at full interactive-map resolution, taking over a second of frozen bot time and uploading a 2.4 MB image every couple of minutes on servers that use it. It is now rendered at a size suited to a Discord embed, roughly halving both.
• Paging through /changelog or /quickstart could log an internal error and count toward the developer error alerts when Discord returned a routine, harmless failure.

v0.18.463Fix: /setup ftp could silently not save, and Server Monitor showed the wrong status

• On a server with more than one DayZ server configured, /setup ftp could tell you the credentials were saved while nothing was actually stored, leaving /rotation, /teleport, /wipe, store purchases and /createevent all reporting "FTP isn't configured yet" indefinitely. If you have hit that, re-run /setup ftp.
• The Server Monitor page always showed "Considered down: no (0 consecutive failed checks)" for anyone who has not added a second DayZ server, even while the outage alert had already been posted, and its reset button cleared a counter nothing was using. The page now reads the same state the monitor writes.
• /dz-kick could create two overlapping kick records for the same player when two moderators (or Discord and the dashboard) acted at nearly the same moment. The leftover record then blocked every future kick on that gamertag and could keep an unrelated ban from ever lifting in game.

v0.18.462Fix: four dashboard features that were quietly broken

• Bulk-adding a whole item category from the Item Catalog gave every item the same internal ID, because they were all created within the same millisecond. Checkout resolves a cart line to the FIRST item with that ID, so a player buying one item could be charged for, and given in game, a completely different one. If you have used that button, your store is worth a look.
• "Set Count" on the Event Creation page never worked at all: it sent the wrong shape of data and failed with a raw FTP error every time. Changing a horde's zombie count was only ever possible from Discord.
• Announcement channels can now be picked anywhere on the dashboard, matching Discord. Before this, a feed you had pointed at an announcement channel from Discord could not be seen by the dashboard at all, so saving an unrelated setting on the same page either cleared it or silently moved it to a different channel.
• Application links were reusable instead of one-time on most servers, so one person could submit the same application repeatedly for 24 hours.

v0.18.461Security: cash zones now need the Store permission, and other dashboard hardening

• Creating a Cash-paying zone from the dashboard only required the "Zones" moderator permission, while the same action in Discord requires "Store & Economy". A moderator you had deliberately kept out of the economy could create a map-wide zone paying any amount per minute. It now requires Store & Economy, matching Discord.
• Cash zone rewards now have to be a whole number of at least 1 on every dashboard form, matching Discord. A reward of 0 or below still used up the player's visit cooldown and then paid nothing, so the zone looked configured but never worked.
• Drawn (polygon) zones were the one place an offense window longer than 90 days was still accepted, which quietly behaved as 90 and gave repeat offenders a shorter ban than intended.
• Several configuration numbers were written into the dashboard's HTML without escaping. Normal use could not reach it, but a restored backup could, so they are now escaped like every other field.
• A server the developer has switched the bot off for can no longer be managed from the dashboard, and that switch can no longer be turned off by restoring a backup ; it previously covered Discord only.

v0.18.460Fix: auto-mod timeouts that never happened, and expedition best finds that got lost

• Auto-mod rules set to "timeout" silently did nothing to anyone who was not already in the server member cache: the message was deleted, the warning notice was posted and the mod log recorded an action, but no timeout was ever applied and nothing reported the failure. Timeouts now apply to everyone the rule catches.
• /expedition only ever recorded the LAST item of a run as your best find. Pull a legendary and then a common before banking, and the legendary was thrown away; for a first-time player it was worse, because the common was stored as their best find over the legendary the bot had just announced. Your rarest item from the run now counts.
• Setting a horde's zombie count to 0 was accepted and reported as saved, but wrote a self-contradictory entry to your server that DayZ silently ignores. The count now has to be at least 1, matching what creating a horde has always required ; remove the spawn if you want it gone.
• /embed send and /embed delete could report "the application did not respond" while actually having worked, if Discord was slow. They now acknowledge you first, like every other command.

v0.18.459Fix: /createevent browse views could fail on servers with a lot of events

• /createevent's browse screens (hordes, custom vehicle spawns, event positions, scheduled cleanups) sent their whole list as one message with no length limit, so on a server with enough events created they failed outright, and the admin could not see or remove anything. They now fit, and say how many entries were left out.
• Open Tickets and Ticket Panels lists were cut off mid-entry when long, which could show half a ticket or panel number, the exact number you then type into another command. They now drop whole entries instead.

v0.18.458Faster /altcheck, and a corrected number on the Argus page

• /altcheck on a busy server used to lock the bot up for over a second while it worked, which stalled every other server's live feeds and every other command for that whole time. It is now about eight times faster on the same data and no longer gets dramatically worse as a server gets busier. Results are unchanged.
• The Argus page gave two different numbers for its own detection rules, 34 in one place and "19+" in another. Both now read from one figure.

v0.18.457Fix: tickets that looked like they failed but had not, and a category list that could break

• If the opening message inside a brand-new ticket failed to post, you were told your ticket failed to be created. It had not: the channel was there with your name on it, you were just never given the link, and you were then blocked from opening another because you already had one open. For an application, the answers you submitted were sitting in a channel you had never seen. The ticket is now reported as created, because it is.
• /ticket category-list could fail outright on servers with a lot of categories and role restrictions, because the whole list was sent as one message with no length limit. It now fits, and says how many entries did not, instead of failing. This matters because it is the command /ticket panel tells you to run to find your category numbers.
• Ticket category descriptions are now capped at the 100 characters the picker actually displays, on both Discord and the dashboard. Anything longer was stored but never shown.

v0.18.456Fix: auto-roles that silently never applied now tell you why

• Found on a live server: an auto-role was set up correctly and nobody who joined ever got it. Discord will not let a bot hand out a role positioned at or above the bot's own role, and .bOne's role was at the bottom of the list. Nothing anywhere said so ; the only trace was an internal log line no admin can see.
• Setting an auto-role now warns you on the spot if .bOne's role is too low, both in Discord and on the dashboard. The same warning was already given when picking a link role, a level-up role, an achievement role or a reaction role ; auto-role was the one that never got it.
• /setup view now flags any configured role .bOne can no longer grant, so a role that was fine when you set it and later got moved shows up as a problem where you would actually look for one.

v0.18.455Fix: protected gamertags could still be banned, and offense windows over 90 days did nothing

• Protecting a gamertag says it is exempt from every ban path on your guild. That held when a punishment was first applied, but not afterwards: if the in-game ban had failed to go through the first time, the automatic retry banned them anyway, over and over until it stuck. Applies to Zone auto-bans, Base Ping auto-bans, /dz-kick and /rolepunish. A pending punishment against a gamertag you have since protected is now dropped instead of retried.
• The offense window on Zone and Base Ping auto-actions is what decides how far back repeat offenses count toward a longer ban. Offenses are only kept for 90 days, so any window longer than that was accepted, reported as saved, and then quietly behaved as 90. Windows over 90 days now say so instead of pretending.

v0.18.454Fix: /altcheck on Xbox servers, and recycled achievement and quest IDs

• /altcheck and its dashboard page failed outright on Xbox-hosted servers, because the alt scan looked for your logs in the PlayStation folder. It now follows your actual platform. If the log folder cannot be read for any reason, the scan now falls back to what it can pull from Nitrado instead of giving up entirely.
• Deleting a custom achievement and then creating a new one could hand the new one the deleted one's ID. Everyone who had earned the old achievement instantly counted as having earned the new one, which also meant they could never actually earn it, and any role reward attached to the old one silently followed. Quests had the same problem with quest progress. IDs are no longer recycled.

v0.18.453Fix: two log-reading bugs that could replay old events as if they just happened

• If the bot could not read your server logs at all (a Nitrado outage, a rate limit), it wrongly treated that as "there is nothing left to read." When the outage ended, everything that happened during it was announced at once as though it were live: kill pings, join and leave spam, and map blips for sessions that were already over. A failed read is now treated as what it is, no information, so that backlog gets absorbed quietly and only genuinely new events are announced.
• When a log file is replaced or truncated by the game server mid-session, the bot restarts reading it from the beginning. Its duplicate-event guard was not actually catching those re-read lines, so kills and deaths could be counted twice, and bounties, achievements, quests and Cash rewards could fire twice off the same event. The guard now recognises a repeated line properly.

v0.18.452Fix: /pay now suggests who you are paying instead of making you type it

• /pay had no suggestions at all, so paying someone meant typing their exact gamertag from memory. It now suggests as you type, on the one command that actually moves money.
• You can search by their Discord name as well as their gamertag. Suggestions show as "Gamertag (@discordname)" where the player has linked their account, so you can find someone whichever name you know them by.
• It suggests players who are online, players seen recently, and anyone holding Cash on that server even if they have not played in a while, since that is often exactly who you are paying.
• The "your own gamertag" box only ever offers gamertags you have actually linked.

v0.18.451New: web application forms, filled in on the website

• New Applications page on the dashboard. Build a form with as many questions as you like, mixing open-ended answers (with your own character limit on each) and multiple choice. Mark any question required or optional.
• Set a ticket panel to "Web application" and point it at your form. A player clicking that panel now gets a private link to fill it in on the site instead of a Discord pop-up, so you are no longer stuck with Discord's five-question limit or text-only answers. Links are personal to the player, last 24 hours, and work once.
• Every submission appears on the Applications page with a link you can copy straight to your moderator team. That link is read-only and needs no dashboard login, so moderators can read an application without being given access to your settings.
• Deleting a form keeps the applications people already sent, and the links you shared for them keep working.

v0.18.450Fixes: late-night restarts drifting, short kicks lifting long bans

• Scheduled restarts set for 21:00 or later fired twice on the first night, then permanently drifted to just after midnight instead of the time you set. A 23:00 restart was actually restarting your server around midnight, every day. Rotations and scheduled embeds had the same fault. Fixed, and a restart missed because the bot was briefly offline is still caught up exactly as before.
• Five systems can ban a player (timed role-punish, kick, zone auto-ban, base-ping auto-ban and /ban) and they all share one ban list on your server. None of them checked the others, so whichever ban ran out FIRST unbanned the player for all of them: a 7-day ban followed by a 6-minute kick left the player free after six minutes, with nothing logged and Discord still showing them as banned. A ban is now only lifted once no other system still needs it, and the log records which one is holding it.
• Security: a malformed login cookie or form token returned a server error and logged a stack trace instead of being cleanly rejected. Both are now rejected properly.

v0.18.449Website and Discord edits can no longer overwrite each other

• Follow-up to the balance fix: the same overwrite could hit anything edited from both the website and Discord. Channel routing, keywords, achievement roles and level roles now merge entry by entry, so an admin editing on the website and a mod editing in Discord no longer wipe out each other work.
• Deleting an entry still deletes it ; the merge never brings back something you removed.

v0.18.448Custom achievements now explain what you can actually track

• The custom-achievement page used to show a plain list of options with no explanation. It now opens with a What You Can Track table listing every stat, the unit it is measured in, exactly what counts toward it, and an example number to start from.
• The picker itself is grouped too, so it is obvious which stats come from your DayZ server and which are Discord mini-game stats shared across every server you run. Units show in the dropdown and in your saved achievements, so a condition reads "Distance Travelled >= 100 km" instead of a bare number.
• Trackable today: kills, deaths, longest kill distance, playtime, longest life survived, distance travelled, plus bench max and range rank from the Discord mini-games.

v0.18.447Fixes: dashboard balance edits reverting, allowlisted links punished

• Reported: a balance adjusted on the website did not reach the player in Discord. The dashboard and the bot that serves your server are separate programs sharing one set of files, and each was saving the WHOLE player-money table at once, so whichever saved last wiped out the other. Balances, player stats, quest progress and gamertag links now merge player by player, so an admin edit and normal gameplay can no longer overwrite each other.
• Also reported: a player with money in the bank saw $0.00 on /me balance, then /withdraw appeared to create money from nothing. Nothing was ever duplicated ; the balance display simply only showed cash in hand. It now shows on hand, banked and a total whenever you have money banked.
• Auto-mod: a link on your allowed-domains list was still being punished if it ended a sentence, sat in brackets or quotes, or used Discord's <link> no-preview format. With the action set to timeout or ban that meant real punishments for links you explicitly permitted. Fixed, and links you have NOT allowed are still caught exactly as before.
• New: achievements can now use distance travelled. Three are built in (25km, 100km, 250km) and you can build your own at any distance from the custom-achievement menu.
• The /loadout command has been removed.
• /baseping list, /links list and /keyword list could break permanently once you had enough entries, leaving you unable to list them to fix it. All three are now capped.

v0.18.445Fix: deleting a ticket panel could leave its button behind silently

• Deleting a ticket panel tries to remove its message from Discord too, but if that failed the error was thrown away and you were still told the panel was deleted. The button stayed in the channel, so members kept clicking a panel that no longer existed.
• You are now told clearly when the message could not be removed, which channel it is still sitting in, and why, so you can delete it yourself. A message that was already gone still counts as a clean delete.

v0.18.444Fix: icons showing as raw text on panels made from the dashboard

• Anything the dashboard posted to Discord for a .bOne server showed its icons as raw text, like ":bb_list:" instead of the icon itself. Ticket panels, reaction-role panels and built embeds were all affected. They now render properly.
• The cause: the dashboard sends those messages over a second connection that was set up years ago as read-only, and never got the icon handling the main bot has. A comment in the code still described it as never sending messages, which is how it stayed hidden.

v0.18.443Fix: brand-new ticket panels not working, plus a keyword master switch

• A ticket panel created on the dashboard did not work when clicked, reporting that the panel no longer existed. The dashboard and the bot that answers your buttons are separate programs sharing one set of files, and the bot had not picked the new panel up yet. It now re-checks before giving up, so a panel works the moment it is made. This was the real cause behind panels offering the wrong categories.
• New: /keyword disable-all turns every keyword off in one command, and /keyword enable-all turns them back on. There is a matching switch on the dashboard's Keywords page.
• Turning them all off keeps every keyword configured, so switching back on restores exactly what you had, including any you had disabled one at a time. /keyword list now says clearly when the master switch is off, so keywords can never look healthy while nothing is firing.

v0.18.441BenchBot retired: .bOne is the bot from here on

• BenchBot is retired. Its Discord side is switched off: no commands for anyone but the developer, no DayZ feeds, no auto-mod, keywords, welcome messages, auto-roles or reaction roles. Anyone who runs one of its old commands is told it has been retired and pointed at .bOne.
• Its old commands stay listed on purpose rather than being deleted, so a player running one gets an explanation instead of a command that silently vanished.
• Nothing about the website changes. Login, sessions, the dashboard and every page it serves keep running from the same place, for every server, on both bots. The dashboard also keeps its live link to Discord, so servers, channels and roles all still resolve normally.

v0.18.440Fix: ticket panel buttons opening the wrong panel

• Found on a live server: a ticket panel message titled "Donation tickets" was actually opening a different panel entirely. Deleting a panel freed up its internal number, the next panel created reused that number, and the old button, still sitting in Discord, then pointed at the new panel. Panel numbers are never reused now, so a button always opens the panel it was posted for.
• A button whose panel really was deleted now says so instead of falling back to offering every category on the server. That fallback was the other half of the "it offers all categories" problem.
• The original all-purpose ticket panel is unchanged and still offers every category, as it always has.

v0.18.439New: rename a ticket category without breaking your panels

• You can now rename a ticket category from the dashboard's Ticket Categories page. Until now there was no rename at all, so the only way to change a name was to remove the category and add it back, which quietly disconnected it from every panel and every ticket already opened under it. That was the cause of the panel problem fixed in the last update.
• A rename carries everything with it: every panel using that category, and every existing ticket opened under it, all follow the new name. The confirmation tells you exactly how many of each were updated.
• Changing only the capitalisation of a name is allowed. Renaming to a name another category already uses is rejected, and nothing changes when it is.

v0.18.438Fix: ticket panels offering every category instead of their own

• Reported: picking a category on a ticket panel offered every category on the server instead of the ones that panel was set up with. The cause was renaming or removing a category: the panel kept pointing at the old name, found nothing, and quietly fell back to showing all of them, including the ones you had deliberately left out.
• Removing a ticket category now also removes it from every panel that used it, and tells you by name if that leaves a panel with no categories left, so it can never drift out of sync again.
• A panel that still cannot find its categories now says so plainly and asks for an admin, instead of silently offering the wrong menu. Panels where only the capitalisation of a category changed keep working as before.

v0.18.437Fix: go-live alerts could be lost for a whole stream

• A real bug in both Twitch and TikTok go-live alerts: if the lookup that fetches a creator's profile picture failed even once, the bot still recorded the stream as "already announced" and never posted anything. The alert was then skipped for that entire stream, silently, with no retry. It now waits until the alert has actually been sent before marking it announced, so a failed lookup just tries again on the next check.
• Online-count: a voice channel that has been deleted no longer logs a warning every single cycle. It reports once and then stays quiet until it is fixed, so real problems are not buried underneath it.
• Punishment History on the dashboard showed gamertags wrapped in stray backtick characters. They now render the same way as everywhere else on that page.

v0.18.436Fix: TikTok live checks no longer retry a dead creator forever

• Found in the logs: two linked TikTok creators had failed every single live check for six days straight, 5951 failures with no successes, because neither account has a live room the lookup can resolve. Nothing was broken on your side and no alert was ever missed, but the bot kept asking every three minutes anyway.
• A creator who keeps failing is now backed off progressively instead of being re-checked every cycle, which stops the bot hammering TikTok and stops those failures burying everything else in the log. The moment a check succeeds the creator goes straight back to normal checking, so nothing is lost.
• Separately: a partner Discord invite that has expired is no longer re-looked-up on every single visit to the partners pages. Live member counts still show their last known values instead of going blank.

v0.18.435The TWD DayZ page is now pure dark behind the ember storm

• The site background is gone on /partners/twd. No green circuit grid, no constellation field, no code rain, no ambient glow: just a flat dark room with the ember storm burning in it. The storm itself is unchanged.
• The content panels were being washed in the green-black the rest of the site uses. They are now toned to this page's own neutral ash, so the dark reads as dark rather than faintly green.

v0.18.434Rebuilt: the TWD DayZ page animation, plus their real emblem

• The fire on /partners/twd has been replaced with something completely different. Instead of a band of flame along the bottom edge, the whole page now sits inside a drifting ember storm: hundreds of embers rising through three depth layers at different sizes and speeds, ash falling the other way, and a furnace glow breathing low on the screen. It carries the full height of the page rather than stopping under the hero.
• The opening is new too. The page starts blacked out, the emblem ignites and lights the storm, then the wordmark scorches in left to right. As before, anyone who has asked their device for reduced motion skips straight to the finished page.
• TWD DayZ's real emblem is now on the page and on the partners list, replacing the placeholder it launched with.

v0.18.433New: TWD DayZ partner page, with its own fire

• TWD DayZ joins the official partners at /partners/twd: 18 faction bases, heavy PvP, raid weekends, custom POIs, and regular giveaways and events.
• The page has its own identity, same as every other partner page here. The background is a real fire simulation burning along the bottom of the screen with embers rising off it, and the page opens by igniting: a spark, a shockwave, then the wordmark burning in one letter at a time. All of it is skipped for anyone who has asked their device for reduced motion.
• Listed on /partners alongside the existing partners.

v0.18.432Fix: /shop and /spin links opened from the .bOne bot wrongly said "expired"

• Reported live: a Corna Store link clicked seconds after running /shop showed "This shop link has expired (links last 2 hours)". The link was never expired -- .bOne and Benches Bot are separate processes sharing one data folder, but only one of them serves the web dashboard. A link minted by the bot that does NOT serve the dashboard was invisible to the one that does, and a link it cannot find is reported as "expired" rather than "not found".
• Links are now looked up in the shared storage when they are not already in memory, so it no longer matters which of the two bots you ran the command on.
• Fixed a second, related problem in the same area: saving a new link used to overwrite the shared file with only one bot's own list, silently wiping every link the other bot had handed out. Both bots' links now survive.
• /spin (Spin the Wheel) had exactly the same bug and is fixed the same way.

v0.18.431Container damage is now its own /containerdamage command, plus 10 bugs from a fresh full-codebase re-audit

• Container damage is no longer buried under /basedamage as "/basedamage containerdamage ..." (which read as "base damage container damage" for a command that only ever touches one of the two). It is now its own top-level /containerdamage command with the same controls, and each command's status now reports only its own flag. The timezone is still shared and settable from either.
• A scheduled recurring embed with 2 posting times less than 3 hours apart could re-post itself every poll cycle for up to ~2 hours, every day it ran. Same bug already fixed for rotation and restart schedules; it had never been carried over here.
• /slut told you that you lost the full rolled amount even when your balance was lower than that, including every brand-new player (balance 0) -- the balance was always correct, the message was not.
• /altcheck silently dropped every account pair belonging to its 4th-and-lower ranked cluster: not listed as a cluster, not listed individually, just missing from the results entirely.
• Fixed a creator-alerts crash that could still abort the whole sweep (skipping every other server's alerts that cycle) if someone unlinked and re-linked Twitch mid-sweep, and a case where global /bench, /range, /beer and /expedition progress could be reverted by the other bot process.
• Editing a horde's zombie count now also updates the 2 event fields added yesterday, instead of leaving them at the original count's values.
• Smaller fixes: a keyword deleted while a message was being answered no longer silently skips the message's remaining keywords; a player profile opened with a stray leading space no longer reports a linked player as unlinked; the Behavior Detection page now escapes stored values; and the data-integrity check now covers prize-wheel segment IDs.

v0.18.430"Test all ++" re-audit (round 2, FTP-write/data-migration lenses): 5 bugs -- 2 CRLF-injection gaps, a malformed rotation path, and a horde event missing required fields

• /whitelist add (Discord and dashboard) and /rolepunish start's explicit-gamertag option could silently drop a gamertag containing an embedded line break from the actual Nitrado write, while still reporting success -- closed the same way this project's other admin commands already guard against it.
• A rotation pool file path pasted with a leading "../" (or a Windows-style "..\") could get written into the live server config as a malformed, doubled path; a legitimate file name starting with a literal "." could get silently corrupted the same way.
• Custom Hordes created via /createevent were missing 2 fields every real vanilla DayZ event has, which could make a horde silently fail to spawn on the live server despite the command reporting success.
• Added direct test coverage for the shared protected-admin check every moderation command in this bot relies on (previously only its most common branch was actually tested).

v0.18.429"Test all ++" re-audit (round 1): 6 bugs -- cross-process progress loss, a permission-recheck gap, an automod false-positive, a fail-open protection gap, 3 creator-alert crashes, and a broken uptime monitor

• Bench/Beer/Range/Salvage progress could be silently reverted to a stale value on a process's very first save after a restart, if the OTHER bot process (bone/dotbone) saved a change for the same player in between -- now protected from the very first save, not just the second and later ones.
• An already-open /radio create|edit session could still save after the caller's permission for it was revoked mid-session; now rechecked at save time too.
• Automod's link-allowlist could wrongly flag (and punish) an admin-permitted domain if it was posted with no path, just a query string or fragment (e.g. a plain shared YouTube link) -- a completely ordinary way to share a link.
• A protected admin/developer could lose their automod protection entirely if Discord briefly failed to look them up as a member at the exact moment they tripped a rule, instead of staying protected.
• All 3 creator-alert sweeps (Twitch go-live, TikTok go-live, TikTok new-post) could crash outright -- silently skipping every other guild's alert that cycle -- if a member unlinked their Twitch/TikTok mid-sweep; now that one creator is skipped cleanly instead.
• /server-monitor set accepted an invalid port number (like 0) with no validation, which silently broke that server's uptime monitoring forever with no error, while /server-monitor status confusingly reported "not configured" right after "set" had just replied success.

v0.18.428Test 4 max-intensity audit (test-suite quality pass): 4 test fixes -- a gameable regression test, a tautological assertion, a test that didn't test what it claimed, and a test-order dependency

• Test-only changes, no production-code behavior changed. A performance-sweep regression test could pass even on code checking the wrong variable's status; a payment test's prototype-pollution assertion couldn't have failed either way; a checkout test claiming to prove server-side pricing never actually sent a spoofed price to prove it; and 2 ticket-panel tests only passed when run in a specific order. All 4 fixed and re-verified to fail against the old (pre-fix) behavior and pass against the current code.

v0.18.427Test 4 max-intensity audit (Pass D, consistency): a chat-injection gap in 3 more ADM event regexes, a dead-end achievement migration, and a shop checkout error-response fix

• The chat-message-fabricating-real-events bug fixed earlier this session for connect/kill/hit/flag/etc. also applied to 2 more: a player could fabricate a fake base-building/construction event via ordinary chat text, reaching the Cash reward for building, zone auto-ban, and the Raiding alert -- closed the same way as every other event type.
• A guild with an old custom achievement from before the in-game currencies were retired had it silently rewritten to a different, equally nonexistent condition on every load, permanently breaking it; it's now left alone instead.
• The public shop checkout page now reports "link expired"/"server not found" clearly instead of a generic "something went wrong," matching the fix already shipped for the prize wheel's equivalent page.
• A handful of stale dashboard descriptions and code comments (an outdated alert count, an outdated leveling description, a few others) were corrected; no behavior changes.

v0.18.426Test 4 max-intensity audit (Pass C, performance): 4 unbounded per-player state maps capped, 4 O(n^2) sweeps fixed, a public-route rate limit, and a dropped promise catch

• Fixed 4 spots where a per-player tracking map (PvP-hit cooldowns, kill rivalries, base-ping proximity state, alert-zone entry state) grew one entry forever for every distinct player ever seen, with no cap -- now capped with the oldest/least-significant entry evicted to make room, same as this project's existing per-player sample caps.
• Fixed 4 periodic moderation sweeps (temp-bans, zone-bans, base-ping bans, /ban duration expiry) that re-scanned a server's ENTIRE historical ban record every ~30s forever, instead of just the still-active ones -- pure performance, no change in what actually gets unbanned or when.
• The public, no-login player-profile page (shared via /myprofile links) now has the same rate limit already applied to the Event Map and Zone Draw pages, since it can trigger the same kind of expensive cross-server lookup.
• Closed one small gap where a failed dropdown-menu update in a couple of embed pickers (leaderboard categories, etc.) went uncaught instead of failing cleanly.

v0.18.425Test 4 max-intensity audit (Pass B, security): weak randomness on the prize-wheel cash payout, and 2 prototype-pollution gaps

• The prize wheel's winning-segment draw (which can award real Cash) was using a fast, non-cryptographic random-number source instead of a cryptographically secure one; switched to a secure source, with no change to the wheel's odds or feel.
• Closed 2 more prototype-pollution guard gaps (same class already fixed in several other places): a saved keyword/gamertag-link record named exactly "__proto__" could corrupt an in-memory object during a backup restore, and a PvP-hit victim named "__proto__"/"constructor"/"prototype" could silently block that hit's Cash reward.

v0.18.424Test 4 max-intensity audit (Pass A, correctness): 2 broken dev scripts, an automod allowlist port bypass, an embed-builder button-id reuse gap, and a silent ticket-panel repost failure

• Two dev-only emoji-upload scripts had a stale import path left over from the .bOne rebrand and would crash immediately on any invocation; a third, now-superseded one-time data-export script (from the already-completed second-economy retirement) was removed.
• /automod external-link protection could still flag an admin-allowlisted domain if the link included an explicit port (e.g. a self-hosted panel on :8080) -- the port was captured as part of the host and never stripped before the allowlist comparison.
• A saved custom embed created via the Discord /embed create wizard (not the dashboard) was missing its button-id counter, which could let a later dashboard edit reissue a button id still in use by that same embed's own live, already-posted buttons.
• The dashboard's ticket Quick Setup silently reported success without ever reposting the panel when reusing an already-existing auto-named panel channel whose panel message had been deleted -- it now checks for a live panel first and reposts if one's missing, without spamming a duplicate into an already-working channel.

v0.18.423Test 2 deep audit: fixed a false-positive Fire Rate alert, a stale-display bug in 9 dashboard routes, and 6 smaller correctness gaps

• Fire Rate alerts (a suspicion-detection feature) could false-positive on completely ordinary multi-target combat: hits/kills landing in the same ~30s poll cycle were misread as happening 0 seconds apart, regardless of their real in-game timing.
• 9 dashboard pages (Punishments' 6 release/unban/refresh routes, Teleporter create/remove, Base Damage Apply Now) could briefly show stale data on the very same response after a real action succeeded, if another save landed for the same guild during the request -- always self-corrected on the next page load, never lost data.
• Fixed a false-positive teleporter-name rejection (a plain teleporter could be wrongly blocked by an unrelated marker-object file path it would never actually use), a public shop-page robustness bug (a crafted deep-link value could silently break the page's cart-restore script), a small log-analysis gap on a fresh/small bot.log, and a stale, self-contradicting warning message on /whitelist enable|disable.

v0.18.422Fix: Fire Rate / Headshots / Teleport-Speedhack alerts were landing in the position feed channel instead of the suspicion-alerts channel

• These 3 alert types (all enabled by default) were never included in /setup auto-channels' suspicion-alerts routing, so they silently fell back to the server's default channel -- which auto-channels itself points at the Position feed by default. On a busy PvP/Deathmatch server this flooded the position channel with alert spam and made it look like position updates had stopped entirely.
• Re-run /setup auto-channels (or route them manually via /channel set) to move these 3 alert types into your existing suspicion-alerts channel -- this fix updates the code path, not already-saved per-server channel routing.

v0.18.421Test 4 max-intensity audit (batch 7): test-suite quality pass round 3 -- a real concurrency test for the giveaway reroll/sweep race, plus 2 more coverage gaps closed

• Added a genuine concurrency test proving /giveaway reroll can never announce a 2nd winner set while the automatic sweep is still finalizing the same giveaway (previously only the static precondition was tested).
• Closed 2 more previously-untested but already-correct code paths: /teleport remove's live FTP file deletion + cfggameplay.json deregistration, and /bounty cancel's ownership/mod-permission gate and refund.

v0.18.420Test 4 max-intensity audit (batch 6): test-suite quality pass round 2 -- closed coverage gaps on already-correct code

• Verified and locked in test coverage for several previously-untested but already-correct code paths: base-damage schedule field mapping (base vs. container never swapped), 7 dashboard Faction admin routes (leadership/bank), the shared Nitrado ban-list lock across all 6 real writers (was only proven for 3), quick-ban/quick-kick's protected-admin reverse-lookup, and every individual dangerous-role permission (was only sample-tested).
• Tightened a weak test assertion in the ticket-creation permission-overwrite check that would have passed even if the category role were missing ViewChannel entirely.

v0.18.419Test 4 max-intensity audit (batch 5): test-suite quality pass -- closed a real gamertag-link prototype-corruption gap and 4 chat-spoofable ADM event types the earlier chat-spoofing fix missed

• The Link Admin dashboard page now rejects a reserved Discord user ID (__proto__/constructor/prototype) instead of silently corrupting that guild's linked-accounts data.
• Closed 4 more ways a player could fabricate a fake in-game event (flag raise, buried stash, teleport, emote) just by typing the right phrase in ordinary chat -- the same class of bug fixed for connect/disconnect/kill/hit/death/knockout earlier this session, missed on these 4 the first time around.
• Ran a dedicated test-suite quality audit (6 agents covering economy, auth/security, moderation, DayZ-server-affecting features, the event-processing pipeline, and tickets/giveaways/factions/quests) looking for weak assertions and coverage gaps rather than new source bugs; real findings from that pass are being triaged and fixed in the batches that follow.

v0.18.418Test 4 max-intensity audit (batch 4): consistency/dead-code pass -- a reachable Discord crash, a zone-deletion data-loss bug, Discord-vs-dashboard drift across 6 commands/routes, and dead code cleanup

• Fixed a reachable crash: clicking a custom saved-embed panel's Balance/Store/My Stats/Leaderboard button in a guild with 0 DayZ servers configured used to throw with zero reply; now shows a clean "ask an admin to run /setup server-add" message, matching Player Hub's own fixed panel.
• /store admin zone-remove used to delete an entire multi-purpose zone (cash + autoban-kill/build) just to turn off its Cash reward; it now only clears the Cash purpose, leaving autoban protection intact.
• /store admin zone-add now merges onto an existing same-name/same-spot zone (matching the dashboard's already-fixed behavior) instead of silently creating a confusing duplicate-named record.
• The dashboard's Cash give/take/set forms now reject reserved gamertags (__proto__, constructor, prototype) instead of showing a false "success" banner while nothing was actually written, matching the Discord commands.
• /warn issue, /keyword add, /automod words|links add now match their dashboard equivalents' protections/limits: guild-wide protected-gamertag exemption, and Discord's own 2000/100-char field caps enforced up front.
• Dashboard rotation "Enable" now refuses to turn on with no FTP configured (was silently no-op-ing forever with no diagnostic trail); dashboard heatmap-auto now caps interval/sample days at the same 90/365-day limits as the Discord command.
• Removed dead code: an orphaned src/game/casino.js left behind by the earlier Casino/Grit retirement (already preserved in archive/), and its unused LUCKY_CASINO_BONUS constant.

v0.18.417Test 4 max-intensity audit (batch 3): resource/performance pass -- removed dead per-save SQLite work, moved two blocking disk writes off the event loop

• Removed a per-save loop that was mirroring the old, fully-retired Dollars economy to SQLite on every single guild-data save (every DayZ event, every command) -- pure wasted synchronous database writes for data nothing reads anymore.
• Dashboard image uploads (Embed Builder) and file drops no longer block the whole bot process while writing to disk -- large uploads used to stall the Discord connection and every other guild's dashboard for the write's duration.

v0.18.416Test 4 max-intensity audit (batch 2): saved-embed id reuse, teleporter filename collisions, ADM chat-spoofing, and several smaller hardening fixes

• Fixed saved-embed records reusing a deleted record's id, which could let a stale, still-live button silently resolve to the wrong (unrelated) saved embed.
• Fixed /teleport create allowing a new teleporter's name to collide with an existing one's underlying files (e.g. "Base" and "Base-return"), silently corrupting the older one.
• Fixed several ADM event types (kill, hit, connect, disconnect, death, knockout) that could be fabricated purely from a player's own chat text, not anything that actually happened in-game.
• Fixed the dashboard's temp-ban/kick/warning/rotation actions occasionally rendering a stale result on multi-server guilds right after a successful action (the action itself was always safe; only the immediate display could lag).
• Fixed /keyword add on the dashboard silently no-op'ing on invalid input (no length cap, no failure banner) instead of clearly rejecting it.
• A few smaller hardening fixes: capped unbounded automod word/link entries, fixed a UTF-8 byte-boundary truncation edge case in /logs downloads, a welcome-card font-sizing off-by-one, and closed a gap in the IPv6 private-address check.

v0.18.415Test 4 max-intensity audit (batch 1): reflected XSS, a reaction-role privilege escalation, false-positive zone autobans, and a stale-server Cash bug

• Fixed a real, exploitable reflected XSS on the public /shop page: the deep-link query value was embedded into a <script> tag via raw JSON.stringify instead of the site's safe-for-script escaping helper.
• Fixed a privilege-escalation gap in reaction-roles: a role mapped as safe could later become dangerous (picked as the bot-admin role, or given Administrator) with zero re-check at the actual grant point, letting any member self-grant it by reacting.
• Closed a race window where two near-simultaneous /reactionrole addrole submissions for the same emoji could both land, silently stranding the second admin's role grant.
• Fixed Zone Autoban-Build firing on dismantling/folding/packing an existing structure, not just actual construction -- a player removing a structure inside the zone was getting auto-banned for "building."
• Fixed a stale-reference bug where the dashboard's Store cash-take/cash-set could silently drop a Cash deduction or balance override on a multi-server guild when another save landed at the same moment.

v0.18.414Fix: /createevent's "remove after restart" auto-cleanup now actually fires

• Real bug: the scheduled check that decides whether any temporary event is due for automatic removal after a restart was silently broken by a classic JavaScript gotcha (Array.prototype.some() always calls its callback with the array index as a second argument, which was overriding the due-check's own "right now" default). The removal logic itself was always correct -- confirmed live, a real server had 8 genuinely-overdue temporary events (one over a day past due) that cleaned up instantly and correctly the moment this was called directly -- the automatic trigger just never fired, for any guild, ever. Existing overdue events across every affected server will clear automatically on their next poll cycle now that this is fixed ; nothing further needed from admins.

v0.18.413Fix: Construction/Placement/Territory Flag/Stash (and any other) feed can now be diagnosed when it goes silently dark

• Root cause of a real, repeated "these feeds are not working" report: when a feed's configured channel gets deleted, the bot correctly self-heals the stale routing (clearing it so the dashboard shows "Not set") -- but once that also clears the server's shared default channel, every further real event of that type was being silently dropped, forever, with ZERO signal anywhere: not bot.log, not the dashboard. Confirmed live: one real server had 16 genuine placement events and 32 genuine construction events vanish this way in a single poll cycle. Now logs a clear warning naming the event type and how many real events were just dropped, so this is actually discoverable again -- loot and the two admin-diagnostic feeds stay silent as before, since not having opted into those yet is normal, not a regression.

v0.18.412Fix: dashboard "Send Now" embeds never pinged, plus 2 smaller Spin the Wheel gaps

• The dashboard Embed Builder's own "Send Now" button was never wired into last version's @-mention fix at all -- an embed with a real user mention pinged correctly when sent from Discord, but never when sent from the dashboard. Both surfaces now behave identically (and the fix's own safety scoping -- no roles, no @everyone/@here -- applies here too).
• Spin the Wheel: the dashboard's spin-cooldown field accepted fractional minutes (e.g. "2.5") despite its own error message claiming whole numbers only, and despite Discord's own /wheel config (an integer-only option) never being able to produce one. Now actually rejects it.
• Spin the Wheel: the dashboard's segment table never showed a segment's numeric ID as visible text, even though that ID is required to use /wheel edit|remove on the Discord side. Added an ID column.

v0.18.411Security fix: embed mentions could no longer be used to mass-ping a server

• A real gap in last version's embed @-mention fix: forwarding role mentions (<@&roleId>) meant a moderator holding only the narrow "design and send embeds" permission could type a role's id -- including the @everyone role's id, which always equals the guild's own id -- into an embed and mass-ping the entire server, something they could never do under their own Discord permissions. Only individual user mentions are ever forwarded now, with allowedMentions explicitly locked to users-only as a second layer.
• Spin the Wheel: the public page's POST /commit action sent an HTML error page on an expired/invalid link, but the page's own JS always expects JSON back -- the real reason ("link expired") was getting swallowed by a generic "something went wrong" message. Now returns real JSON.
• Spin the Wheel: if an admin edited the wheel in the several minutes between a player loading the spin page and clicking Spin, the animation could land on the wrong (stale) segment while the text result still showed the real one. Now shows the real result directly instead of animating to a guess.
• Spin the Wheel: the dashboard's Weight/Cash Prize fields had no character limit, unlike the matching Discord modal.

v0.18.410Debug pass: Spin the Wheel + last version's mention fix

• Spin the Wheel: the public spin page drew every slice the same size no matter its configured Weight, so a rare 1-in-100 segment looked exactly as likely as a common one -- the actual spin was always correctly weighted server-side, only the picture was wrong. Slices (and the landing animation) now size and land proportionally to weight.
• Spin the Wheel: /wheel add (Discord) never enforced the same 25-segment cap the dashboard's Add Segment form already did, so the two management surfaces could drift out of sync. Both now share one exported limit.
• Last version's embed @-mention fix was scoped back: it originally also promoted the literal text "@everyone"/"@here" into a real ping, which could have mass-pinged a whole server the next time an existing saved embed that happened to contain that phrase as plain prose got sent. Only real <@user>/<@&role> mention tokens (which can only get into the text via Discord's own mention-autocomplete, never plain typing) are forwarded now.

v0.18.409Fix: @-mentions inside a custom embed now actually ping

• Real user report: mentioning someone in a custom embed's text (title/description/a field/author/footer) never notified them, even though it showed up as a real clickable mention. Discord only scans a message's own content for pings, never embed data -- every custom-embed send (the wizard's Send Now, /embed send, the scheduled sweep) now also carries any mention found in the embed text as real message content, so the ping actually fires.

v0.18.408New: Spin the Wheel -- an admin-configured prize wheel players spin via /spin

• /spin gives a player a personal link to a public page with a real spinning prize wheel (built server-side, never a client-side "random" pick -- the same discipline every other real-money action in this bot already follows). Admins configure segments (label, color, relative odds, an optional Cash prize per segment -- some can be pure flavor, others real payouts) and a spin cooldown from either Discord (/wheel add|edit|remove|list|config, a small popup per segment) or the new Spin the Wheel dashboard page. A minted link only ever consumes the cooldown once actually spun, so grabbing a link and not using it right away never wastes it.

v0.18.407Fix: /radio use can actually say something now, plus a signal waveform

• Real gap in last version's first release: /radio use had no way to type an actual message, it could only ever re-post a channel's static styling over and over. Added a required message option, shown as its own field on the broadcast. Also added a decorative Signal field (a random block-character waveform, re-rolled on every broadcast) for a bit of "live transmission" flavor.

v0.18.406New: Roleplay Radio System -- named, role-gated in-character radio channels

• Admins define named radio channels (e.g. Police, Bandit, EMS) via /radio create|edit (a guided popup wizard, same mechanics as /embed create) or the new Radio Channels dashboard page: title/description/color/image/thumbnail/footer, two radio-specific fields (Frequency, Wavelength), and a single gating role. /radio use channel:<> posts that channel's embed publicly in the current channel (a real broadcast, not ephemeral) to anyone holding its role ; everyone else gets a private denial.

v0.18.405Fix: /shop and /buy links no longer break on a bot restart

• A shop cart link was only ever kept in memory, so any bot restart (a deploy, a crash recovery) silently invalidated every outstanding link well before its real 2-hour expiry, showing "Link Not Available" with no real explanation. Now persisted to disk, same durability Burn Notes and File Drop links already had -- a link now genuinely lasts its full 2 hours regardless of how many updates ship in the meantime.

v0.18.404Store: bulk-select items to edit or remove several at once

• Reworked feedback on last version's price editor ("too crowded"): the Store Items table now has a checkbox per row (plus a "select all visible" header checkbox) feeding one small shared toolbar below the table -- select one or many items, optionally fill in a new price and/or category, Apply. A blank field means "don't change that field," same convention the Add/Update Item form already uses. Remove Selected works the same way for deleting several items at once, with a confirmation prompt naming exactly how many are about to go.

v0.18.403Store & Item Catalog: removed the per-item inline price editor, and Item Catalog pictures now actually finish loading

• The Store page's inline "Edit Price" button/form (added last version) is gone -- re-submitting the Add/Update Item form with the same item name already changes its price cleanly, and the separate inline editor was redundant.
• Item Catalog pictures were mostly showing the fallback icon because the only thing that ever fetched them was a page view itself -- a fresh admin browsing 250+ never-before-seen tiles at once kept re-tripping dayz.wiki.gg's rate limit before the cache could make real headway (confirmed live: only 75 of ~1,400 catalog images had ever actually cached after a full week). A new background sweep now keeps warming the cache a little at a time, independent of anyone viewing the page, using the exact same rate-limit-safe queue/circuit-breaker a live page view already used -- so it can never hit the wiki any harder than before, it just keeps making progress the rest of the time too.

v0.18.402Retired the global watchlist; /ban add can now take an optional duration

• /banlist (the bot-wide, Discord-only player reputation watchlist -- add/dispute/export, its own dashboard page, a dev review queue) is gone entirely. It never touched Nitrado or actually banned anyone from a DayZ server, and was being confused for the real ban tools. /ban (the direct Nitrado ban list) and /rolepunish (Discord role-swap + Nitrado ban) are unaffected and still exactly what they were.
• /ban add gained an optional duration option (30m/2h/1d/1w) for an auto-expiring temporary ban, checked every 30s and reversed automatically once it ends -- same mechanism /zone's auto-ban already uses. Leave it blank for the exact same permanent-ban behavior as before. /ban remove clears a matching temp-ban record early; /ban list shows a countdown next to any temporary entries.

v0.18.401Fix: /setup auto-channels no longer creates a Casino or Economy Shop channel

• Both belonged to the old "second economy" (Dollars/Chips/Grit/Salvage), fully retired in v0.18.376 -- there's no /casino command anymore, and /shop is a web cart/checkout link now (v0.18.397), not a channel-routed feature. The auto-channels list was never updated when those were removed, so it kept creating two dead channels under .bOne Games on every fresh setup.

v0.18.400Maximum-intensity feeds/event-creation audit: 27 real bugs found and fixed across parsers, security, and data integrity

• Security: gamertags and chat messages are attacker-controlled text ; a backtick in a name could break out of its code-span wrap and render live Discord markdown (a masked-link phishing vector) in kill/chat/leaderboard/online-players/weekly-digest feeds. All player-controlled text is now safely escaped everywhere it's shown.
• Security: /channel create now makes admin-only types (Stash, Mission Config Broken, the Behavior Detection Alerts, ...) actually private, matching /setup auto-channels -- it was creating them fully public.
• Fixed 3 parser bugs: a melee/unarmed hit or kill's Weapon field could swallow trailing damage text ("ZmbFists for 10 damage" instead of "ZmbFists") ; a non-lethal hit on an already-dead, nameless corpse was silently dropped entirely ; base-building events showed the tool used (e.g. "Hatchet") mislabeled as the object's own classname.
• Fixed a horde-cleanup bug where two scheduled removals pointing at different mission files could silently run against the wrong file's content, permanently losing the still-live one's cleanup while reporting success.
• Fixed several behavior-detection false positives/negatives: Teleport/Speedhack could misread a normal ~18 km/h sprint as ~360 km/h when both readings landed in the same poll cycle ; Boost could keep re-alerting on a days-old placement burst forever ; six /detect thresholds could be set higher than their internal buffer, silently and permanently disabling that detector while still showing "ON".
• Fixed the auto-updating Leaderboard channel re-posting via a real Discord API call every single poll cycle forever, even with no ranking change, because its "skip if unchanged" check accidentally hashed a value that's never the same twice.
• Fixed several smaller consistency/resource issues: /channel list was missing 2 alert types and showed "Not set" for two types that actually have a working default-channel fallback ; a handful of unbounded per-player/per-service tracking maps now bounded like their siblings already were ; a couple of stale-object-reference and permission-recheck gaps in /createevent closed.

v0.18.399Fix: stale "online" state after a bot restart ; feeds silently dropped after their channel is deleted now show up in diagnostics

• Root-caused a live report of Construction/Stash/Flag/Placement feeds "not working": the parser and event pipeline were never broken (confirmed against real production data -- these events were being generated the whole time). The real gap: once a routed channel gets deleted (an admin decluttering a busy feed, a reorganization, ...), the bot correctly notices and clears the dead route, but nothing ever told the admin it happened, so the feed just silently stopped forever. npm run diagnostics / the dashboard's Diagnostics page now flags exactly this ; a plain-language explanation and the one-line /channel create fix to resolve it.
• Fixed: "Players online feed displays incorrect information" (the dashboard's live guild-hub panel) -- a player still marked online in the cross-process database when the BOT ITSELF restarted (a routine deploy, not a DayZ server restart) could stay stuck "online" for days, since the existing DayZ-server-restart cleanup only ever clears players it still has in its own memory, and a fresh process starts with none. Now reconciled the moment each server's post-restart backlog catch-up finishes.

v0.18.398Fix: a channel field now accepts a pasted #mention or "Copy Link" URL, not just search

• Discord caps autocomplete at 25 suggestions per field, a hard limit no amount of search improvement can lift ; a large guild's wanted channel could still never surface if too many others matched whatever was typed. Every channel option bot-wide (/channel set, /setup channel, /income channel, /giveaway, /embed, /keyword, /banlist, /ticket, /player-hub, /creator admin channel, /server-monitor channel, and more) now also accepts a pasted channel reference directly instead: a #channel-name mention, or a "Copy Link" URL from right-clicking the channel. A bare channel ID already worked ; those two didn't.

v0.18.397Corna Store rework: a real web cart/checkout, and /mylocation replaces manual coordinates entirely

• /shop and /buy no longer browse or purchase in Discord at all ; both reply with a personal link to a new cart/checkout page on the website. Add as many items and kits as you want, adjust quantities, and check out everything at once for one combined total, instead of one /buy per item. /buy item:<>/kit:<> still works, it just pre-adds that one thing to your cart on the page instead of buying it directly.
• New /mylocation, replacing /setlocation and /checklocation: shows your last known in-game position (from the live ADM feed, the same one /player locations already reads) and saves it as your delivery spot with one tap ; no coordinates to type anywhere, ever. This is now the ONLY way to set where Corna Store purchases deliver ; checkout is blocked with a clear message until one is saved.
• The Player Hub panel's Store button now opens the same personal cart link too, instead of the old in-Discord category browser.

v0.18.396Fix: channel-picker searches were missing Announcement-type channels ; /rotation setup-ftp moved to /setup ftp

• Every command that searches your channels (/channel set, /setup channel/trap-channel/lootfeed-channel, /income channel, /giveaway, /embed, /keyword, /banlist, /dev, /ticket panel/quicksetup/panel-create/panel-edit, /player-hub, /creator admin channel, /server-monitor channel) only ever searched plain text channels ; any channel converted to Discord's Announcement type was invisible to the search no matter what was typed, not just filtered out by relevance. Widened to include Announcement channels everywhere (/reactionrole already did this in one place ; now every channel search does).
• /rotation setup-ftp is now /setup ftp, alongside its sibling /setup nitrado ; same private-form modal, same credentials. It never had anything to do with rotation specifically (/createevent, /teleport, and /eventspawns all use the same FTP credentials), and living under /setup also means it's consistently Administrator-gated like the rest of that command, instead of /rotation's own weaker delegable permission plus a special-cased admin re-check just for this one subcommand.

v0.18.395Fix: leftover "DZ-Income" branding cleaned up ; economy audit

• An audit confirmed the Cash economy's command surface itself was already fully simplified (/shop, /buy, /pay, /setlocation, /checklocation, /deposit, /withdraw, /daily, /weekly, /work, /beg, /crime, /income, /store admin -- no /dz-store, /dz-cash, or /dz-income left anywhere). What hadn't caught up: /income's own embeds and the dashboard still said "DZ-Income" in several places (the submission/rates embed titles, the Income dashboard page's heading/tab title, its Moderator Permissions label, and the guild hub tile) from before the Discord command itself was renamed /dz-income -> /income. All now say "Income" ; the stored mod-permission key and dashboard URL route are deliberately left as internal implementation details, unrenamed, so no guild's already-granted permission gets silently dropped.

v0.18.394New: /help player:true, a player-only command cheat sheet

• A single page listing every command a regular member can run themselves (link/balance, Cash shop/pay/income, the 4 free minigames + leaderboard, factions, bounties/achievements, DayZ reference, fun/misc) with none of the admin/mod-only stuff mixed in ; the regular /help still shows the full menu by default.

v0.18.393The 0.18.387 ticket-system changes are fully reverted

• /ticket panel, category-role-add, category-role-remove, and closerequest are all back exactly as they were before 0.18.387 ; the dashboard's "Post Panel Only" section is back too. The 0.18.387 update's panel-adopt addition and category-roles collapse are both gone with it (panel-adopt specifically had to go to fit back under Discord's hard 25-subcommand-per-command limit alongside category-role-add/-remove as two separate commands again).

v0.18.388Fix: dashboard guild-picker access-check noise

• A "test 3" full bot.log investigation found the guild picker (the dashboard homepage's "which servers can you see" list) was logging a WARN for every single guild a visiting admin doesn't personally administer, on every visit -- 500-900+ a day in production, purely from routine use, since nobody administers every server this bot happens to run. That check now logs at INFO, matching the same "expected, not an access denial" treatment a developer's own equivalent check already got (see the 0.18.332 entry below) ; a real, targeted access attempt on one specific server's dashboard URL still logs at WARN exactly as before.

v0.18.387Ticket system: retired /ticket panel, collapsed the category-role commands, renamed closerequest

• /ticket panel is gone ; panel-create (post an additional panel) and the new panel-adopt (bring an already-posted panel message, from Quick Setup or the old /ticket panel, under Ticket Panels management without reposting it) cover both of its old jobs. The original bare "Open a Ticket" button itself keeps working forever either way, adopted or not.
• /ticket category-role-add and category-role-remove are now one command, category-roles index:<> role:<@role> action:<add|remove>.
• /ticket closerequest is renamed to close-request, matching every other multi-word ticket subcommand's naming.
• Dashboard: Ticket Setup's old "Post Panel Only" section is replaced by a pointer to the Ticket Panels page, which now has its own Adopt an Existing Panel form (channel + message ID) alongside Create.

v0.18.334New: more function and information on the guild hub's side panels

• Live Ops (right): Server Status (last restart, Nitrado connection health), a Recent Kills feed, and inline Kick/Ban buttons on every online player, pre-filled with their gamertag. Quick Actions (left): a Quick Kick / Ban form for banning someone who isn't currently online. Both new gamertag-only actions (POST /punishments/quick-kick, /punishments/quick-ban) are the exact same core /dz-kick and /dz-ban already use -- no Discord account required, gated on the same 'kick'/'ban' permissions those commands already respect.

v0.18.333New: guild hub gets a Quick Actions panel and a Live Ops panel

• Real user feedback: "notice the dead space on the left and right of this screen." The guild hub is now a 3-column layout instead of one centered card grid. Left: Quick Actions (whitelist enable/disable, force rotation now, a Create Event shortcut). Right: Live Ops -- who's currently online (with a warning tag if a still-connected player has an active ban this platform can't force-disconnect), Server Power (start/restart/stop), and Active Bans with one-click Unban, all reusing the exact same routes their own dedicated pages already use. A "tried to connect but was banned" log (requested alongside this) isn't buildable yet: this platform has no RCON/BattlEye access, so there's no confirmed signal anywhere in this bot's logs for a rejected reconnect attempt.

v0.18.332Fix: dashboard access-check noise ; a developer browsing an unjoined guild no longer logs a WARN

• guild.members.fetch failing (a routine, expected outcome for a bot developer opening a guild's dashboard without personally being a member of it -- full access is still granted either way) used to always log at WARN, indistinguishable from a genuine access-denial worth investigating. Now logs at INFO for a known developer, WARN only for an actual non-developer denial.

v0.18.331New: /restart-schedule, automatic DayZ server restarts at fixed daily times

• Configure one or more daily restart times (24h HH:MM, your own timezone) and .bOne will trigger a real Nitrado restart automatically at each one, catching up within 3 hours if the bot was briefly offline right at the scheduled minute instead of silently skipping the day. Optional lead-time warning (default 10 minutes, 0 to turn off) posts to the server's Default Channel before each scheduled restart. Admin-only, same as /restart : /restart-schedule times timezone|add|remove|list, /restart-schedule warning, /restart-schedule enable|disable|status.

v0.18.330Fix: Nitrado log-fetch warnings/errors were unattributed in bot.log

• The recurring "Log seek"/"Log download" warnings and errors nitrado.js logs when a server's ADM/RPT/script log fetch fails never named which server they were about ; with several guilds' Nitrado polling interleaved in the same ~30s cycle, a failing server could only be guessed at from timestamp proximity to a nearby guild-tagged line. Every one of these lines now includes the Nitrado service ID.

v0.18.329New: grant/revoke Admin or Moderator directly from the dashboard

• General Settings now has an Add / Remove Admins & Moderators section: paste a player's Discord user ID to grant or revoke the configured .bOne Admin or Moderator role for them, without leaving the dashboard or using Discord's own role UI. Works the same way for guilds running .bOne (the secondary bot) as it does for the primary bot. Requires a role to already be picked above first.

v0.18.328Improvement: Skywalk detection's sit-emote path now requires the sit to happen at sea level

• The real skywalking exploit is triggered by an emote glitch performed at the coast/in shallow water, not inland or up a mountain ; Skywalk's "sit then rise" path (Path A) now only arms its baseline when the sit emote itself was logged within 5m of DayZ's ~0m sea level (the one map-independent elevation reference available without a real heightmap), instead of arming on any sit anywhere. Paths B (sustained float) and C (anomalous altitude gain) are unaffected.

v0.18.327Fix: keyword triggers now fire on an emoji glued directly to text, not just spaced out

• A keyword whose trigger is an emoji (a plain 🎉-style emoji, or a Discord custom emoji's full <:name:id> form) already fired fine when surrounded by spaces, but silently never fired when glued directly against other text ("yay🎉", "🎉congrats") ; extremely common in real chat. Keyword responses could already contain emoji of either kind with no issue. Word-based keywords ("cat" not matching inside "category") are unaffected.

v0.18.326Fix: a heatmap could get stuck reposting every poll cycle instead of on its real schedule (live production bug)

• The scheduled Heatmap auto-post and the live Players Heatmap both wrote their "just posted, don't fire again yet" timestamp through a server reference that could go stale during the image render/Discord send if this guild had any other concurrent activity ; when that happened, the write silently never landed, so the guild stayed permanently "due" and reposted a fresh heatmap on every single ~30s poll cycle instead of its real once-a-day (or once-every-N-minutes) schedule. Same class of bug already fixed this week in store/teleport/weekly digest, now closed here too.

v0.18.325Fix: Ticket Categories role picker + the ticket system's dashboard pages are now grouped together

• Fixed a real bug: picking which roles auto-see a ticket category used a native multi-select, where a plain click on a 2nd role silently replaced the 1st instead of adding to it. Now checkboxes, like every other multi-pick control on the dashboard ; check as many roles as you want.
• Ticket Categories and Ticket Setup used to live under Server Config on the guild hub, while Manage Tickets and Ticket Panels lived under Support ; all 4 ticket pages never appeared together, only reachable from each other via a small link. All 4 now group together on the hub, and those redundant inline links are gone.

v0.18.324New: admins can now let a user hold more than one open ticket at once

• Tickets were always capped at one open ticket per user, no way to change it. Admins can now turn that off per guild ; /ticket allow-multiple enabled:true, or the new toggle on the Ticket Setup dashboard page. Off by default, so no guild's behavior changes unless an admin flips it.

v0.18.323Fix: 10 real bugs found by a full-codebase audit (12-agent sweep of every src file)

• Security: a player named exactly "__proto__" could crash the Raiding detector every cycle (a prototype-pollution edge case), silently dropping that whole poll cycle's events for the server with no retry ; fixed with the same guard other player-name lookups already use.
• Security: the Server Monitor host (real outbound UDP query) never got the same private/internal-address guard the FTP host already has ; an admin could point the bot at an internal address. Also closed a DNS-rebinding gap on the FTP host itself: it was only checked once at save time, never re-checked at actual connection time.
• Fix: Fire Rate alerts triggered by a hit (not a kill, the common case) reported the victim's map position instead of the accused shooter's, since the parser never extracted the attacker's own position from a hit line the way it already does for a kill line.
• Fix: a real stale-object-reference bug (already fixed in tempban/zone/base-ping) was still open in the Store, Teleport, and Weekly Digest features ; under real concurrent activity, a store purchase's refund or cleanup entry, a new/removed teleporter, or a posted weekly digest's "already sent" flag could all silently fail to save.
• Fix: a per-server pricing config (category base price / tier multiplier) added yesterday never backfilled onto an already-existing server, the same gap already fixed once before for a different field.
• Fix: /dz-kick with both a Discord user and a gamertag pointing at two different people recorded the kick against the wrong person (DM, list entry, and all).
• Fix: /giveaway start could leave a live, untracked giveaway message in the channel forever if the react-to-enter step failed after the message itself sent successfully.
• Fix: Punishment History showed a blank " ()" for a gamertag-only kick (no linked Discord account) instead of the actual gamertag.
• Fix: a moderator granted only the Ticket Panels permission could manage panels from the dashboard but was rejected doing the identical thing via /ticket panel-create in Discord.

v0.18.322Fix: Zone Entry role-ping alerts ignored Protected Gamertags (live production bug)

• A zone with the Alert purpose configured (@-mentions a role when a player enters) was the one trigger type in the whole ban/alert system that never checked the Protected Gamertags list ; a protected player still got pinged every time they entered, even though every other trigger (Zone/Base Ping auto-ban, Base Ping's own alert) already respects that list. Now checked the same way.

v0.18.321New: Ban Logs on the Player Punishments page ; one-click Unban for every ban type

• The Active Bans table on Player Punishments used to only cover Temp-Bans. Base Ping auto-bans and Zone auto-bans (which had NO dashboard unban path at all before this ; Base Ping was Discord-only via /baseping unban, Zone had no manual unban whatsoever) are now merged into the same table, each with its own one-click Unban button.
• Added a "Nitrado Ban List" section: a live, on-demand ("Load from Nitrado") read of this server's raw in-game ban list, showing anyone banned outside this bot's own records (added via /dz-ban or Nitrado's own panel) with its own Unban button.

v0.18.320New: add/remove Base Damage and Container Damage schedule windows directly on the dashboard

• The Base/Container Damage page could already enable/disable a schedule and set a timezone, but adding or removing an actual protection window still required /basedamage schedule-add/schedule-remove in Discord. The page now has real add-a-window and remove-a-window forms for both sections, same day/time parsing and validation Discord's own command already uses.

v0.18.319New: Protected Gamertags ; permanently exempt a gamertag from every ban path

• New dashboard page (and /dz-ban protect-add|protect-remove|protect-list, admin-only) lets you mark a gamertag as protected, guild-wide, across every server. A protected gamertag is skipped by Zone/Base Ping auto-ban, /tempban, /dz-kick, and /dz-ban alike ; base-ping/zone auto-bans previously had no admin-protection at all, unlike the manual commands, so this also closes that real gap. Not the same as the server-join Whitelist (a different, existing feature) ; named separately to avoid confusion.

v0.18.318New: Store Items table is now searchable and filterable by category

• The Store & Economy page's Items table now has a search box (name or classname) and a category dropdown, same filter bar the Item Catalog page already has. Matches show across every page at once (paging is suspended while a filter is active), with a live "Showing X of Y" count.

v0.18.317Fix: Item Catalog pictures were broken almost everywhere (live production incident)

• dayz.wiki.gg started 429ing nearly every single image request for 15+ minutes straight tonight ; earlier tonight's fix (only caching a genuine 404 as "no picture," not a rate limit) meant the bot kept retrying at the same pace instead of giving up, which turned out to just keep re-tripping the same rate limit. Added a real circuit breaker: after a few failed fetches in a row, the bot stops hitting the wiki entirely for 90 seconds instead of hammering it the whole time, and widened the spacing between fetches. A confirmed live production incident, not a hypothetical.

v0.18.316Fix: Store Items table is now paginated (was unusable once a store held hundreds of items)

• A store can now hold 1,000+ items (auto-stocked on setup, or via Add All Items) and the Store & Economy page's Items table had no pagination at all ; one page trying to render every row was genuinely broken at that size. Now paginated (50 per page) with Prev/Next controls, same "render once, page client-side" approach the rest of the dashboard already uses for its bigger lists.

v0.18.315Fix: Zone Autoban-Build no longer fires on placing a sea chest, barrel, or other unrelated item

• The Autoban-Build zone trigger had no item filter at all ; placing literally anything inside the zone (a sea chest, a barrel, a tent) triggered the same auto-ban as actually building a base. Now scoped to real base-structure activity only (fence/watchtower/flag/barbed-wire/shelter kits and parts, or actually building/dismantling one) ; same classname knowledge the building Cash reward already uses for the identical question.

v0.18.314New: Placement is now its own feed, separate from Construction

• Someone placing an item (a tent, a landmine, a fence kit, a fireplace) used to share the same "Construction" feed as actually building/dismantling a base structure. Placement is now its own separate event type/feed channel (/channel create type:Placement, or /setup auto-channels for a new server) with its own icon and color on the Event Map, so the two can be routed to different channels ; every Cash reward, Zone Autoban-Build trigger, and Raiding detection that used to key off Construction still applies to Placement exactly the same as before, only which channel it posts to has changed.

v0.18.313Draw a Zone now uses the same real map as Event Map ; alert channel picker moved onto the Base Pings page

• Fixed a real gap: Draw a Zone always showed a lower-resolution flat map background, even for chernarusplus and livonia, which the Event Map page already renders from real, ~12x finer satellite tile imagery. Draw a Zone now uses that same real map whenever it's available, with proper pan/zoom, falling back to the old flat rendering only for a map that has no tile imagery yet.
• The alert channel Base Pings and Zone entry alerts post to now has its own picker directly on the Base Pings page, instead of only being reachable from a separate Server Config page.

v0.18.312New: shops auto-stock on setup, tier pricing is now configurable ; fixed a real image-loading bug

• A brand-new DayZ server (/setup server-add) now gets its Corna Store shop pre-stocked with the entire real item catalog at the current default prices automatically ; a player can buy something the moment the shop is live, no separate trip to the Item Catalog page needed. Existing servers get the same thing with one click: a new "Add All Items" button on the Item Catalog page stocks every category at once instead of one at a time.
• Pricing Defaults on the Item Catalog page now also has a per-rarity-tier price multiplier (Tier1 through Tier4, Unique) alongside the existing per-category base price ; how much pricier a rarer weapon/item is than a common one is fully in your control now, not fixed.
• Fixed a real bug: the Item Catalog's pictures were mostly showing the fallback icon instead of the real item photo. Root cause was the first-ever page load hitting dayz.wiki.gg's rate limit partway through fetching 250+ never-before-seen images, and every rate-limited image got permanently marked "no picture available" instead of being retried ; only a genuine "this item has no wiki picture" now gets remembered that way, a rate limit gets retried on the next view instead.

v0.18.311Fix: Online Players board no longer posts a "0 online" message

• The Online Players status board now stays silent while a server is empty instead of showing an empty roster ; if the board was already up when the last player logged off, it gets removed, and a fresh one goes up the moment someone logs back on.

v0.18.310New: Zones can ping a role when a player enters ; guild map-config fix

• Zones (/zone) get a 4th purpose: Alert. Pick a Discord role and a cooldown on the Zones dashboard page (works on any existing zone, however it was created) or the Draw-a-Zone page for a new shape, and that role gets pinged the moment a player steps inside ; fires once on entry, not again until they leave and come back. Shares the same alert channel Base Pings already uses.
• Fixed one guild's Zone map rendering the wrong terrain: its server was saved with the Livonia map slug instead of Chernarus. Corrected directly in that guild's config.

v0.18.309New: Item Catalog ; every DayZ item with a real picture, one-click add to your store

• The Store's catalog used to start completely empty ; every item was typed in by hand, name and exact classname and all, with no images anywhere. New Item Catalog page (linked from Store & Economy) browses every real sellable DayZ item (1,400+, filtered from the full vanilla item list) as an image tile with its real name, a suggested price, and a one-click Add button ; an "Add All" button per category (Weapons, Food, Clothes, Tools, Containers, Explosives) stocks a whole category at once. Suggested prices are computed from a per-category base price (admin-editable, applies going forward) scaled up by the item's real rarity tier. The existing Store Items table also gets a picture next to each already-configured item now.
• Real item pictures come from dayz.wiki.gg, fetched and cached by the bot itself the first time any item is ever viewed (a live browser check caught that hotlinking the wiki directly gets blocked by the browser's own cross-origin policy, even though a plain server-side check said it would work fine ; fixed by proxying and caching instead). A picture for the one-off item a wiki page doesn't have falls back to a category icon, so every single item always shows something.

v0.18.308Fix: a single stuck routine log read could freeze EVERY guild's feeds at once, not just one

• Caught live tonight, right after deploying the previous fix: a guild with a large backlog of unread log content could hang its own poll cycle indefinitely on a routine (non-rotation) read that had no time limit at all -- and because the sweep that polls every guild shares one lock, that one guild stalled ALL of a bot process's guilds at once. Observed live freezing all 9 of one bot's guilds for 5+ minutes with zero progress; restarted the process to restore service immediately, then closed the actual gap: every log read a poll cycle makes now shares the same real time budget the rotation-recovery reads already had, so one stuck read can no longer hold up the whole sweep.

v0.18.307Fix: a live false-flood alert on deathmatch servers; the same stale-record bug found across kicks/temp-bans/zone-bans too; third audit pass

• The connection-flood alert (built for a real DDoS incident) was firing repeatedly on a fast-paced deathmatch server, where players rage-quitting or crashing out right after a death produce the exact same tight cluster of "lost connection" kicks a real attack does. Server Monitoring now has a per-server switch to turn off just that one heuristic, leaving the separate (and still valid) Nitrado-unreachable outage alert untouched.
• A third independent full-codebase audit, plus tracing the previous two nights' concurrent-save fix all the way through, found the SAME underlying bug (a concurrent save silently orphaning an in-progress ban/kick record) in three more places it hadn't been fixed yet: base-ping ban expiry, base-damage schedule syncing, and -- the deepest instance -- inside the actual Nitrado unban call itself for zone bans, temp-bans, and kicks, where the record could go stale mid-call even after the caller had already re-resolved it. All fixed the same way, with a live-concurrency regression test proving each one.
• Also fixed: three separate ways a real Nitrado read/download failure during log-rotation recovery could get silently mistaken for a clean, successful drain, hiding the failure from every outage alert that depends on it; and a background giveaway reroll could leave a giveaway permanently locked forever if the bot crashed at exactly the wrong moment.

v0.18.306Fix: a concurrent save could silently lose an auto-ban record; second full-audit pass

• A real, quietly-serious one: for a multi-server guild, an auto-ban record (base-ping or zone) written right after the real Nitrado ban call could be silently lost if ANY other save for that same guild landed during that round trip -- routine under normal poll traffic, not a rare coincidence. The bot-side tracking record vanished even though the real ban was in place, so it never showed up in the ban list and never got auto-reversed when its time was up.
• A second full-codebase audit pass turned up and fixed several more: a background sweep's own "is it still running" tracking could get confused by two overlapping runs of the same sweep; /dz-store pay let a "__proto__" recipient silently destroy the sender's Cash with no error and nothing credited; four dashboard channel pickers (embed builder, channel manager, creator alerts, dz-income) accepted a real but non-text channel and reported success while every later post to it would have silently failed; removing a reaction-role mapping that then failed to save left the removal applied in memory anyway, waiting to be flushed by an unrelated later save; and editing a saved embed past Discord's size limits corrupted the live record with the rejected values before the rejection was even reported.

v0.18.305Fix: the per-cycle log-recovery walk could still freeze feeds for minutes; test-2 audit fixes

• Third same-night follow-up to the log-recovery-walk freeze: the shared time budget from the previous fix could still be blown past by a SINGLE already-in-flight network call running long (each one retries internally with its own real timeout), since the budget was only ever checked between steps, not during one. The whole recovery step is now raced against a hard deadline so this can no longer hold up every other guild's feeds no matter what a single stuck call is doing.
• A full-codebase audit (test 2) also turned up and fixed: Twitch/TikTok go-live and new-post alerts weren't actually saved to disk, so a routine bot restart while a creator was live could re-announce an already-live stream or already-posted video; an IPv4-mapped IPv6 address (e.g. the cloud metadata endpoint in that form) could slip past the FTP-host SSRF guard; a raw "__proto__" gamertag could crash achievement checking; a saved embed's link-button URL had no format validation; editing an existing zone's ban tiers always said "Added" instead of "Updated"; and three small dashboard display bugs (a stray comma instead of a blank cell in Tickets and Logins, and /resetlogs not actually resetting everything its own name promises).

v0.18.304Fix: a permanently-broken server (e.g. a suspended Nitrado subscription) could hammer Nitrado forever with zero backoff protection

• Found via a full-log audit today: a real suspended-subscription service was retrying its script-log discovery call thousands of times a day, every single poll cycle, with no cooldown ever kicking in -- because that specific call's failures were invisible to the circuit breaker built earlier this week (its own /gameservers check and every routine log read looked "fine," since a server that never actually ran has no log files to even attempt reading). Script-log discovery failures now feed the same circuit breaker as everything else, so a genuinely dead service gets the same escalating backoff protection instead of being hit every 30s indefinitely.

v0.18.303Fix: yesterday's per-cycle recovery cap could still freeze every other server for minutes, and could quietly duplicate events

• Same-night follow-up to v0.18.302: capping how many log generations that recovery walk downloads per cycle bounds worst-case DATA volume, not worst-case TIME -- a real second live recurrence (dotbone, ~9 more minutes with zero log output) proved that under sustained Nitrado slowness, every read can be succeeding, just too slowly, blowing past a cycle's time budget with no warning at all. A real wall-clock budget now backs up the count cap, so this can no longer hold the shared cycle lock for more than a bounded window no matter how slow (not just how much) Nitrado is being.
• Separately, a same-night audit caught a real correctness gap in that recovery walk: a log generation that gets fully downloaded and then becomes the new tracked file had its read position wrongly reset to the start instead of to where its content actually ends -- on a big enough backlog, that could have silently re-announced real kill/chat/connect events a second time on the next cycle. Fixed to track and reuse the real position.

v0.18.302Fix: one struggling server could freeze feed updates for every other server on the same bot process

• Real incident: a service that fell many restarts behind (sustained Nitrado rate-limiting) needed to recover a couple dozen retained log generations in one go -- each one its own real, rate-limited download, all running inside the single shared per-cycle lock. That held the lock for 15+ minutes straight and froze every other guild's kill/chat/connect feeds on the same process, not just the struggling one's. That recovery walk is now capped per cycle (the rest is picked up on later cycles, same "spread it out, don't lose it" approach already used for oversized single-file backlogs), and a cycle that has to pause partway now correctly counts toward the existing circuit breaker instead of being invisible to it.

v0.18.301New: Online Players board, a simple always-up-to-date "who's on" list

• New auto-updating channel type (Online Players): just a plain, sorted list of currently-connected gamertags, refreshed automatically as people join/leave. Deliberately minimal by design, no extra stats or fields ; /player online is still there for the fuller on-demand version. Available via /setup auto-channels or /channel create.

v0.18.300Nitrado circuit breaker fix: it now actually catches the failure it was built for

• Same-day follow-up: yesterday's circuit breaker (v0.18.299) only watched the initial Nitrado connectivity check, not the actual log-reading calls that run every cycle -- so a service whose connectivity check kept succeeding while its log reads kept failing (confirmed live, the exact shape of the original incident) never tripped the breaker at all, and kept hammering Nitrado every 30s regardless. Both checks now feed the same breaker.

v0.18.299Nitrado circuit breaker: a struggling server backs off instead of hammering Nitrado forever

• Real incident today: sustained Nitrado rate-limiting (429s) across many guilds at once, self-reinforcing because every affected guild's own poll cycle kept retrying fresh every ~30s regardless, never giving the rate limit room to clear. Once a server's Nitrado connection has been failing for a few minutes straight, it now backs off on its own (3 min, then 8, then settling at 15 min for a persistently-broken service) instead of retrying every single cycle -- protects the services actually struggling without slowing down every healthy guild's normal ~30s polling.
• Server Monitoring now shows when a server is in this cooldown and roughly when it'll be checked again, so it reads as "backing off on purpose" instead of looking like the bot silently gave up.

v0.18.298/logins goes deeper: real device fingerprinting + IP abuse scoring

• The dev-only /logins page now captures a real browser device fingerprint on top of the usual Discord/network info: screen size, GPU (via WebGL), CPU core count, device memory, and a canvas render hash. Two different Discord accounts sharing the same device now get flagged as likely the same person even when they log in from different IPs (defeats a VPN, which a plain IP match never could).
• Also added: a real IP abuse-confidence score (AbuseIPDB, free tier) alongside the existing proxy/hosting flags, shown on every login and pushed to the security alert channel the same way a proxy/hosting flag already is.

v0.18.297/creator link now supports TikTok too (go-live and new-post alerts)

• /creator link platform:tiktok username:<you> links a TikTok account, same self-service flow as Twitch. You'll get an alert when you go live on TikTok, and another when you post something new.
• Worth knowing: TikTok has no official API for either of these (unlike Twitch), so both run on unofficial, reverse-engineered detection. Go-live checks every 3 minutes; new-post detection watches your total video count every 15 minutes rather than reading individual posts (a currently-broken piece of the library it depends on), so a new-post alert links to your profile rather than the specific video. Less prompt and less reliable than Twitch by nature, not a bug.

v0.18.296Security hardening pass: a real XSS fix, SSRF protection, and more

• Found and fixed a real stored-XSS gap: a crafted player display name (sourced from DayZ's own logs, which place no restriction on it) could break out of the Event Map's inline data script tag and run arbitrary script in an admin's dashboard session. Now safely escaped, with the same fix applied to Draw a Zone for consistency.
• Rotation's FTP setup now blocks a hostname that resolves to a private/internal/loopback address (an SSRF gap; nothing stopped an admin, intentionally or by mistake, from pointing this bot's own outbound connection at its own infrastructure).
• The Logins dev page got a real upgrade: an overview stat strip, a new "N failed attempt(s) first" signal correlating a run of failed logins right before a success (a real brute-force-then-success pattern the page never surfaced before), and client-side search/flagged-only filtering.
• Smaller hardening: a weak DATA_ENCRYPTION_KEY now warns on boot (same as the existing session-secret check); dependency vulnerabilities patched (0 remaining); a couple of expensive map-render pages now rate-limited against a leaked/abused session; the public file-drop upload endpoint no longer parses a large body before checking the link is even valid.

v0.18.295Diagnostics page redesign: see what actually needs attention in one glance

• The /dev/diagnostics page now opens with a plain-language "N things worth a look" banner (or a clean "everything looks healthy" line), each item linking straight down to the section it's about -- no more scrolling the whole page to find out if anything's wrong.
• The 6 "is anything wrong" sections (data findings, code scan, log errors/warnings, background jobs, retry counters) now collapse to a single reassuring line when healthy, and only expand automatically when there's something real to see -- a clean process no longer forces a scroll past a wall of empty tables to reach the developer controls at the bottom.
• Reorganized into three clear groups (Anything Wrong? / System Status / Developer Controls) instead of one long flat list, and the top stat strip is now clickable, jumping straight to the matching section.

v0.18.294Alert Guilds actually reaches people now; Channels Configured stopped showing broken links

• Alert Guilds (dev panel) no longer requires a guild's Discord "system channel" specifically; most guilds never set one, so the alert was silently landing nowhere. It now posts to any channel the bot can actually send in, and @-pings the guild's own configured .bOne Admin + Moderator roles so it can't be missed.
• Fixed a real bug in the "Channels Configured" confirmation embed (/setup auto-channels): every channel reference in it was literally broken text (e.g. "<#kill-feed>" instead of a real link) rather than a clickable mention, and duplicated each channel's own emoji right next to itself. Now shows real, working links in a compact wrapped list instead of a long duplicated-icon wall of text.

v0.18.293Draw a Zone: you can now zoom in for more accurate placement

• Real user feedback: the Draw a Zone map couldn't be zoomed, capping every click at the full-map view's resolution. Scroll to zoom in (up to 8x) and drag to pan while zoomed, with Zoom In/Out/Reset View buttons for anyone without a scroll wheel. Points now survive panning/zooming mid-draw instead of only being placed at whatever the view happened to be at click time.

v0.18.292Mission Config Errors feed catches more real failure shapes

• Fixed a real gap: a multi-line "JSON ERROR" reason (e.g. a broken cfggameplay.json) was getting truncated to its first line in the Mission Config Errors feed, silently dropping the actual error detail. Now captured in full, plus the script file/line for JSON-parse-specific failures when DayZ logs one.
• The feed now also catches Nitrado's own "types.xml won't even parse" errors from restart.log (a genuinely broken economy config file, not the routine "we silently adjusted a value" case that stays in Nitrado Types.xml Override); same private admin-only channel as everything else in this feed.

v0.18.291Combat-Log Attempts is now a suspicion alert too, not its own channel

• Combat-Log Attempt (a player cancelling a logout right as they're about to be finished off) no longer gets its own dedicated feed channel either, same call as Knockout Disconnection a moment ago. Now grouped with the other /detect suspicion alerts (Join-Kill, Raiding, etc.) in the shared private suspicion-alerts channel /setup auto-channels creates.

v0.18.290Knockout Disconnections is now a suspicion alert, not its own channel

• Knockout Disconnection (a player disconnecting while knocked out, a possible combat-log evasion) no longer gets its own dedicated feed channel. It's now grouped with the other /detect suspicion alerts (Join-Kill, Raiding, etc.) in the shared private suspicion-alerts channel /setup auto-channels creates, since that's the more useful place to actually notice it.

v0.18.2899 new feeds: knockouts, emotes, combat-logging, weapon jams, and more

• New feeds, most auto-provisioned by /setup auto-channels: Knockouts and Knockout Disconnections (a player going unconscious, regaining consciousness, or disconnecting while still out), Emotes, Combat-Log Attempts and Logout Type (instant vs. timed), Weapon Jams, and an auto-updating Infected Zone Status board (server-wide infected/animal counts plus per-group zone health, straight from the server's own Central Economy log).
• Two new admin-only diagnostic feeds, private by default: Mission Config Broken (a server-side script/config error, e.g. a missing custom mission file) and Nitrado Types.xml Override (when Nitrado's own automated limiter silently lowers a configured item count below what's set in your economy config).
• Under the hood: this bot now reads two DayZ log files it never touched before (script_*.log and restart.log), on top of the existing .ADM/.RPT ones, using the same Nitrado connection already configured via /setup.

v0.18.242Setting up a Ticket Category no longer means alt-tabbing to Discord first

• The dashboard's Ticket Categories page can now create the Discord category channel for you, right in the same form, instead of requiring you to go create it in Discord first and come back to find it in a dropdown. The page also now explains how Categories and Panels fit together and links straight to Ticket Panels.
• Also gave Blackwater DayZ's partner-page tracer animation a real pass: bursts now travel in a true straight line like real automatic fire, fire more often, and add a subtle screen-wide flicker synced to each shot.

v0.18.241Blackwater DayZ's background now actually reads as gunfire

• Reworked the tracer animation on the Blackwater DayZ partner page: real glowing streak lines with a bright head and a muzzle flash at the origin, fired in short automatic-fire bursts instead of single soft dots drifting by.

v0.18.240Blackwater DayZ's partner page gets its own continuous background

• The Blackwater DayZ partner page now has a real, continuous full-page background animation of its own: sparse ambient dust and the occasional tracer round streaking across the screen and fading out, instead of a static page once the opening animation finishes.

v0.18.239A second official partner: Blackwater DayZ, with its own dedicated page

• /partners is now an index of every official partner community, each with its own dedicated page instead of one shared spotlight. Blackwater DayZ (console PvP/deathmatch, run by Austin) joins Baked Beanz as an official partner, with its own tactical/night-vision visual identity and a real target-lock opening animation.

v0.18.238/features is now .bOne's own flagship page, wordmark and all

• The Features page got a full revamp into a real flagship page for .bOne: a new animated opener featuring the actual .bOne wordmark and Knuckle mark (the prepared brand kit's first real appearance anywhere on the live site), real copy on what .bOne actually does, and live server/community counts alongside the real feature count, all sitting above the same real feature grid as before.

v0.18.237Fix: server settings imported from another bot could silently stop showing up in feeds

• A backup exported from one bot process and imported into a different one (for example, moving a server's settings from the primary bot to .bOne) was carrying over the ORIGINAL bot's internal ownership marker, which quietly excluded that server from every background check (loot/event feeds, temp-bans, zones, giveaways, reminders) run by the bot it was actually imported into. No error appeared anywhere ; feeds just stopped. Both the /setup backup-import command and the dashboard's Import button now correctly hand ownership to whichever bot performs the import. Already-affected servers have been corrected live.

v0.18.236.bOne rebrand, phase 3b: deploy tooling now targets the renamed process

• Purely internal deploy-tooling update, no behavior change: the deploy script's own process target renamed from 'benchbot' to 'bone' to match phase 3a's file rename, ahead of actually renaming the live process itself.

v0.18.235.bOne rebrand, phase 3a: renamed the entry/config/env files themselves

• Purely internal: benchbot.js, BenchbotConfig.js, and Benchbot.env(.example) are now bone.js, BoneConfig.js, and Bone.env(.example). Every import/reference across the whole codebase updated in lockstep. No behavior change ; nothing you'd notice from Discord or the dashboard.

v0.18.234/about now shows the real .bOne wordmark, and says .bOne instead of BenchBot

• Bench's own "About" write-up (/about) now displays the actual .bOne wordmark image alongside the text, and the one remaining "BenchBot" mention in that text/title is now ".bOne" too.

v0.18.233.bOne rebrand, phase 2: real branding (new favicon, wordmark on the repo README)

• The dashboard's browser-tab icon is now .bOne's actual current mark (it was quietly still the pre-rebrand shape until now). The project's README also leads with the real .bOne wordmark instead of plain text, light or dark depending on how you view GitHub.
• Icons/wordmark for chat, the public site, and everywhere else stay as their own separate follow-up ; this was specifically the browser tab + repo front door.

v0.18.232.bOne rebrand, phase 1: every command, message, and page now says .bOne instead of BenchBot

• Every user-facing bit of text this bot controls (Discord replies/embeds, command descriptions, the dashboard's pages, docs) now says ".bOne" instead of "BenchBot" ; this covers text only, not yet the site's branding images/icons or any repo/infra naming, which are their own separate follow-up steps.
• A few things that live on your own DayZ server were deliberately left alone rather than blindly renamed: hordes, airstrikes, and other events you've already created keep working under their original names exactly as before ; only brand-new ones use the new naming. Same for the "Feeds"/"Games"/"Utilities" Discord categories /setup auto-channels already created for you ; they'll get relabeled automatically the next time that command runs, nothing duplicates.

v0.18.231Fix: dashboard pages with a lot of real data (many players, many entries) could go permanently blank

• The dashboard's scroll-reveal animation decided whether to show a section based on what fraction of ITS OWN total height had scrolled into view ; for a section that grew tall enough (found live: a guild's 152-player Cash Balances table, ~9,000px tall), even a full screen of visible overlap could never reach that fraction, so the section just never appeared, with nothing in any log to explain why. Fixed to trigger on any visibility at all instead, which can't fail this way no matter how much data a section ends up holding.

v0.18.230Full-codebase audit: a faction currency exploit and a critical account-corruption bug found and fixed, plus several smaller cleanups

• /faction leave and /faction bank deposit used to trust a freely-typed gamertag with no ownership check, unlike every other faction command. Anyone could force a rival faction's members out one by one off its public roster (forfeiting its Cash bank on the last member) or drain a fellow member's real Cash balance into the shared bank without consent. Both now require your own linked gamertag, same as kick/promote/withdraw already did.
• Linking a Discord account to the gamertag "__proto__" (a reserved word with special meaning in JavaScript) used to be able to corrupt shared bot memory across every server the bot serves, once that account touched Cash, quests, or a saved store location. Now blocked outright at /link, with matching safety checks everywhere a gamertag is used as a lookup key.
• A message that gets automatically reposted (reaction role panels, ticket panels, suggestions) now correctly explains why: "it was deleted" vs. "it's owned by a different bot" are two different situations and now get two different, accurate explanations instead of one hardcoded story.
• Several dashboard tables and cells had a handful of stray bare commas left over from an old cleanup pass, showing as visual noise instead of "nothing here" (Login History's IP location, Giveaways' active countdown, and a few config dropdowns). All show clean placeholder text now.

v0.18.229Corna Store: items can now be grouped into categories (Ammo, Weapons, etc.) instead of one long list

• /dz-store admin item-add has a new optional category field (with autocomplete suggesting whatever categories you've already used, so names stay consistent) ; leave it blank and an item stays Uncategorized, same as before.
• Both /dz-store view's Items list and the dashboard's Store page now group items under a heading per category instead of one flat list.

v0.18.228Fix: reaction role panels, ticket panels, and suggestions could get permanently stuck if a guild ever moves to a different bot

• Discord never lets one bot edit a message a different bot posted. If a guild's data ever moves to a different bot process (e.g. a .bOne migration), three features used to break on that one specific message: reaction role panels stopped accepting new add/remove-role edits (and silently lost the change), ticket panel edits failed with a visible error, and worst of all, resolving a suggestion reported success while the public embed silently never updated at all.
• All three now self-heal the same way the leaderboard, live heatmap, and giveaways already did: if the original message can't be edited, a fresh one is posted automatically, tracked going forward, and you're told it happened (with the old message's id, so it's easy to find and delete).

v0.18.227Fix: Login History showed a broken-looking double-comma for logins that predate device/ISP tracking

• Every login recorded before the login-audit upgrade shipped has no device/ISP data (nothing to backfill it with), which rendered as two stacked bare commas in the new Device/ISP column, reading like a bug rather than "no data for this old entry." Collapsed to the same single-comma empty placeholder every other column here already uses.

v0.18.226Fix: the new Login History table was cut off on a normal desktop window

• The Login History table's 8 columns didn't fit the dashboard's own max-width container ; it was technically scrollable but with no visible cue, so it just looked broken. Consolidated back down to 6 columns and fixed the layout so no single long value (a Discord ID, an IPv6 address) can push the table wider than the page again.

v0.18.225Dashboard login audit: deeper signal, failed attempts, correlation, trust list, session revocation

• Developer-only /logins page overhaul: now captures device/browser, ISP, and ASN per login (in addition to VPN/proxy/hosting), flags a login from an IP or device that account has never used before, flags two different accounts sharing the same IP or device, and flags an 'impossible travel' pattern (the same account logging in from two implausible locations too close together in time).
• New: failed/rejected login attempts (bad OAuth state, a Discord API error, a rate-limit trip) are now recorded and shown in their own section, instead of only existing in bot.log.
• New: a trusted-source allowlist (an account or a specific IP) so a known, legitimate VPN user's routine logins stop generating flags and alerts, without weakening detection for anyone else.
• New: an Active Sessions view with a real 'revoke all sessions' action per Discord account, immediately invalidating that account's existing dashboard login everywhere.
• New: a browser-reported timezone check ; a VPN changes an IP's apparent location but not the OS's timezone setting, so a mismatch between the two is a real signal worth surfacing.

v0.18.224Embed Builder: add buttons to a custom embed (links + self-serve role toggles)

• /embed create can now attach up to 5 buttons to whatever you build: Link buttons open a URL, and Role Toggle buttons grant/remove a role when a member clicks them, no reactions needed. The wizard has a new Add Button step (Link opens a quick label+URL form ; Role walks you through picking the role, then its label).
• The same admin-only safety rule /reactionrole already enforces applies here too: only a full Administrator (or BenchBot's own admin role) can wire up a toggle button for BenchBot's own admin/moderator role, or any role carrying a powerful Discord permission ; a moderator with just Embed Builder access can't use this to grant themselves elevated access.
• The dashboard's Embed Builder page got the same Buttons section, so you can add/edit/remove buttons there too, including picking a role from a real dropdown instead of typing an ID.

v0.18.223Fix: a buried stash could show a location off the map entirely

• A ground stash's Buried event was reading its height value where the real north-south coordinate belongs (and vice versa), the one location log line in this bot that doesn't use the same format every other event type does ; a buried item could show an "Open on iZurvive" link that plotted it in open ocean, nowhere near where it actually was. Fixed and verified against the real report.

v0.18.222/economy daily|weekly|work|beg|crime and /slut now pay real Cash, fully admin-configurable

• These 6 commands used to pay a fixed, hardcoded amount of Dollars (a Discord-side minigame currency) with zero way for an admin to change it ; a real admin reported they couldn't configure daily/work/slut at all. They now pay real Cash (the DayZ economy /dz-store spends), and every one of them can be enabled/disabled and have its chances, payout ranges, and cooldowns tuned via the new /economy admin daily|weekly|work|beg|crime|slut.
• Since Cash is tied to your actual DayZ gamertag, these 6 commands now need a linked gamertag (/link set) to use, the same requirement /dz-store already has ; you'll get a clear prompt instead of a silent failure if you haven't linked yet.
• On a guild running more than one DayZ server, these commands now ask which server's Cash economy to use, same as /dz-store/other server-scoped commands ; a single-server guild sees no change at all.

v0.18.221Cash is now clearly marked as the real DayZ economy everywhere

• Dollars/Plates/Bullets/Chips/Salvage were never labeled as anything in particular, and Cash's own icon doubled as Dollars' icon almost everywhere ; Dollars now gets its own icon, and every balance display, /game currencies, and the leaderboard now say plainly that Cash (spendable at the Corna Store) is the real economy and the rest is minigame money.
• /player-hub's Balance button and /myprofile's Economy Ledger now show Chips and Salvage too (previously missing entirely), not just Dollars/Plates/Bullets/Cash ; one place to see every balance at once.

v0.18.220Fix: full-codebase audit ; 8 more real bugs found and closed

• /expedition go's run-in-progress guard released almost immediately instead of holding for the whole run, letting a well-geared player stack several runs at once and multiply their guaranteed find rate ; now genuinely holds until the run actually ends.
• A handful of gamertag/item/slug lookups (banlist review, banlist reports, legal pages, /shop buy) mishandled a few reserved words ("__proto__", "constructor", etc.) in a way that could corrupt shared bot state or crash the command instead of just saying "not found" ; all closed with the same guard pattern already used elsewhere.
• /suggest could orphan an already-posted suggestion (and silently reuse its number for the next one) if only the confirmation emojis failed to attach ; a suggestion is now tracked the moment it's actually posted, regardless of what happens after.
• A very large log-catchup batch (recovering from a multi-restart outage) could crash mid-cycle and permanently lose that whole batch of events ; fixed the crash.
• The dashboard now warns at boot if its session secret is missing entirely, instead of silently starting and failing every single login with a confusing, unrelated error.
• A safety gap in the FTP mission-file writer (used by /createevent, /rotation) that could, on an unusual path, delete a live file with no way to restore it ; closed before it ever hit production.

v0.18.219Fix: audit sweep complete ; last 3 ack-timing gaps closed

• /quests' submission-review post, the embed builder's "Send Now" button, and /ticket add|remove could all fail to respond under ordinary network latency ; the same class of fix applied everywhere else in the bot this week, now covering every remaining command that had it.

v0.18.218Fix: /altcheck could miss (or falsely flag) a handoff that crosses midnight

• Every line in a log file used to get stamped with the file's own rotation-start date, regardless of the line's real time of day ; a server whose restarts don't land at exactly midnight could make a genuine account-switch handoff invisible, or make an innocent player's real overlapping session look like it never happened (the exact thing that's supposed to rule someone out). Now tracks the real chronological order within each file correctly.

v0.18.217Fix: audit sweep continued ; a stuck quest button and 3 slow-command ack failures

• Double-clicking "Start Quest" on an already-started quest silently did nothing (a real double-acknowledgment bug) instead of just showing the quest again.
• /ticket priority, /ticket rename, /player-hub setup, and /dz-income submit could all fail to respond under ordinary network latency, same class of bug as everywhere else in the bot that already acks before doing slower work ; these four just hadn't gotten the fix yet.

v0.18.216Fix: audit sweep continued ; a kick ban-evasion race and a Cash-farming exploit closed

• /dz-kick had the same race /tempban was already fixed for: two kicks for the same gamertag landing at once used to create two independent records, and the shorter one's expiry could unban the gamertag early even while the other still claimed active. Now merges into one record, same as /tempban.
• /dz-store admin config's hit/build/flag cooldown fields accepted 0, which doesn't mean "instant" ; it fully disables the anti-farm cooldown, letting the reward pay out on every single qualifying action. Also closed a related gap where the dashboard's own store config accepted a negative starting Cash balance.

v0.18.215Fix: full audit sweep ; 4 real bugs closed, including a privilege-escalation gap and a multi-restart data-loss gap

• /dz-ban add never checked whether the target was a protected admin/bot-admin-role holder/developer, unlike every sibling punitive command ; a moderator with only the narrow 'ban' permission could have permanently game-banned an admin (no auto-reversal on this one, unlike /tempban or /dz-kick). Now blocked the same way, via a reverse gamertag→Discord lookup.
• Removing a DayZ server and adding a replacement (the common "swap Nitrado subscriptions" workflow) could silently reuse the removed server's in-memory runtime state if the new one got the same id ; phantom "online" players, old map events shown on a brand-new server, even a permanently-stuck write lock in rare cases. Fixed at the source.
• Tonight's earlier log-rotation-drain fix only ever recovered ONE hop ; if a DayZ server restarted twice or more during an outage, an entire intermediate log generation could still be silently, permanently lost. Now walks every generation Nitrado still retains, not just the one immediately before the newest.

v0.18.214Fix: /baseping whitelist now also stops the alert, not just the auto-ban

• A whitelisted gamertag (/baseping whitelist add) used to still trigger the base ping's own alert, only the auto-ban was skipped ; now whitelisting exempts a gamertag entirely, no alert and no auto-ban, so a base's own owner stops getting pinged for being in their own base. Same whitelist, same commands, just one consistent meaning now.

v0.18.213New: multiple DayZ servers on the same Discord server can now share a name

• /setup server-add no longer blocks a name already used by another server here. When 2+ servers share a name, every place that shows or accepts a server name (autocomplete, /setup server-list, the dashboard's server switcher) shows it as "Name (#id)" so the right one is always unambiguous ; a unique name works exactly as it always has.

v0.18.212Fix: the dashboard could silently be served from the secondary bot's own, separate data instead of the primary one's

• The secondary bot used to unconditionally try to start its own dashboard server on the same port the primary one uses, racing it on every restart ; whichever process lost was just quietly dashboard-less, and whenever the secondary bot won, everyone's real dashboard traffic was served from its own separate (often much emptier) data store instead of the primary bot's live one. The secondary bot never needs its own dashboard, the primary one already serves its guilds too, so it no longer even tries.

v0.18.211Fix: a real event written right before a server restart could be silently lost

• Every ADM/RPT log rotates to a fresh file on server restart ; anything written to the OLD file after the bot's last read but before the restart used to be silently dropped the instant the bot switched over, rather than ever being read. Now the bot drains whatever was left in the old file first, so a vehicle spawn, kill, chat line, or anything else logged in that final window is recovered instead of lost, found while auditing a live report of vehicles missing from the map that had genuinely spawned.

v0.18.210New: DZ-Income dashboard page for setting rates and the review channel

• /dz-income's role rates and review channel can now also be set from a new dashboard page (guild hub > DZ-Income), the same config /dz-income admin already offered on Discord ; view/add/edit/remove a role's hourly rate and pick the review channel from real dropdowns instead of typing role/channel names. Admin-only, same as the Discord command's own admin subcommands ; approving/rejecting submissions themselves stays Discord-only.

v0.18.209New: /dz-income ; honor-based hours-worked pay, admin-reviewed before anything is paid

• Set an hourly Cash rate per role (/dz-income admin set-rate) for staff, builders, event crew, whatever roles you use ; a player reports hours worked with /dz-income submit, and it posts to a review channel you configure with Approve/Reject buttons. Nothing is paid automatically ; every single submission needs an admin or granted moderator's decision first. If someone qualifies for more than one configured role, their highest rate is used automatically.
• The submitter can never approve or reject their own submission, even if they also hold the reviewing role ; approved amounts deposit straight into their linked gamertag's Cash balance and they're DMed either way.

v0.18.208New: dashboard now works for servers running the secondary bot, not just the primary one

• Any server admin-managed through the secondary bot instead of the primary one could not use the web dashboard at all ; every page checked guild membership against the primary bot's own Discord connection only, so a secondary-only server was invisible to it. The dashboard now also recognizes the secondary bot's own servers across every page (login, the server picker, and all ~35 individual settings pages), automatically using whichever bot actually manages that server.

v0.18.207Fix: connect/disconnect feeds could show a wildly wrong "Time Online"/"Time Offline"

• Reported live as "Time Online: 1m" on a session that was actually hours long. Whenever the bot has to catch up on a backlog (right after every restart, until it finishes reading anything it missed), a player's connect and disconnect could both get processed together in the same catch-up pass ; the duration was measuring how long that catch-up took, not how long the player was actually online. Now shows "Unknown (bot restarted mid-session)" in that specific case instead of a misleading number, and is unaffected the rest of the time.

v0.18.206Fix: the secondary bot's icons were STILL broken after the previous fix ; real root cause this time

• Live-reported still broken right after v0.18.205 shipped. That first fix mutated the shared code's icon definitions in place at startup, which only worked for icons read fresh each time a command runs ; several places (the leaderboard, faction cards, the in-game currencies, help/quickstart pages) instead build their own icon text once when the bot first starts up, before that mutation had a chance to run, so they kept using the primary bot's own icon IDs regardless.
• Properly fixed this time by rewriting outgoing messages themselves right before they're sent to Discord, instead of trying to catch every place an icon might get used early ; this covers every icon everywhere, including places like this that build their text in advance, confirmed against a real live connection before shipping this time, not just re-tested in isolation.

v0.18.205Fix: the secondary bot was showing raw ":icon_name:" text instead of actual icons in every embed

• Every embed the secondary (dotbone) bot sends was showing literal text like ":bb_star:" or ":bb_gun:" instead of the real icon ; those tags reference custom emoji IDs that only belong to the primary bot's own Discord application, and Discord can't render another bot's message using someone else's application emoji. The secondary bot now uses its own already-uploaded copies of all 89 icons instead, swapped in automatically at startup ; the primary bot's own embeds are completely unaffected.

v0.18.204Fix: Loadout Generator was offering wrong or missing attachments for most weapons and gear

• Reported live: the SCAR couldn't take any support/buttstock attachment, and the AUG could only take one optic. A full re-audit against dayz.wiki.gg (cross-checked against this server's own real item list) found the problem was much bigger than those two ; nearly every AK-pattern rifle had a Western-only ACOGOptic wrongly listed instead of its real Eastern optics, and most Western rifles (M4A1, FAL, M14, Scout, SV98, UMP45, MP5K, and more) were missing nearly their entire real optic/suppressor/furniture list. All now corrected, plus the newer SCAR-H now has its real buttstock option.
• Also found and fixed while auditing gear: the belt was missing the Winter-color holster, and the vest listed a pouch color ("_Desert") that was never a real item on this server ; the real Winter-color pouch is offered instead. Two similar invalid "_Desert" entries for the vest/backpack item picker were removed outright since the real Winter versions already show up normally.
• Added a dedicated test suite (14 tests) that checks every single attachment the generator can ever offer is a real, spawnable item ; this class of bug (an item that just doesn't exist) will now fail a test immediately instead of silently shipping.

v0.18.203New: Creator Alerts (Phase A) ; automatic go-live posts for linked Twitch streamers

• Members can now link their own Twitch account with /creator link, no admin needed ; when they go live, BenchBot automatically posts an alert (with a link, their real profile picture, and stream title) to a channel admins configure, pinging either @everyone or a specific role (/creator admin channel, /creator admin ping-role, or the new Creator Alerts dashboard page).
• First phase of a bigger creator-alerts push ; YouTube (new videos + going live) is planned next, and TikTok/Instagram/X will get a static profile link (no platform currently offers a free, reliable way to auto-detect a new post on those three).

v0.18.202New: hide event locations from specific Discord feeds, per event type

• Dashboard > Channel Management now has a Location Visibility section: check any event type (kills, builds, flags, stashes, etc.) and its Discord embeds stop including Coordinates/Nearest Town/Map link entirely, while everything else about the event still posts as normal. Each type is independent, so e.g. base/flag locations can stay hidden while kill locations still show, or the other way around.

v0.18.201New: a faster, second DDoS signal that catches a flood even while Nitrado stays reachable

• Direct follow-up to the 2026-08-14 incident: a live re-check of the same server's logs found the actual attack still let Nitrado's own status query respond normally for its whole acute phase ; only individual players were being flooded off. The existing outage alert (v0.18.197) couldn't have caught that. Server Monitoring now also watches for several different players losing their connection within seconds of each other (calibrated against the real incident's own timing), and posts its own immediate alert, pinged the same way, independent of whether Nitrado itself ever goes unreachable.
• The Server Monitoring dashboard page now shows this signal's live status too, next to the existing outage-streak progress.

v0.18.200Fix: Military Convoy map events were actually mislabeled airdrop supply crates

• Found via a real log audit for Baked Beanz: the dynamic-event classifier's fallback for "_DE"-suffixed classnames (meant for real Abandoned_* convoy wreckage) was also catching StaticAirplaneCrate's own supply-box loot children (StaticObj_Misc_SupplyBox1/2/3_DE), which happen to carry the same suffix. Every Military Convoy event this server had ever logged (949 of them) was actually an airdrop crate. Now correctly classified as airdrop instead.

v0.18.199New: Server Monitoring dashboard page, and DDoS detection + Player Activity Map are now flagship features

• Server Monitoring (/server-monitor) now has a real dashboard page too, not just Discord commands: live A2S status with a one-click 'Check Now', the direct host/port config form, the shared alert channel, live Nitrado-outage streak progress toward the alert threshold, and who the outage alert will actually @-ping (or a warning if nobody's configured yet).
• The Player Activity Map and this new Server Monitoring page are now showcased as flagship capabilities on the public /features page, alongside Event Map, Store & Economy, and Global Watchlist ; both back real, actively-used detection work, not just backend plumbing nobody sees.

v0.18.198Fix: Event Map (and constellation cards sitewide) still stuttering on mobile

• Found the same bug (v0.18.196's mobile background fix) in two more places: the Event Map's own pan/zoom recompute, and the animated constellation cards used on /features, quests, and player profile pages. Both ran their full resize logic on EVERY 'resize' event, completely undebounced ; mobile browsers fire that repeatedly as the address bar collapses/expands during ordinary scrolling, so the map kept re-centering and every constellation card kept reallocating its canvas several times per scroll. Both are now debounced to settle once, ~200ms after a resize actually finishes.

v0.18.197New: fast, DDoS-aware Nitrado outage alerts that actually ping admins and the dev channel

• The Nitrado outage alert (v0.18.190) now fires in ~3 minutes instead of ~10, and both the per-guild alert and the dev error-channel alert now actually @-mention people (the guild's configured bot-admin/mod roles, and the bot's own developer(s)) instead of posting a silent embed nobody gets notified about.
• New: when a Nitrado outage is detected, the bot now also checks whether the game server's own hostname (from /server-monitor or the configured FTP host) is resolving in DNS. If it's failing too, the alert calls that out explicitly as matching a real DDoS pattern (not just a routine Nitrado hiccup) ; grounded directly in a real incident against a customer's game server that showed exactly this combination.

v0.18.196New: two-finger pinch-to-zoom on the Event Map ; fixed the sitewide background glitching on mobile

• The Event Map now supports real two-finger pinch-to-zoom (and pinch+drag together) on touch devices, matching how a mobile map app is expected to work. Previously the map only ever tracked one pointer at a time, so a second finger touching down mid-drag just silently hijacked the pan instead of starting a pinch.
• Fixed a real bug behind reported "glitchy, laggy... snappy and choppy" background animation on mobile: the sitewide starfield/constellation and code-rain backgrounds fully re-randomized every particle/column and reallocated their canvas on EVERY resize event, completely undebounced ; mobile browsers fire resize repeatedly as the address bar collapses/expands during normal scrolling, so the whole background was discontinuously snapping to a new random layout several times per scroll. Now only does that on a genuine resize (width actually changing) ; an address-bar toggle just resyncs the canvas height in place.

v0.18.195Fix: Player Activity Map blip colors, click-to-pin player info, and a double-polling slowdown

• Player blips are now GUARANTEED distinct colors while simultaneously on screen (up to 20 concurrent players), not just a per-gamertag hash that could coincidentally collide two real names onto the same shade every time. Colors are allocated from the palette live, freed back to the pool once a player ages out of the window, and fall back to the old hash-based color only past real 20-player concurrent capacity.
• Player blips are now clickable: click one for a real detail panel (recent activity, any active "potential cheating" flags for that player, and a link to their full public profile), pinned open the same way Events-mode blips already work (click elsewhere or Escape to close). Previously a blip only showed a one-line tooltip on hover, with no click interaction at all.
• Fixed a real bug found while building the above: the new "potential cheating" overlay layer (v0.18.194) was missing pointer-events:none on itself, so its full-map-sized invisible bounding box silently blocked clicks on player blips underneath it anywhere on the map, not just where a flag actually renders.
• Fixed a real performance issue (reported: "the whole map page feels slow/laggy"): Players mode's ~20s poll used to start once and never stop, running forever in the background even after switching back to Events mode, on top of Events mode's own poll loop which also never paused; once a session had ever visited Players mode, both loops ran concurrently for the rest of the page's life. Players-mode polling now starts/stops with the mode switch.

v0.18.194New: Player Activity Map anti-cheat overlay ; 3 new /detect detectors (Phase C)

• Players mode on the Event Map now has a "Potential Cheating" overlay: a distinct pulsing marker for any /detect alert (all 10 types) within the selected time window, with a show/hide toggle and an honest hover tooltip (what triggered it, plus the same disclaimer text /detect's own embeds already show). Alerts get their own retention tier, isolated from Events mode exactly like position/connect/disconnect already are.
• 3 new /detect behavior-detection alert types: Fire Rate (the same attacker landing hits/kills against several different players within a few seconds), Headshots (repeated long-range headshot kills by the same killer), and Teleport/Speedhack (implied speed between two position readings far beyond even a real vehicle). All 10 detectors (7 existing + 3 new) now route to the map for the first time ; previously none of them did. Configurable via /detect config and the dashboard, same as every other detector.

v0.18.193New: Player Activity Map now shows ghost trails and vehicle detection (Phase B)

• Players mode on the Event Map now draws a fading ghost trail behind each player, connecting their recent position/kill/hit history, and flags a blip with a distinct shape + vehicle icon when their implied speed between two samples lands in a real vehicle's range (~30-150 km/h, using DayZ's verified ~24 km/h max sprint as the floor). Everything is computed client-side from data Players mode already receives ; no new server requests. Anti-cheat overlays (Phase C) are next.

v0.18.192New: Player Activity Map, a Players mode on the Event Map (Phase A)

• The Event Map dashboard page now has a mode toggle at the top: Events (unchanged, today's exact experience) and Players (new). Players mode shows a colored blip per active player, position updates plus kills/deaths/hits, its own time windows (5m/10m/30m/2h/4h/6h), a live per-player legend, and hover tooltips with real event detail. Same page, same URL, same permission as Events mode ; nothing about Events mode changed. Trails, vehicle detection, and anti-cheat overlays are planned for later phases.

v0.18.191New: Nitrado outage alerts also reach the dev error channel, not just per-guild

• The new sustained-Nitrado-outage alert (v0.18.190) only reached a guild that had already configured its own uptime-alert channel ; most hadn't, so a real, hours-long outage produced no notification anywhere until directly reported. Now also posts to /dev error-channel (the same bot-wide channel already used for repeated process errors), naming which guild/server is affected, so an outage for ANY guild surfaces centrally regardless of that guild's own setup.

v0.18.190Fix: player online status could get stuck after a real disconnect ; added a live Nitrado outage alert

• CRITICAL: a player who genuinely disconnected could still show up in /player online (and the dashboard) forever afterward, if any other event type for them (a hit, kill, teleport, chat line, or build action) happened moments earlier in the same log but sorted AFTER their disconnect in the parser's own internal processing order. The event parser was never actually chronological, just grouped by event type ; now sorted by real time before anything reads it.
• HIGH: a sustained Nitrado API outage (every request failing) for a guild produced no active notification anywhere, only a passive dashboard warning nobody would see unless they happened to open that exact page. Now posts a real alert to the server's uptime-alert channel (same one /server-monitor channel sets) the moment a sustained outage is detected, and a recovery alert the moment it clears.

v0.18.189Fix: 7 bugs from a full audit sweep, including 3 CRITICAL

• CRITICAL: /dz-store buy/pay/setlocation let any player act on ANOTHER player's Cash balance or saved spawn location by simply typing their gamertag in the optional gamertag option ; no ownership check existed. Now checks the caller's own linked gamertags first, falling back to requiring mod permission for anyone acting on someone else's identity.
• CRITICAL: /dz-kick, /tempban, and the dashboard's Fine tool all resolved WHO gets punished from the gamertag option, but checked protection status against a separate, unrelated user option ; a moderator could punish a protected Administrator's real gamertag while the check passed against an unrelated bystander. Now checked against whoever the gamertag actually belongs to.
• CRITICAL: every PvP/infected/animal kill was silently double-counting the victim's death stat. DayZ logs a closing summary line after EVERY death, including a real kill, and the parser was counting that closing line as a second, separate death.
• HIGH: /casino blackjack could pay out the same hand twice if a button click landed right at the same moment the table's own 60-second timeout fired.
• HIGH: two /tempban start calls issued for the same player around the same time (two mods, or Discord+dashboard) could create two separate active bans instead of one ; when the shorter one expired, it silently freed the player even though a longer ban was meant to still be active.
• HIGH: a killer/attacker Steam name containing parentheses (clan tags/region markers are common) was getting silently cut off in kill feeds, hit feeds, and reward payouts.
• HIGH: /achievements me and /achievements dayz permanently skipped a role reward if anyone viewed the achievement before the automatic sweep caught the unlock a few seconds later.

v0.18.188Fix: /dz-kick can now be used with just a gamertag

• /dz-kick required a Discord user, with no way to kick a player who was never in this Discord at all, or whose Discord account was never linked. user is now optional ; a gamertag alone is enough. A protected Administrator's DayZ character still can't be kicked this way if their gamertag is linked to their Discord account, same protection as before, just checked in reverse when no user is given directly.

v0.18.187Fix: death feed was falsely reporting real suicides/fall damage as Dehydration

• Real bug, verified against live server logs: DayZ logs a closing 'died. Stats>' summary line after EVERY death, regardless of real cause, right after whatever specific line already exists (committed suicide, bled out). The parser was matching that summary line as a SECOND, separate death, and guessing a cause from its Water/Energy numbers, so a real suicide or fall-damage death was showing up a second time as 'Dehydration' or 'Starvation' even though nothing about it was actually dehydration-related.
• Fixed at the source: duplicate death lines for the same player/moment are now collapsed into the one real death, keeping whichever cause DayZ actually logged. When a death has no specific cause line at all, we now check for a real logged hit (e.g. fall damage) at the same moment before ever guessing, and if there's truly nothing to go on, the feed now says so honestly ('Cause unclear') instead of asserting a specific cause that was never actually verified.

v0.18.186Update: background grid now has scattered circuit-trace detail

• Added a handful of small right-angle trace lines with via-dots to the sitewide grid, sparse and static, with the earlier glow-pulse points repositioned to sit exactly on a couple of them so it reads as a couple of powered trace endpoints on an etched circuit board, not just floating glow blobs.

v0.18.185New: /dashboard command

• A quick way to get to the web dashboard: /dashboard replies (privately) with a link straight to your server list, no need to remember or dig up the URL.

v0.18.184Update: sitewide background grid now has a subtle animated circuit glow

• The terrain grid behind every page now has a couple of soft, slow-pulsing glow points sitting at real grid intersections, on top of a slightly brighter base grid; a small circuit-board-style detail pass, kept deliberately subtle so it never competes with real page content.

v0.18.183Fix: homepage/guild-picker background no longer snaps when the mouse leaves

• The homepage and guild-picker's 3D constellation background used to jump straight back to its resting rotation the instant the cursor left the hero area, a visible, chopped-looking snap. It now keeps spinning in the direction (and at roughly the speed) the cursor was moving when it left, decaying smoothly to a stop instead of cutting instantly.

v0.18.182Update: sitewide background dimmed and re-themed around stars

• The sitewide scrolling code background was loud enough to compete with real page content for attention (most visible on pages without their own bespoke look, like /features, /docs, /changelog); dimmed and spaced out so it reads as ambient texture instead of a wall of text.
• The sitewide constellation field's stars are now pale starlight white (with a gentle twinkle) instead of brand green, so it reads as a night sky behind every page, while the connecting lines stay green as this site's own thread through it.

v0.18.181Fix: /bench page rendered at roughly double width on mobile

• The /bench page's code snippet grid had no width constraint on its grid items, so a long unwrapped code line stretched the entire page (and everything in it) to fit instead of scrolling horizontally within its own code block; the whole page rendered at ~2x the phone's actual width. Fixed.

v0.18.180Fix: busy connect/disconnect (and other) feed cycles no longer drop players

• A poll cycle with more connects, disconnects, kills, etc. than fit in one Discord embed (a hard 25-field limit) used to show the first few and silently drop the rest, with only a small 'Showing 3 of 5' footer note; the dropped players had no name, PSN, or location shown anywhere, not truncated info. Fixed to spill into as many messages as it takes so every event in the cycle gets shown.

v0.18.179New: an Official Partners page, first partner is Baked Beanz

• New /partners page: BenchBot's official-partner showcase, its own warm ember/campfire visual identity and a continuous rising-embers animation distinct from every other page on the site. First (and for now, only) partner is Baked Beanz (Baked Beans™ Roleplay, PS5), with a live member/online count pulled straight from Discord's own invite API.
• Removed the OMG-Its-Dan21/OMG Projects credit and link from the homepage, /about, and /expedition; no longer affiliated.

v0.18.178Fix: intermittent "database is locked" errors mirroring economy data to SQLite

• Added a busy-timeout to the SQLite economy mirror so a writer that finds the database momentarily locked retries for a few seconds instead of failing immediately. These failures never touched real player data (the JSON files stay authoritative and the mirror write is best-effort), just noisy error logs; this should make them stop happening.

v0.18.177Update: /bench page now explains its own code and backs up the hype

• Every real code snippet on /bench now has a short explanation of what's actually happening in it, not just the highlighted source. Added a standout callout on the single most impressive fact: self-hosted codegen is verified for real by transpiling to Rust, invoking rustc on it, and running the result, every time the test suite runs.

v0.18.176New: a Bench (.b) language showcase page

• Bench (.b files, also called .bench), a real from-scratch programming language, now has its own page at /bench: real syntax-highlighted code copied straight from its own repo (control flow, generics, traits, real OS-thread concurrency, and its own self-hosted lexer written in Bench itself), verified stats, and a continuous animated circuit-board background instead of a one-time intro. A genuinely separate visual identity from both BenchBot's own pages and /argus.

v0.18.175Update: /argus page now covers encryption and threat-intel scope

• The /argus page now specifically names its AES-256 encryption (SQLCipher) and adds a real stat and explanation for its threat-intel sources (4 independent feeds covering scam domains, malicious netblocks, and known-bad IPs, shared across every server it protects). Deliberately does not claim cross-server user surveillance: that's a real, separate, and still-unbuilt feature, not something this page should suggest already exists.

v0.18.174New: an Argus teaser page

• Argus (a separate, standalone Discord security bot, still in active development) now has its own page on the site at /argus: its real detection capabilities, verified stats pulled straight from its own repo, and a boot-up animation built in Argus's own established visual identity. Clearly marked in development, not yet installable.

v0.18.173Fix: 4 places that could get permanently stuck once a guild moves to a new bot

• Found via the same live migration testing as the race fix above: the leaderboard channel, the live-players heatmap channel, giveaway endings, and the global banlist review queue all keep one message alive by editing it in place every cycle, and Discord flatly refuses to let one bot edit a message a different bot posted. Once a guild's data moves to a new bot process, all four would fail silently every single cycle forever, and a still-open giveaway would never announce its winners at all. Each one now reposts a fresh message under its own identity the first time it hits this, instead of getting stuck.

v0.18.172Fix: closed a live race between the two bot processes on a freshly-invited guild

• Found live, minutes after the .bOne bot's very first real invite: an already-running bot process has no way to learn a guild it thought it owned just got claimed by the other one, since that claim only ever updates the claiming process's own memory. Both processes ended up independently polling the same DayZ server logs for several minutes with separately-diverging read positions, heading toward duplicate kill-feed messages and duplicate cash payouts before it was caught and stopped. Every bot process now rechecks who owns each guild every 30 seconds, closing the gap down from indefinite to a single short window.

v0.18.171Infra: closed a gap in the multi-bot-process safety net (v0.18.170)

• Found live while actually standing up a second bot process for the first time: on-boot re-encryption resave (turns on automatically whenever DATA_ENCRYPTION_KEY is set) blanket-resaved every shared guild regardless of which bot process owned it, unlike every other background sweep. A second process restarting could have silently overwritten another guild's more-recent write with its own stale copy. It now respects the same per-guild ownership every sweep already does.

v0.18.170Infra: prep work for a second bot process sharing this same data

• No visible change for any existing server. Every background sweep (temp-bans, zone/base-ping bans, kicks, the online-count channel, server-uptime checks, giveaways, reminders, scheduled embeds, and the main DayZ log poller) now skips a guild whose data is marked as owned by a different bot process, and a guild is automatically marked as owned by whichever bot process is actually in it. This is the safety net that lets a second, separate bot application eventually share this same data store without either process racing the other's reads/writes for the same guild.

v0.18.169Fix: dashboard-created events could silently lose their own write

• Found via a direct audit: creating an airstrike, gas strike, vehicle spawn, or horde from the dashboard skipped a lock the same feature's Discord command already held, so a dashboard-created event could race the automatic cleanup sweep (or another concurrent create) and have its write silently overwritten, with the dashboard still reporting success. The lock now lives inside the shared function itself, so every caller (Discord and dashboard alike) is protected the same way, and no future caller can forget it.
• Also closed a smaller version of the same kind of race in ticket panel creation: two panel-creates arriving at nearly the same moment, right at the 20-panel limit, could both slip through before either had actually reserved a slot.

v0.18.168Security: closed a bounty payout exploit, plus a duplicate-ticket race

• Found via a direct audit: /bounty claim paid out to whoever ran the command, with no check at all that they were actually the killer named on the bounty. Since /bounty list shows every fulfilled bounty's id to the whole server, anyone could have claimed anyone else's reward. It now checks the claimant's own linked gamertags (/link set) against the recorded killer first, and only falls back to a staff member sorting it out manually for a killer who hasn't linked a gamertag yet.
• Filling out a ticket application's modal takes real time; two near-simultaneous submissions (a fast double-click, two tabs, or just bad timing) could both slip past the 'you already have an open ticket' check before either had actually reserved one, opening a second ticket. The check that actually reserves a ticket now happens at the one point that's guaranteed race-safe, closing that window for good.

v0.18.167Fix: the Event Map could go silent for a busy server, sometimes permanently

• Found via a real live report: a server logging loot at a genuinely high, sustained rate could grow its log faster than one poll cycle's read could drain, so it never finished catching up after a restart, not just for a few minutes, but indefinitely. The map, and everything else that waits for a server to be fully caught up, went silent for as long as that kept happening, even though the server was actively logging the whole time.
• A poll cycle can now read several chunks in a row when it's still behind, instead of just one chunk per cycle. A brief backlog still catches up in one cycle like before; a much larger one now drains in a handful of cycles instead of dozens, and a sustained-busy server no longer gets permanently stuck.

v0.18.166Polish: homepage background slowed down further (2nd pass)

• Follow-up on the previous pass: node drift, the ambient rotation, and how often new radar-ping/comet events appear are all roughly another 2-2.3x slower. The radar sweep itself was left exactly as-is.

v0.18.165Polish: homepage background constellations calmed down and spread across the whole page

• The animated background on the homepage had too much going on at once ; every rotation, drift, and sweep now runs 2.5-3.5x slower, and new radar-ping/comet events fire less often.
• The fuller effect used to fade to almost nothing right after the hero section ; it's now visibly present the whole way down the homepage, not just at the top.

v0.18.164Fix: full diagnostic sweep, 9 real bugs including 3 privilege-escalation/exploit CRITICALs

• CRITICAL: any guild member could take over a rival faction (accept a fake join request, transfer leadership to themselves) by typing that faction's public leader gamertag into /faction accept/kick/promote/transfer-leader/etc., then drain its shared Cash bank ; those actions now require your own /linked gamertag, not a typed-in one.
• CRITICAL: a mod holding only the delegable reaction-role permission (Discord command or dashboard) could map an emoji to the bot-admin/moderator role, or any Administrator-flagged role, then grant it to themselves by reacting ; both surfaces now reserve mapping a role like that to real Administrators.
• CRITICAL: /zone's auto-ban could produce two independent active bans for the same player from two hits in one poll cycle, and reversing the shorter one unbanned the player early even while the longer one was still meant to be active ; now merges to one ban per player per server, matching /baseping's already-fixed equivalent.
• HIGH: the dashboard's Event Creation page trusted a client-submitted target for Remove/Edit Count with no server-side check it was real, letting a moderator with only the narrow create-event permission point it at an arbitrary path on the server's own FTP account ; it now re-verifies against the real spawn list first.
• HIGH: /createevent's Edit Count/Remove and the automatic 15-minutes-after-restart cleanup sweep could write to the same event-spawn files at the same time with no coordination, silently dropping whichever change finished last ; both now share one lock.
• HIGH: the dashboard's Cash Zone and Autoban Zone forms accepted a 0 or negative cooldown/offense-window, which defeats the cooldown entirely (unbounded Cash farming) or permanently disables ban-tier escalation ; both now enforce the same 1-minimum floor the Discord commands already had.
• A per-server basePing/detector/cash-config field added after a server's data was already saved could stay permanently missing instead of picking up its default, on any guild running more than one DayZ server ; fixed the same way the single-server equivalent already was.
• /shop buy let players acquire /expedition-catalog items (Ammo Case, Reinforced Backpack, etc.) for free, since those use a different currency /shop's own balance check never recognized ; removed from /shop buy entirely, unaffected on /expedition buy where they belong.

v0.18.163Fix: /player online kept showing players who left hours (and several restarts) ago

• A forced server restart ends every player's connection immediately, but often never writes an explicit "disconnected" line for whoever was still in-game at that moment, unlike a normal logout. The bot had no way to tell the difference, so it kept marking those exact players online forever, through as many further restarts as it took, until each one happened to reconnect. Now a detected restart marks everyone who was online beforehand as offline right away, so /player online reflects who's actually connected instead of who was connected before the last restart nobody logged out of cleanly.

v0.18.162Fix: rare command failures under load (real ack-timing data finally came in)

• A handful of commands (this time /dz-ban) have occasionally failed instantly with Discord's "Unknown interaction" error since 2026-08-07 ; diagnostics added back then (still shown in bot.log if it happens again) finally caught it with real numbers: the bot's own code was ready in 96ms, but the actual Discord network call took 3.7 seconds and blew past Discord's hard 3-second reply deadline before it could even complete. Lowered how many event-announcement messages the bot sends at once per server, leaving real headroom below Discord's global rate limit instead of sitting right at it ; this is a mitigation based on the first real evidence caught, not a guaranteed fix.

v0.18.161Add: base ping whitelist ; let staff fight in a zone everyone else gets auto-banned in

• New per-base-ping whitelist for auto-action: exempt specific gamertags (staff, event-runners) from a base ping's auto-ban entirely, while everyone else who enters or gets a kill there still gets banned as configured. The alert notification still fires either way ; only the punitive ban is skipped for an exempt name.
• Manage it with /baseping whitelist add|remove|list, or the new "Auto-Action & Whitelist" card on the dashboard's Base Pings page, which also brings full auto-action configuration (enable, trigger type, ban tiers) to the dashboard for the first time ; it was Discord-command-only before.

v0.18.160Fix: auto-mod link allowlist had no way to manage it ; add: auto-role on gamertag link

• Fixed: the auto-mod External Links check had an allowlist field with zero way to ever add to it, so turning it on blocked every link with no exceptions, including GIFs sent through Discord's own Tenor-backed picker. New /automod links add|remove|list (Discord) and a Link Allowlist section on the dashboard's Auto-Mod page let you allow specific domains through, e.g. tenor.com or giphy.com ; a domain covers all of its subdomains too.
• Add: an admin-configurable role that's automatically granted the moment a member links a gamertag (/link set, /link admin set, or the Player Hub button). Configure it with /setup link-role, or the new "Auto-assign once a member links a gamertag" picker on the dashboard's General Settings page ; off by default.

v0.18.159Fix: 11 issues from a full diagnostic sweep across the bot and dashboard

• Fixed: removing a zone, base ping, or DayZ server and later adding a new one could silently inherit the deleted one's offense/ban history (or Event Map data), since the auto-assigned id could get reused ; every removal now cleans up its own history instead of leaving it to reattach.
• Fixed: a moderator without Administrator could re-grant themselves an achievement's role reward by editing its unlock condition instead of the role field directly ; changing the condition on a role-attached achievement now requires admin, same as changing the role itself.
• Fixed: the Server Config page showed your Nitrado API token in plain text in the edit form ; it's now a masked password field that only changes when you actually type a new one or explicitly clear it.
• Fixed: a real DayZ vehicle spawn could be misclassified against the RPT log's dynamic-event list instead of the actual known vehicle list, and vice versa.
• Fixed: a player already standing inside a base-ping zone across a routine bot restart could get flagged as a fresh "entered" the moment the bot came back online, wrongly feeding a real auto-ban offense for doing nothing.
• Fixed: a failed /restart, /stop, or /start could retry automatically and risk double-triggering the action against your live server ; those three now make a single attempt instead of silently retrying an ambiguous failure.
• Fixed: several admin confirm-and-execute dialogs (Cash wipe, close all tickets, wipe achievements, purge/purgechannels) could still complete even after a guild was deactivated mid-confirmation, same class of gap fixed for other flows last session.
• Fixed: the Embed Builder's multi-step draft flow didn't re-check your permission on each step, only when it was first opened ; each step now re-verifies access, matching how other multi-step admin flows already work.
• Reliability: a single bad or unexpected event in a poll cycle could silently drop every event after it in that same batch ; each event is now processed independently, so one failure no longer takes the rest of the batch with it.
• Reliability: startup now registers commands and warms invite tracking for every server the bot is in concurrently instead of one at a time, so a bot in many Discord servers comes fully online faster after a restart.

v0.18.158Fix: quest system fully broken, plus a self-approval exploit and two data-isolation bugs

• Every quest button/select-menu click and the review modal crashed instantly (a real bug in v0.18.152-153's server-resolution code); /quests, Start Quest, Submit for Review, and Approve/Reject are all working again.
• Fixed: the Approve/Reject buttons on a quest submission had no permission check at all; anyone who could see the review message could approve their own submission for a real Cash payout. Approving/rejecting now requires the same admin/mod permission as the Quests dashboard page.
• Fixed: a guild's 2nd+ DayZ server created before the quest system shipped could silently share quest/announcement data with another server on the same guild instead of having its own. Every server now gets its own independent copy on load.
• Fixed two bugs in last session's Nitrado status cache: a different (unauthorized) token for the same server id could be served another server's cached data instead of its own ; and a slow, still-retrying request could wrongly evict a newer, valid cache entry.

v0.18.157Add: upload an image file straight from your computer in the Embed Builder

• The dashboard's Embed Builder Image and Thumbnail fields now have an Upload button next to the URL box; pick a file (PNG/JPEG/GIF/WebP, 8MB max) and it's hosted automatically, no need to find somewhere else to host it and paste a link first.

v0.18.156Add: global ranks; compare your players across every opted-in BenchBot server

• New "Global Ranks" toggle on Server Config: opt this server's players into a bot-wide rank pool, compared against every other server (any guild) that has also opted in. Off by default; your players are never compared against anyone else's until you turn it on.
• Once opted in, /myprofile pages show a Network Rank alongside the existing per-server rank, computed by kills across the whole opted-in pool.

v0.18.155Polish: player profile page background no longer a flat void

• The /myprofile page now carries the same ambient sitewide starfield every other dashboard page already has; it was skipped when the page was first built (deliberately standalone, no dashboard shell), which left the wide margins outside the content column flat and empty on anything wider than a phone.

v0.18.154Fix: Nitrado rate-limiting from redundant status polling

• Three independent recurring jobs (the main event poller, the online-count channel's mapSlug sweep, temp-ban list reads) each queried Nitrado's server-status endpoint on their own schedule with no sharing between them ; on a Nitrado service already running a tight quota, that redundant load could tip it into sustained rate-limiting, felt anywhere live data is shown (the Event Map included).
• That status call is now deduped behind a short shared cache, and automatically invalidated the moment any of those same jobs writes to the server (e.g. applying or reversing a ban): so a read right after a write always sees the fresh result, never a stale one.

v0.18.153Polish: Quests + player profile get the constellation treatment ; quest rewards simplified ; announcements now configurable

• The Quests dashboard page and the /myprofile player page now use the site's constellation visual language (seeded starfield/node art, comet included on the profile hero) instead of a plain table/dossier look: every quest gets its own unique constellation "fingerprint" glyph.
• Quest rewards simplified to just two options: DayZ currency (Cash, spendable at the Corna Store) and an optional custom note admins write for anything else (e.g. "Ghillie Suit kit; ask an admin") ; Dollars/Plates/Bullets and role rewards are no longer quest reward options.
• Quest completion announcements are now fully configurable per server; pick the channel and customize the title/description (with placeholders like {player}/{quest}/{reward}) right from the Quests dashboard page, plus a Send Test button to preview it.
• A manually-approved quest step now announces and DMs the player exactly like an auto-detected one (previously it silently skipped both).
• Completing a quest step now DMs the linked player with what's next (or their reward, if that was the last step).
• Fixed a small mobile layout overflow on the Quests dashboard page.

v0.18.152Add: full quest system; auto-detected steps, manual submission + approval, admin builder

• New /quests command lets a player view every quest on this server, start one, and see their own step-by-step progress.
• Admins build multi-step quests on a new dashboard page (guild hub > Quests); steps can be a zone to visit, a kill count, a travel distance, or a manual step (submitted by the player, approved or rejected by an admin), any mix, in any order or strictly sequential.
• Zone/kill/travel steps complete automatically off the same live event stream playerStats and Cash already read: no extra polling. A manual step's submission posts to a review channel with Approve/Reject buttons.
• Rewards (Dollars/Plates/Bullets, Cash, and/or a Discord role) pay out automatically the moment every step in a quest is done.

v0.18.151Add: /myprofile, a public player dossier page

• New /myprofile command posts a link to a real player profile page ; a public, no-login "Field Dossier" showing combat/survival stats, rank among every tracked player, both economy ledgers (Dollars/Plates/Bullets and Corna Store Cash, kept clearly separate), all 3 real achievement categories with unlock state, and a new Rivalries ledger tracking who's killed you most and who you've killed most.
• Ban/kick/fine/warning history is deliberately never shown on this page ; that stays admin-only, exactly as everywhere else in the dashboard.

v0.18.150Polish: real dashboard panel cards, not a wall of green buttons

• Every one of the 35+ hub panel cards (Auto-Mod, Zones, Event Map, etc.) now has a real title with a category icon instead of a solid green pill button ; the whole card is now the click target (previously only the small button text was, despite the whole card lifting on hover), with a hover arrow to signal it.
• Card backgrounds are a touch more opaque so the animated background text reads less distracting behind titles and descriptions.

v0.18.149Polish: Event Map search raises matches out of clusters instead of jumping to them

• Searching no longer pans/zooms the view ; instead every matching blip is pulled out of clustering entirely and rendered bigger with a glowing ring, so results are easy to spot right where they already are without the map yanking around under you.
• A tight group of matches that would normally collapse into one cluster badge now shows every one of them individually.

v0.18.148Add: search bar on the Event Map

• The Event Map's control panel has a new Search box at the top ; type an item, vehicle classname, category, or player name and matching contacts filter live, everything else dims out of the cluster/blip view.
• A live match count shows under the search box, with an 'Enter to jump' hint ; pressing Enter pans and zooms to whichever match sits closest to your current view.
• Search combines with the existing category checkboxes ; a category you've toggled off stays off even if it would otherwise match.

v0.18.147Polish: slower, steadier Constellation Charts

• The flagship cards and the homepage's own particle-field hero now tumble noticeably slower ; a calmer, more ambient drift instead of a fast visible spin.
• Every card's constellation now fills a consistent amount of the visual area regardless of its random viewing angle ; previously an unlucky angle could compress a shape into a small, sparser-looking corner of the card even though the underlying cluster was just as rich as any other card's.

v0.18.146Polish: Constellation Charts get much denser, glowier fields

• Every card's constellation now has roughly double the nodes and connections, a much denser scattering of background dust, and a real soft glow/bloom behind the brightest stars ; a busier, richer starfield across both the flagship and standard cards.
• Same green/amber/rust palette and calm-grid behavior throughout ; a pure visual density pass, no behavior changes.

v0.18.145Add: real 3D depth for the constellation effects (cards + homepage)

• Every card's constellation and the homepage's own particle-field hero are now genuine rotating 3D point clouds (real perspective, nodes properly sized/layered by actual distance) instead of flat dots with a fake size trick ; the flagship cards and homepage hero visibly tumble in place, the homepage also tilts toward your cursor.
• The ~37 standard feature cards get the same real 3D perspective computed once per card (a fixed, per-card viewing angle) rather than continuous animation, keeping that grid calm and fast to scan.
• The sitewide particle-field background behind every other dashboard page is untouched ; this only reaches the homepage hero and the feature cards.

v0.18.144Polish: Constellation Charts get sparkle glints, dashed links, and a denser starfield

• Every card's constellation now has a couple of bright sparkle-glint stars, dashed (not solid) connecting lines, and a real scattering of tiny background dust points behind the main shape ; a denser, more starfield-like look on both the flagship and standard cards.
• Still the site's own green/amber/rust palette throughout, nothing new to configure ; a pure visual polish pass, no behavior changes.

v0.18.143Add: Event Map tooltips now show event times in your own local time

• Hovering an Event Map blip used to only show the raw time straight from the DayZ server's own log ; that clock's timezone is whatever the game server itself happens to be set to, not yours.
• The tooltip now shows the time your own browser thinks it is (plus a plain-language "3h ago"), with the original server-log time kept right underneath for anyone cross-referencing the DayZ server's own logs directly.

v0.18.142Redo: the tactical-HUD flagship cards had a real bug and got replaced entirely with "Constellation Charts"

• The v0.18.141 HUD redesign had a genuine rendering bug (its rotating border occasionally tore outside the card's rounded corners) and, on a closer look, every card in a category still shared one identical giant icon ; both are fixed by a full redesign instead of a patch.
• Every one of the ~37 standard feature cards, and all 4 flagship cards, now shows its own small constellation ; glowing nodes connected by faint lines, generated uniquely per feature so no two cards in a category look alike anymore, plus a small grid-reference/status readout underneath.
• The 4 flagship cards additionally animate live (gentle drift, an occasional signal pulse, and a real comet crossing reserved for the hero card only) ; the standard grid stays fully static so scanning 37 cards at once stays calm, with just a small hover-only pulse per card.
• Also fixed a rare, unrelated pre-existing bug in the sitewide particle-field background found while live-testing this: a radar ping could occasionally compute a negative radius and throw, found and fixed with a one-line clamp.

v0.18.141Redesign: the flagship Features cards get a whole new tactical HUD treatment

• The 4 flagship spotlight cards on /features dropped the glowing-orb-with-spinning-rings look for something genuinely different ; a rotating energy-frame border around the whole card, a radar-style scanline sweep, a 4-corner targeting-lock reticle around the icon, a small scanning signal indicator, and a beveled nameplate with a double rule and flanking chevrons.
• The full 36-feature grid below it is untouched ; still the calmer glow/ring showcase treatment, so the true flagship cards keep standing out.

v0.18.140Add: full Ticket Panels dashboard overhaul + a new Application intake-form mode

• New Ticket Panels dashboard page ; create, edit, and delete as many ticket panels as you want (up to 20), each with its own custom title, description, categories, and channel, with a live mock-embed preview showing exactly what it'll look like in Discord before you post it.
• New Application mode, toggled per-panel ; clicking the button pops up a real Discord form (up to 5 configurable questions) instead of going straight to a blank chat, then the submitted answers post as the ticket's opening message and it behaves like a normal ticket (chat, claim, close) from there.
• Open Tickets and a ticket's own detail page now both show whether it came from a Ticket or Application panel, with the submitted Q&A visible right on the ticket detail page.

v0.18.139Add: the full Features list gets the animated showcase treatment too, with a flashier flagship tier for real contrast

• All 36 features (not just the 4 flagship picks) now get the animated icon showcase treatment instead of a plain icon badge ; every one of them gets a real glowing, tone-colored icon composition now.
• To keep the true flagship cards standing out above that, they got noticeably flashier: a 3rd ring, 6 light particles instead of 4, a permanent glow at rest (not just on hover), and a real diagonal light-sweep across the card.

v0.18.138Add: a real masonry showcase, custom animated icons, and a proper Docs landing page

• The homepage's Explore section, the Features spotlight, and a brand-new /docs landing page all now use a real editorial masonry layout ; asymmetric card sizes, a big animated icon centerpiece per tile (a glowing orb, two counter-rotating rings, and drifting light particles around the real feature icon), and a caption underneath, instead of a plain uniform grid.
• /docs used to just bounce straight to the setup guide ; it's now a real landing page with its own showcase grid, one tile for Get Started and one for each of the 7 command categories, so there's an actual "pick where to start" moment before the dense reference content.

v0.18.137Polish: Features and Reviews get a real showroom-grade spotlight treatment

• Pushed the Features spotlight much further: the lead capability now gets a genuinely dramatic full-width reveal ; glowing border, ambient light behind it, a huge glowing title, and a big glowing icon, with a slow cinematic rise into view instead of a quick fade.
• The featured review on Reviews (and the homepage) gets the same treatment: a glowing avatar, a glowing oversized quote mark, a glowing title, and the same dramatic reveal ; every other card keeps its hover glow, just calmer, so the one true spotlight moment actually reads as one.

v0.18.136Polish: Features and Reviews now read like a real showcase, not a table

• Features had 36 identical plain boxes in a row ; it now leads with a large spotlight for a few standout capabilities (Event Map, Store & Economy, the Global Watchlist, Custom Achievements), every card gets a real colored icon badge instead of a tiny outline glyph, and each category header gets a real number.
• Reviews now shows a decorative quote mark and a real initial avatar per reviewer, and cards size to their own content instead of stretching to match their row ; it reads like a wall of testimonials now, not a spreadsheet.

v0.18.135Add: 5 new public pages ; Features, Docs, Changelog, and Reviews, plus a deeper homepage

• The public site was really just one page (this homepage) plus /legal. It now has real Features, Docs, Changelog, and Reviews pages, each pulling from content that already existed but was locked behind Discord: the same 36 dashboard capabilities, the same step-by-step setup guide and full command reference, and this same changelog you're reading right now, going all the way back to day one.
• The homepage itself got real cards for every review instead of a cramped scroll box, a third live stat (commands run in the last 30 days), and a new "Explore more" section tying the whole site together.
• Card grids across the site now reveal in with a per-card cascade instead of popping in all at once, and page-to-page navigation gets a real cross-fade on browsers that support it.

v0.18.134Mobile: every remaining dashboard table now stacks into readable cards on a phone; the mobile table pass is complete

• Finished what the last two updates started: every dashboard page with a data table (27 more since last time; Store & Economy, Server Config, Factions, Zones, Base Pings, Teleporters, Custom Achievements, the Guild Manager, and the rest) now collapses into labeled stacked cards on a phone instead of forcing sideways scrolling. All 32 table-bearing dashboard pages are covered.
• Purely a mobile layout change; desktop keeps the exact same table view it always had, nothing about how any of these pages work changed.

v0.18.133Mobile: the Watchlist, Tickets, and Punishments tables now stack into readable cards on a phone instead of forcing sideways scrolling

• Continuing the mobile pass: the Global Watchlist, open Tickets list, and Player Punishments pages (both the active ban list and the merged history table) had dense multi-column tables that only worked by scrolling sideways on a phone. They now collapse into a stacked card per row on small screens, each field labeled, with the desktop table view unchanged.
• More dashboard pages with tables still need this same treatment: this covers the highest-traffic ones first.

v0.18.132Mobile: dashboard pages get real breathing room, and the Event Map console no longer eats the whole screen

• First pass of a real mobile pass across the dashboard (more to come); tightened padding/spacing on every page so a phone screen isn't mostly whitespace, and card grids now genuinely stack instead of just squeezing.
• The Event Map's control panel was a fixed-width sidebar that covered most of a phone screen, leaving barely any room to see the map underneath it. It now collapses to just its header bar by default on mobile, tap it to expand the full controls, so the map itself is what you actually see first.

v0.18.131Fix: severe backlog-catchup bug; hours of history could get replayed as if it just happened, after any restart with a real gap

• Found and fixed the actual root cause of the Event Map's impossible loot numbers (a user's own words: "there's no way that 8000 items spawned in 2 hours"), and it went deeper than the map. Since last night's log-reading speed fix, catching up on a real backlog after a restart could take several read cycles on a busy server, but the bot only protected the very first cycle from being treated as live; every cycle after that got dumped into the map, kill/death feeds, achievements, and cash payouts as if it had just happened, timestamped with the moment it was processed instead of when it actually occurred.
• Both gaps are closed: the bot now correctly stays in catch-up mode for as many cycles as a real backlog actually takes to drain, and the live map buffer itself no longer accepts backlog-era events at all (previously only the permanent database copy was protected, not the live view).

v0.18.130Polish: homepage visual pass; real depth on the "why this exists" story, a bigger pull-quote moment, and more breathing room

• The homepage story section had no card behind it at all; long-form text sitting directly on the busy animated background. It now gets the same elevated-panel treatment as everything else on the page, and the pull-quote moment is bigger and glows.
• The page itself is noticeably wider on desktop now, so the credits and feature cards actually use the screen instead of staying pinned to a narrow single column; Special Thanks now lays out as a real grid instead of one card per row.
• The two hero stat numbers (communities/servers protected) were hard to read against the busiest part of the background; solid background now, no more blending in.

v0.18.129Fix: Event Map time-window buttons were never actually showing different loot history, plus a real fix for the earlier clustering bug

• Root-caused why every time-window button (2H through 24H) could show the exact same loot count: the buttons were only ever filtering a small, fast in-memory buffer that was never sized to hold real day-long history in the first place. The map now queries the real stored history for whichever window you pick, so 24H actually means 24 real hours.
• This safely reintroduces deeper loot history without bringing back the earlier "one giant cluster swallowing everything" bug: this time, clusters have a hard cap on how far they can visually spread, so heavy local activity still consolidates into one marker, but nothing can ever chain across the whole map into a single dominating blob again.

v0.18.128Add: real ack-timing diagnostics for the unexplained rare command-failure pattern

• A handful of commands (seen on /player online, /link, /basedamage, /dev error-channel) have occasionally failed with no identifiable slow code to explain it, unlike every other case fixed tonight. Every command's acknowledgment call is now timed centrally: if this happens again, the logs will show real numbers (how long our own code took vs. how long the actual Discord round-trip took) instead of needing another manual audit.

v0.18.127Add: multi-panel ticket support; post several independent "Open a Ticket" panels, each with its own text and categories

• New: /ticket panel-create, panel-list, panel-edit, panel-delete. A server can now post multiple ticket panels in different channels; e.g. a general-support panel in #help offering every category, and a focused player-reports panel in #reports offering just "Player Report"/"Ban Appeal"; each with its own custom embed title and description.
• The original /ticket panel and /ticket quicksetup are completely unchanged; that panel and every one already posted in the wild keeps working exactly as before ; this is purely additive.

v0.18.126Fix: 3 more silent-failure commands found by a post-incident audit (/setup bot-admin-role, mod-role, bot-trap, /channel create)

• Ran a full audit for the same "command silently fails under load" bug fixed for 12 other commands earlier tonight, specifically to catch anything that could still fail the same way. Found and fixed 3 more: /setup bot-admin-role and /setup mod-role (when creating the role automatically instead of picking an existing one) and /setup bot-trap could all hit the same 3-second Discord acknowledgment window if the server was busy ; /channel create had the identical gap. All four now acknowledge immediately and do their work after, closing the window for good.
• Also confirmed via the same audit: no other part of the app has a similar unbounded-clustering risk to the loot map issue, deploy is byte-for-byte identical between this codebase and the live server, and the error-alert channel is genuinely wired and active.

v0.18.125Revert: Event Map loot retention/clustering change (v0.18.124), made map clutter worse, not better

• Reverted last night's loot retention raise + separate loot clustering pass. In practice, once loot's retention was raised to 4000 events, the wider loot-only clustering radius chained almost every loot spawn on the map into one dominating cluster (a single marker showing a count in the thousands) instead of separate readable hotspots: confirmed live, visibly worse than the original overpopulation complaint it was meant to fix. Loot is back to its previous retention window and clusters the same way every other event type does. A real fix for loot's map density still needs to be found; this just undoes a change that made things worse in the meantime.

v0.18.123Add: a new dynamic event type (Airdrop), full parser audit, and a real "any error, any guild" dev alert channel

• Added a genuinely missing event type: Airdrop (StaticAirplaneCrate) spawns were being silently ignored on every server; the log line was already recognized, it just had no category to route into. Now shows up on the Event Map and can get its own feed channel like Heli Crash, Convoy, Police Situation, etc.
• Ran a full audit of the log parsers against real production data from every active server: confirmed nothing else is being silently dropped beyond what was already fixed tonight.
• Extended /dev error-channel: it used to only alert on a full process crash (rare) ; it now alerts on repeated errors from ANY command, in ANY guild, the exact category of bug found and fixed tonight, while still collapsing a burst into one alert instead of spamming one message per error.

v0.18.122Fix: Event Map missing loot (and some other RPT-sourced events) during specific overnight hours

• Found and fixed the real cause of a reported "the Event Map shows no loot" incident: the log reader required a strictly two-digit hour ("04:08:56") on every timestamp it read from a server's RPT log, but real RPT logs write single-digit hours space-padded instead (" 4:08:56", not "04:08:56"); so every loot spawn, cleanup, and a few other event types logged between 12am and 9:59am were silently skipped, every single day, for as long as this parser has existed. Fixed and covered by new tests built from the actual real log format. Player kills, hits, chat, and other admin-log (ADM) events were never affected; only the separate RPT log stream had this timestamp quirk.

v0.18.121Fix: several commands could silently fail under load (already-acknowledged / interaction expired errors)

• Found and fixed a real production incident: /player online, /link, /basedamage, /warn, /dz-kick, /tempban, /online-count setup, /ticket panel, /reactionrole (create/addrole/removerole), /suggest, /suggestion resolve, and /giveaway start could all silently fail (the member sees a generic "Something Went Wrong" DM, or nothing at all) when the bot took more than 3 seconds to respond; Discord's hard limit for the first acknowledgment. Every one of these now acknowledges the command immediately and does its actual work afterward, closing that window for good.

v0.18.120Fix: feeds falling behind; the log reader was re-downloading the entire (ever-growing) log file every 30 seconds

• Found and fixed the real cause of slow/delayed feed channels: reading a server's log for new events was re-downloading the ENTIRE file every 30-second cycle, forever, for as long as that server stayed up without restarting; one real log had grown past 33MB. A single oversized download like that could stall EVERY server's feeds fleet-wide for up to a minute and a half at a time. Now reads only the new bytes since the last check, every cycle, regardless of how large the file has grown.

v0.18.119Fix: cluster popup wheel-scroll fought the map, plus a website copy cleanup

• Fixed: scrolling inside a busy Event Map cluster's category breakdown popup (the "17 Events" list) zoomed the map underneath instead of scrolling the list; the popup's list is now its own independent scroll area.
• Cleaned up punctuation across the dashboard/website's visible text (error messages, page copy, table placeholders) for consistency.

v0.18.118Fix: 3 real reported bugs; a silent restart-detection outage, an FTP setup permission gate, and a map label overlap

• Found and fixed a real production incident while chasing a "restart detection isn't working" report: two servers' Nitrado connections had been failing on literally every single check for over a week straight, completely silently; nothing ever errored loudly because a failed connection looked identical to "this server just has no logs yet." The dashboard's Server Config page now shows a clear warning once a server's connection has been down for a sustained stretch, instead of this requiring a manual dig through raw logs to ever notice.
• Fixed: /rotation setup-ftp could be opened by a moderator granted the delegable 'rotation' permission, but silently rejected the save itself (full Administrator only); so filling in and submitting FTP credentials appeared to do nothing, with no clear explanation why. Now blocked with a clear message the moment the command is run, before typing anything in.
• Fixed: on a busy stretch of the Event Map, a town name label could render directly under a cluster count badge, making both hard to read. Labels now yield to a nearby event marker instead of overlapping it.

v0.18.117Add: full dashboard visual rework; depth, icons, and a living background on every page

• Every dashboard page (35+ of them, not just a handful) now has real card depth, hover glow, and a category icon next to its title, instead of flat bordered panels.
• The main Guild Hub is now grouped into 6 labeled categories (Moderation, Economy, Events, Community, Server Config, Support) instead of one long unlabeled wall of identical buttons.
• The homepage and post-login server picker got a new animated background, glowing connected nodes, a radar sweep, and the occasional comet streak, with real proof numbers (communities/servers running the bot) instead of a static logo.
• A quieter version of that same background now runs on every other page too, so the whole site feels alive, not just the front door.
• Security fix: the Event Map's live data feed could let an attacker-controlled in-game player/weapon/reason name break out of its data block and run script in an admin's dashboard session; found during this pass, unrelated to anything above, now closed.
• Fixed along the way: a scroll-reveal animation that was silently doing nothing on a few pages, a couple of buttons that had lost their keyboard-focus styling, a corner decoration rendering in the wrong spot, and animated backgrounds going blank after a window resize for anyone with reduced-motion turned on.

v0.18.116Add: dashboard visual overhaul; real toggle switches, danger actions, tags, and animation across the site

• Real toggle switches (Casino chip economy, Account Links mode) instead of a button whose label just changed text.
• Destructive actions (Disband, Remove Member, Unlink) are now clearly marked in red with a confirmation prompt before they go through; Factions and Account Links specifically.
• Tickets' priority column is now color-coded at a glance, and Close All sits inside a clearly-marked warning panel.
• Member/pending gamertag lists render as individual tags instead of a run-on comma-separated line.
• Every dashboard page now has a subtle entrance animation on load, and the Automod/Logins tables collapse into readable stacked cards on a phone instead of requiring sideways scrolling.
• First wave of a larger overhaul; more pages get this treatment over time.

v0.18.115Add: All / None / "only" buttons for the Event Map contact filters

• Real reported gap: filtering the map down to a specific event type meant clicking 16 checkboxes off one at a time. "All" and "None" now clear or restore every filter in one click, and each row has its own "only" button to instantly isolate just that one.

v0.18.114Add: cluster breakdown on the Event Map now shows exactly what spawned, not just the category

• Real reported gap: a cluster popup showing "Loot Spawn: 2" gave zero indication of what actually spawned. It now lists the real item/vehicle names under each category (e.g. two different loot types shown separately, not lumped together); same for construction items and anything else with a specific identity behind the category.
• Categories with nothing more specific to show (Kill, PvP Hit, etc.) are completely unchanged.

v0.18.113Add: real town names on the Event Map, hover-to-preview clusters, and an honest "Zoom In"

• Town and city names now show on the map itself, styled like Google/Apple Maps place labels; clears up automatically as you zoom in so it never looks cluttered.
• Hovering a cluster now previews its category breakdown, not just clicking: same as individual markers already worked.
• Real reported gap: for events that keep happening at (or very near) the exact same in-game spot, a fixed convoy spawn point, for example, no amount of zooming can ever visually separate them, so "Zoom In" was a dead end that looked broken. It now says so honestly instead of showing a button that does nothing, while every cluster that CAN actually be zoomed into still works exactly as before.

v0.18.112Fix: clicking a cluster on the Event Map now actually shows what's inside it

• Real reported gap: clicking a cluster marker just zoomed in with zero indication of what was actually there. Clicking one now shows exactly which event types are inside and how many of each, with a "Zoom In" button if you want the old jump-closer behavior too.
• Found and fixed along the way: that same click was occasionally getting silently swallowed by the map's own drag-to-pan handling, so the button looked like it did nothing even when it should have worked.

v0.18.111Fix: Event Map couldn't reach the map edges when zoomed in, plus a quick server switcher

• Real reported gap: zooming in near a coastal town (Elektro, Cherno, anywhere close to an edge) got visibly cut off and couldn't pan any closer; the pan limit was left over from before the map got sharper and didn't account for how much bigger the new zoomed-in view actually is. Every part of the map can now be reached at any zoom level.
• Guilds running more than one DayZ server can now jump straight between each server's map from a small switcher inside the map itself, instead of backing all the way out to the dashboard first.
• Also fixed: real map tiles were occasionally failing to load during normal zooming/panning (missing gray patches on the map); a traffic limit meant for regular page loads was too strict for how many map tiles a zoom or pan legitimately needs at once.

v0.18.110Add: Event Map now renders real map tiles instead of one blurry image, and blips are finally clickable

• Real reported gap: the map background was a single small flattened image, so it turned to mush as soon as you zoomed in past a couple of clicks; nowhere close to the Google/Apple Maps clarity this feature was always meant to have. It's now a real zoomable tile set built straight from the actual game terrain, sharp all the way down to street level, on Chernarus and Livonia (Sakhal keeps today's placeholder until its own tiles exist).
• Clicking a marker previously did nothing: only hovering showed its info card, which also meant markers were completely unusable on phones and tablets (no mouse to hover with). Tap or click a marker now and its info card stays open until you tap it again, tap elsewhere, or hit Escape.
• Marker outlines got a stronger drop shadow so they stay readable sitting on top of real, busier satellite terrain instead of the old flat placeholder.

v0.18.109Add: Event Map now shows vehicle spawns, item spawns, and teleports too, with real clustering for busy areas

• Real reported gap: vehicle respawns on most servers happen through routine economy restocking, not the "dynamic event" system the map was watching, so they never showed up even though they were definitely happening. The map now recognizes real vehicle spawns directly (Vehicle Spawn), plus general item spawns (Loot Spawn) and teleporter usage (Teleport), 17 event types total now, up from 14.
• Busy areas no longer show a wall of overlapping, indistinguishable dots; nearby events now group into a single marker with a count badge, same as Google Maps ; click it to zoom in and it splits apart into the individual events.
• Item spawns are tracked separately with a shorter retention window than everything else, since they happen far more often than kills or vehicle spawns: this keeps them from crowding out the events that matter more.

v0.18.108Fix: Event Map now tells you when a time-window switch has no more history to show instead of silently looking broken

• Right after the Event Map's history-persistence feature went live, every time window (2H through 24H) looked identical for a while since there simply wasn't more than an hour of real recorded history yet; clicking between them looked like nothing was happening. The map now shows exactly how much history is actually on file (e.g. "Only ~1H of history recorded so far") so it's clear the feature is working and just needs more real time to build up a longer history, not stuck or broken.

v0.18.107Add: Event Map goes fullscreen with a real icon for every event type; kills, vehicles, dynamic events all look distinct now

• The Event Map now takes over the whole browser window the moment you open it, instead of sitting in a small section on the page: closer to opening a real map app.
• Every event type now gets its own real icon instead of just a shape: kills get a hit-marker, deaths a skull, a heli crash looks like a helicopter, a military convoy and a police car are now clearly different vehicles, police situations get a badge, and so on; 15 distinct icons in total, shown in the updated legend.
• The zoom range now automatically adjusts to how much real detail is actually in your server's map image, instead of a fixed limit: so it'll get better on its own once a higher-resolution map image is in place, with no further changes needed.

v0.18.106Add: Event Map history now survives restarts, plus /stop, /start, whitelist on/off, and base/container damage buttons

• The Event Map's 6H/14H/24H time windows now actually hold that much history; event data is mirrored to disk, so a bot restart or deploy no longer wipes out everything the map had recorded.
• New /stop and /start Discord commands (the dashboard already had buttons for these ; now Discord has matching commands too).
• New /whitelist enable and /whitelist disable; turn Nitrado whitelist enforcement on/off directly, both from Discord and a new dashboard page, instead of needing to flip it in Nitrado's own panel manually.
• The Base Damage dashboard page now has direct Enable/Disable buttons for both base damage and container damage schedules, not just schedule editing.
• New /wipe command and a matching dashboard control for permanently resetting a server's map (admin-only, requires typing the server's exact name to confirm); built and safety-gated, but I couldn't confirm the exact file path this hosting setup uses for persistence data, so it currently refuses safely rather than risk deleting the wrong thing. Let me know if you know where that data lives and I'll finish wiring it up.

v0.18.105Fix: the bot now auto-detects your actual map from Nitrado instead of trusting a manually-set value that could silently be wrong

• Real reported bug: a 2-server guild had one server saved as Livonia in its config while it was actually running Chernarus+, so every map-dependent feature (Event Map, heatmap, /distance) showed the wrong map with nothing to catch it.
• /map, /status, and the dashboard's Server Config status check now compare your saved map setting against what the DayZ server itself is actually reporting, and auto-correct it (with a visible notice) when they disagree.
• This also now runs silently in the background every ~5 minutes for every configured server, not just ones with an online-count channel set up, so a wrong map gets caught and fixed even if nobody happens to check.

v0.18.104Fix: Event Map blips were too small/faint to read, and zoom went far past what the map images can support

• Blips are now bigger, bolder, and outlined so they're actually visible at a glance instead of reading as a faint colored fleck over a busy map; kills/deaths/hits are circles, construction is a square, dynamic events are a triangle, all with a strong dark outline.
• The hover info card is now a plain, clean card instead of a busy angular readout, and the floating control panel dropped its scanline/pulsing decorations for a calmer look.
• Max zoom lowered from 8x to 3x: the source map images are naturally low-resolution, so zooming further than that just produced an unreadable blur, not real detail.

v0.18.103Add: zoomable/pannable full-screen Event Map, selectable time range, and a full blip/tooltip visual redesign

• The Event Map dashboard page is now a real interactive map instead of a small static image: scroll to zoom (in on your cursor), click-and-drag to pan, and a fullscreen button for the whole-screen view. The map itself now spans the full width of the page instead of a narrow column.
• New selectable time range on the map, 2H / 4H / 6H / 14H / 24H, so you can see just the last couple hours of activity or zoom out to a full day, without losing your current pan/zoom position when you switch.
• Blips and the hover tooltip got a full visual redesign: each event category now has its own distinct shape (not just color) so kills, deaths, hits, construction, and dynamic events are recognizable at a glance, recent events glow brighter and fade as they age, and the info card that pops up on hover is a lot more readable.

v0.18.102Add: live Event Map on the dashboard; kills, deaths, construction, and dynamic events plotted where they happened

• New "Event Map" dashboard page (per server, gated behind its own Moderator Permission toggle like every other admin page) shows kills, deaths, PvP hits, construction, and dynamic events (heli crashes, convoys, and the rest) as color-coded dots over the server's real map. Hover a dot for who/what/where. New events appear automatically every ~20 seconds while the page is open, and each category can be filtered on/off with a checkbox. Nothing new is written to disk for this; it's the bot's own short-term memory (roughly the last 500 map-worthy events per server), so a restart clears it, same as the existing /activitylog recent command.

v0.18.101Add: player Cash balances shown as a table on the Store dashboard page

• The Store & Economy dashboard page now lists every player with a tracked Cash balance in one table (gamertag + current balance), with an Add Cash and a Remove Cash field right on each row: no more typing a gamertag from memory into a separate form and hoping it's spelled right. Giving Cash to someone not in the list yet (their very first touch of the economy) still works via a small form below the table. Setting an exact balance, giving to everyone at once, and wiping the whole ledger are unchanged, just regrouped under their own "Other Cash Tools" section.

v0.18.100Fix: 2 real production error sources found by directly auditing live logs, not code review

• Root-caused the single largest source of error-level log noise (~90% of all errors in the last 13 days): fetching a DayZ server's RPT/ADM log tail requests a one-time download link from Nitrado once, then reused that same link across every retry attempt if the download itself failed, but that link is very likely short-lived/single-use, so every retry was doomed against an already-stale link instead of actually getting a fresh shot. Now requests a brand-new download link on every attempt.
• Fixed a bug that logged a real error on every single bot restart: shutting down closed the SQLite economy mirror's connection but never marked it as unavailable, so any economy save still in flight at that exact moment tried to write to the now-closed database and failed loudly. No data was ever actually at risk (SQLite is a secondary mirror ; the real save always goes to the primary store first), but the noise is gone now.

v0.18.99Fix: a critical currency-duplication exploit + 10 more issues (Wave 4 bulletproofing audit)

• CRITICAL: the Bounty Config dashboard page had no floor on its cost fields, unlike the equivalent Discord command; an admin (deliberately or by mistake) saving a negative "cost per extra day" let any player place a bounty with a large negative total cost, which then ADDED currency to their balance instead of charging them, repeatably. Now rejects the same way Discord's command structurally always has.
• A keyword auto-response containing @everyone, @here, or a role mention actually pinged when triggered; turning the narrow "Keywords" permission (meant only for simple auto-replies) into a mass-ping tool any ordinary member could fire just by typing the trigger word. Responses can still @-mention the person who triggered them, just nothing broader.
• 5 different features, permanent bans, temp-bans, kicks, zone auto-bans, base-ping auto-bans, all write to the SAME shared Nitrado ban list with no coordination between them. Two of them landing close together (a 2nd admin, or an automatic sweep) could silently drop one write while both reported success ; the same gap existed separately for the Nitrado whitelist. All 6 write paths now coordinate through a shared lock.
• A background cleanup sweep (removing expired store purchases and temporary teleporters after a restart) wrote to the same two shared files /rotation, /dz-store, and base-damage scheduling already carefully lock against, but wasn't part of that lock itself, so it could silently corrupt either file if its timing lined up with one of them.
• /ask's 30-minute cooldown could be bypassed by firing several questions in quick succession (each one billed to the bot's Claude API) before the first had finished answering.
• A report submitted through the dashboard's Banlist page never notified the developer review channel the way the same report submitted via Discord does, so it could sit un-reviewed indefinitely with nothing surfacing it.
• Two members joining via different invite links close together could have their invite mis-attributed; crediting one inviter twice and the other not at all.
• The dashboard's keyword channel-scoping form, restart/stop server buttons, and automod timeout/threshold fields each had a validation or confirmation gap the equivalent Discord command already closed (an unvalidated channel id, no server-side restart confirmation, no upper bound on timeout minutes/warning threshold).

v0.18.98Fix: a critical role-grant privilege escalation + 4 more issues (Wave 3 bulletproofing audit)

• CRITICAL: a mod granted only the narrow "Custom Achievements" permission (not Administrator) could attach ANY Discord role as an achievement's reward; including the server's own BenchBot Admin role, or a real Administrator-flagged role; auto-granted completely unattended the moment a trivially-satisfiable condition (e.g. "net worth ≥ 0") evaluated true. This bypassed the deliberate Administrator-only gate /achievements role-set already enforced for the identical capability, on both Discord and the dashboard. Role rewards are now Administrator-only there too ; a mod can still create/edit achievements freely, they just can't attach or change a role reward themselves.
• Two different staff members (or Discord and the dashboard) closing the same ticket at nearly the same moment could both succeed, double-posting the "Ticket Closed" log embed with conflicting "Closed By"/reason info; most reliably via /ticket closeall's up-to-30-second confirmation window racing an individual close. Closing a ticket is now safe to attempt twice ; only the first one actually takes effect.
• A rare Discord autocomplete edge case (no option flagged as "focused" on the interaction) could throw before the bot's own per-module error isolation even started, silently killing autocomplete suggestions for that one command with none of the usual diagnostic logging. Now caught cleanly.
• /dev guild-deactivate is meant to make the bot go fully quiet in a server, but a handful of already-open multi-step flows (a /casino blackjack hand in progress, /createevent, /embed create, /expedition, /loadout, and the channel-visibility picker) kept working until their own timeout; for blackjack, that meant real wallet currency could still change hands after deactivation. All 6 now stop immediately.
• The Player Hub panel (the button-only, no-commands-needed player dashboard) silently showed one server's Balance/Stats/Store/Leaderboard data for every player in a guild with 2+ DayZ servers configured, with no indication a different server even existed: unlike every equivalent slash command, which already asks which server you mean. The panel now prompts for which server too, when there's more than one.

v0.18.97Fix: a real achievement data-corruption bug + 8 more correctness/race issues (Wave 2 bulletproofing audit)

• CRITICAL: custom achievements created a 2nd, 3rd, etc. one all got the exact same id ("custom_NaN") due to a subtle id-generation bug, on both Discord and the dashboard; editing or deleting one could silently hit or wipe out a completely different achievement, and role rewards could leak between them. Fixed at the root, AND every guild's already-existing data is automatically repaired the next time it loads.
• The dashboard's Custom Achievements form had no length limit (only a client-side hint), unlike Discord's ; an oversized one saved there would crash /achievements for every player in the guild the next time they ran it. Now rejected server-side, matching Discord's own limits.
• /baseping auto-action threw an error ("Something went wrong") the first time it was run against a base ping created since the bot's last restart, on both Discord and the dashboard. Fixed, plus the dashboard's Add Base Ping form now enforces the same radius/cooldown minimums Discord already did (a radius of 0 silently created an alert zone that could never trigger).
• The dashboard could add the same gamertag to two different factions at once (create, add-member, and approve-request all only checked the one faction being edited); Discord's /faction create|join already prevented this ; the dashboard now does too.
• A banlist review decision made on one surface (Discord or the dashboard) never disabled the other's still-live Approve/Deny buttons, so a stale click days later could silently reverse an already-made decision with no record it happened. Also fixed a rare race where two servers reporting the same gamertag at once could post two separate, orphaned review messages instead of one.
• A giveaway reroll (Discord or the dashboard) landing at the exact moment the automatic sweep was finishing that same giveaway could race it and announce a second, different set of winners. The dashboard's reroll also now enforces the same 1-20 winner-count range Discord already did.
• A base ping with auto-action enabled could double-ban a player (and then un-ban them early) if they triggered two qualifying events in the same ~30-second cycle; e.g. a kill right as they entered the zone.
• Performance: /achievements wipe stripped achievement-granted roles from members one at a time; for a role held by hundreds of members, that could take minutes. Now parallelized. Also fixed the wealth leaderboard re-sorting itself once per configured server instead of once per guild on every poll cycle.

v0.18.96Fix: 2 real economy race conditions, an automod security gap, and 5 performance issues (Wave 1 bulletproofing audit)

• CRITICAL: /dz-store buy could be double-spent; two purchases fired close together (double-tap, a retried command) could both pass the balance check before either had deducted, driving a balance negative and granting two purchases for the price of one. Cash is now deducted atomically at the moment of purchase, and refunded automatically if the purchase itself fails.
• CRITICAL: two purchases on the same DayZ server racing could silently overwrite each other's spawned items in the store's spawner file, even though both had already been charged. The spawner file write is now locked per-server so this can't happen ; a rejected purchase due to the lock is refunded automatically.
• SECURITY: auto-mod could time out or ban a real server Administrator, the configured BenchBot Admin role, or the bot's own developer just for tripping a word/spam/link/invite/mentions rule; something /warn, /tempban, and /dz-kick have always refused to do. Auto-mod now checks the same protection before taking any action.
• The dashboard's Player Punishments page let a mod granted only "Player Punishments" (with Temp-Ban and Kick explicitly left off) still issue real temp-bans and kicks: those two actions now require their own permissions, matching what Discord's own /tempban and /dz-kick already enforce.
• Warning escalation's ban action could ban a still-present, protected admin if Discord's member-fetch happened to fail at the wrong moment (a transient hiccup was being treated the same as "they left the server"). Escalation now aborts safely instead of guessing.
• A temp-ban whose initial in-game ban failed to apply (a transient Nitrado hiccup) used to just stay un-applied for its entire duration, sometimes a full week, with no automatic recovery; it now retries automatically every sweep, matching /dz-kick's existing behavior.
• Performance: 3 more background sweeps (giveaways, reminders, scheduled embeds) and 2 bulk multi-server commands (/tempban ...all-servers, /dz-kick ...all-servers) were still processing guilds/servers one at a time instead of concurrently, so one slow or rate-limited one could delay everyone else behind it. All converted to the same bounded-concurrency approach already used elsewhere in the bot. Also fixed a multi-server guild's poll cycle redundantly re-running its full economy-achievement check once per configured server instead of once per guild.
• Root-caused and fixed real test-suite flakiness (different, unrelated tests failing on different runs): the test suite was reading and writing the SAME real data folder the live bot uses, so a "fresh" test guild id could occasionally collide with leftover state from an earlier run. Tests now run against a fully isolated, disposable data folder every time.

v0.18.95Fix: critical cross-guild data leak + 4 more dashboard-vs-Discord gaps, found by an adversarial audit

• CRITICAL: fixed a real cross-guild data corruption bug in ticket categories. Any guild that had never run /ticket category-add shared the same 5 built-in category objects in memory with EVERY other never-customized guild on the bot ; granting a role to a category via /ticket category-role-add or the dashboard's role picker mutated that shared object in place, silently leaking the role grant into every other never-customized guild's category list (visible in /ticket category-list and the dashboard). This is now impossible; every write path clones its own category list, and the shared defaults are frozen so any future mistake of this kind throws immediately instead of corrupting data.
• Fixed the dashboard's ticket Add/Remove Member forms: Remove used to report success even when the ticket's channel had been deleted outside the dashboard (nothing actually happened) ; Add used to blame "couldn't find that member" even when the real problem was the missing channel. Both now fail with the accurate reason.
• The dashboard's Ticket Categories "Add" form and Ticket Setup's panel/quicksetup channel pickers now re-validate the submitted channel server-side (matching the equivalent Discord commands) instead of trusting a possibly-stale or wrong-type channel id, which could otherwise silently persist a setting that would never actually work.

v0.18.94Add: DayZ server-side logging requirement made obvious, and a faster Ticket Transfer

• Root-caused a real report of dynamic-event/vehicle-spawn/heli/convoy/police feeds never posting: those event types are only ever detected by parsing specific DayZ RPT log lines that the DayZ server itself only writes when cfgeconomycore.xml's <defaults> block has log_ce_dynamicevent and log_ce_vehicle set to "true"; most servers ship with these off. This wasn't a BenchBot bug, but it was easy to miss, so it's now called out everywhere it matters: a new /quickstart step (4 of 9), a note on /channel create|set for the affected event types, and a warning on the Channel Management dashboard page.
• Ticket Transfer (dashboard) now quick-picks from BenchBot Admin role members instead of requiring a raw Discord user ID every time: the manual ID field is still there as a fallback for anyone not yet cached. Add/Remove Member also now shows how to copy a Discord user ID, matching the hint already used elsewhere on the dashboard.

v0.18.93Fix: live crash in /ticket category-role-add on categories added via Discord

• Fixed a live bug shipped in 0.18.92: a ticket category added via /ticket category-add was missing its roleIds field entirely (the dashboard's equivalent route was already fixed, the Discord command wasn't), so running /ticket category-role-add on it crashed with "Something went wrong handling that command." /ticket category-add now sets roleIds correctly, and category-role-add/category-role-remove are also hardened to tolerate a category with no roleIds at all, so this class of crash can't recur even from an untouched code path.

v0.18.92Add: per-category ticket roles, and a new /quickstart step-by-step setup guide

• Tickets: admins can now control exactly which staff role(s) automatically see each type of ticket; e.g. only your Ban Appeals team sees Ban Appeal tickets, not every category. New /ticket category-role-add|category-role-remove commands, and a matching Ticket Categories dashboard page section (pick roles per category). The BenchBot Admin role still always sees every ticket regardless.
• New /quickstart command: a complete, plain-language, step-by-step walkthrough for setting the bot up from scratch, in the right order, for admins who've never used it before. Separate from /help (a by-category reference); this is a guided, numbered path from "just invited the bot" to "fully working."

v0.18.91Fix: 4 more issues found by a deep-dive audit of last night's permissions/autocomplete incident

• Applied the same fix from the last update to 2 more places that had the identical gap: a broken command could also have silently blocked modal-submission (form popups) or button/menu clicks for every other command, and separately, for full slash commands themselves. All three are now isolated the same way.
• The dashboard's ban rejection message ("no Player/Ban Role configured") used to send admins to a dashboard page with nothing about roles ; it now names the actual /setup player-role and /setup ban-role commands, since those roles can only be set there.
• Achievement role rewards and reaction-roles now warn immediately when you pick a role, if BenchBot's own role isn't positioned above it in Server Settings; previously this failed completely silently, matching the warning /setup player-role and /setup ban-role already gave.
• /setup view now shows which Moderator Permissions are actually granted, so you can confirm a dashboard toggle saved without going back to check the dashboard itself.

v0.18.90Fix: a broken feature could silently block autocomplete for every command after it, and a wrong dashboard link

• Fixed a real live bug: channel/server search-as-you-type (autocomplete) could fail with Discord's "Loading options failed" for commands like /ticket panel, even though the bot's own data was fine; a bug in any ONE unrelated command's autocomplete handler was able to silently break autocomplete for every command that happens to be checked after it internally. Each command's autocomplete now runs in isolation, so one broken (or slow) one can never take down another's.
• Fixed the Moderator Permissions dashboard page linking to the wrong page ("Server Config") when telling an admin where to set the BenchBot Moderator role; that role is actually set on the General Settings page, which is where both links now point.

v0.18.89Fix: 2 correctness gaps found by an independent review of the last 2 releases

• /dz-ban add now rejects an empty or newline-containing gamertag before it ever reaches Nitrado: the ban list is stored as a plain newline-joined string, so a pasted gamertag with a stray line break would have silently split into extra, wrong entries.
• A hand-edited or corrupted save file with a malformed gamertagLinks entry could previously crash a live poll cycle (zone/base-ping auto-ban checks) instead of just skipping that one bad entry ; now tolerated gracefully everywhere it's read.

v0.18.88Add: /dz-ban, permanent Nitrado ban list management

• New /dz-ban add|remove|list ; type in a gamertag and the bot adds it straight to that server's Nitrado ban list, permanently (no auto-expiry, no Discord role swap, and no linked Discord account required: the gamertag alone is enough). Distinct from /tempban (Discord role-swap, auto-reversing after a set duration) and /dz-kick (soft 5-minute removal) ; use those when you want the ban tied to a Discord member instead. Admin-gated by default like every other moderation command ; an admin can delegate it to the BenchBot Moderator role from the Moderator Permissions page.

v0.18.87Add: multi-gamertag linking, toggled per-guild

• /link set now supports linking more than one gamertag to a single Discord account: off by default (today's exact one-gamertag-per-account behavior). An admin turns it on with /link admin mode (or the Account Links dashboard page's new mode switch). Once on: /link set adds instead of overwrites (up to 5), /link remove and /link admin remove take an optional gamertag to pick which one, /link status shows all of them, and a new /link primary switches which one commands that auto-resolve "your gamertag" (like /dz-store) use. Also fixed a real pre-existing bug: /link admin set could link a gamertag that was already linked to someone else, a check /link set itself always enforced.

v0.18.86Fix: several more real-time features weren't reading a real 2nd+ server's own data

• Following the /link fix above, did a full audit for the same bug class and fixed everything found: the automated behavior-detection sweep (dupe/boost/camping/etc.) was checking the wrong server's alert thresholds every poll cycle on a guild with a real 2nd+ server ; /detect (view/toggle/configure the 7 behavior detectors) had no per-server awareness at all, so it always showed and edited the first server's settings ; the dashboard's Server Config page showed the wrong server's channel routing table ; and an unlocked achievement's announcement could post to the wrong server's default channel when no dedicated achievement channel was set. All four now correctly scope to whichever server they're actually about.

v0.18.85Fix: /link falsely said a real player had never been seen playing

• Fixed a real bug affecting any guild running a real 2nd+ DayZ server: /link set (and /link admin set)'s "has this gamertag ever been seen playing" check only ever looked at the server that existed before multi-server support; a player who'd genuinely played, sometimes the night before, on a real added 2nd+ server got told they'd never been seen and couldn't link their account without an admin forcing it. It now checks every one of a guild's configured servers.

v0.18.84New: developer control panel on the dashboard

• Developer-only, not visible to regular server admins: a new /dev dashboard page (bot-wide guild list with server counts, deactivate/reactivate, and command-usage analytics) for tracking and managing every server BenchBot runs on, all in one place instead of jumping between individual Discord servers.

v0.18.83Fix: channel pickers across every command now searchable, no more "not a valid channel"

• Fixed a real, widely-hit bug: every DayZ server BenchBot manages has racked up 50-150+ channels (largely from /setup auto-channels itself), and Discord's own native channel-picker popup becomes unreliable at that scale; failing to list or search channels, and sometimes rejecting a valid pick as "not a valid channel." Every command that asks you to pick a channel (or category) now uses the bot's own searchable autocomplete instead, the exact same mechanism the server: option already uses, so typing a few letters reliably finds it, no matter how many channels your server has.
• This touches every channel-picking field across the bot: /setup channel/bot-trap, /channel set/modlog-exclude/modlog-include, /lootfeed channel, /banlist, /baseping, /embed-builder, /dev error-channel/security-channel, /giveaway, /keyword, /online-count, /player-hub, /purgechannels, /reactionrole, /server-monitor channel, and /ticket panel/quicksetup/category-add.

v0.18.82Multi-server Stage 6: /logs, /restart, /status, /altcheck, /whitelist, /map, /distance, /server-monitor now per-server

• Finishing the multi-server rollout's remaining Discord commands: /logs, /restart, /status, /resetlogs, /altcheck, /whitelist, /map, /distance, and /server-monitor all still read the old shared, guild-wide config; every one of them gained the same optional server: option every other migrated command already has, and now correctly targets whichever DayZ server you mean.
• Fixed a real gap found doing this: the bot's restart-history tracker (what /logs restarts reads) was still recording every server's detected restarts into one shared list, so a real 2nd+ server's restarts were invisible to it. Also fixed /server-monitor's background uptime checker, which only ever checked one server per guild instead of every one of them.
• Fixed a subtler bug in the automatic Weekly Recap post: it was computing "Most Contested Zone" against the wrong server's map and mixing kill locations across servers, for any guild running more than one.

v0.18.81Fix: /setup player-role, ban-role, channel, location-format, heatmap-auto, players-heatmap now per-server

• Fixed a severe bug: these six /setup subcommands were still writing to the old shared, guild-wide config even after /setup nitrado and /setup map were made per-server. Since /tempban reads the player/ban roles from each server's own config directly (no fallback for a real added server), any guild running a real 2nd+ DayZ server had no way at all, Discord or dashboard, to set those roles for it, so /tempban start would permanently fail there with "no roles configured." All six gained the same optional server: option every other migrated command already has.

v0.18.80Multi-server Stage 5 cleanup: 3 more gaps closed, hub server switcher, General Settings split out

• Fixed 3 more real gaps found doing a final pass over Stage 5: /event create (the Discord command, not just its dashboard page), /channel, and /setup auto-channels|view had never been touched by any earlier stage, so on a guild with a real 2nd server they'd have silently kept reading/writing the wrong server's event spawns, channel routing, or full-setup channels. All three (plus the Channel Management dashboard page) are now fully per-server, with the same server: option every other migrated command already has.
• The guild hub now shows a server switcher (a row of pills) once a guild has 2+ DayZ servers configured, so every per-server page's card follows whichever server you've selected instead of always falling back to the old picker.
• Server Config split into two pages: Server Config (Nitrado, map, FTP, live status; per server) and a new General Settings page (bot-admin role, mod role, auto-role, farewell DM; guild-wide, shared across all of a guild's servers).

v0.18.79Multi-server Stage 5: 14 more dashboard pages move to real per-server URLs

• Continuing the multi-server rollout (Stages 1-4, v0.18.71-0.18.78): the admin dashboard's Rotation, Base Damage, Behavior Detection, Alt Check, Bounty Config, Classnames, Store & Economy, Factions, Base Pings, Zones, Teleporters, Event Creation, Loot Feed, and Player Punishments pages now live under a real per-server URL instead of quietly falling back to the guild's first server. Every old link still works; it now transparently redirects (or offers a quick picker on a guild running 2+ servers) instead of just rendering.
• Fixed a real gap found while doing this: /teleport (the Discord command itself, not just its dashboard page) had never been touched by any earlier stage, so on a guild with a real 2nd server it would have silently kept reading/writing the wrong server's teleporters and FTP credentials. It's now fully per-server, with the same server: option every other command already has.
• Also fixed: the Store & Economy dashboard page was still almost entirely reading the guild's shared, pre-migration data (cash balances, zones, items, kits) even after Stage 3 supposedly moved that data per-server ; a 2nd real server's admin would have been editing the wrong server's store without any indication. Corrected as part of this move.

v0.18.78Multi-server Stage 4: temp-bans and kicks now track per server, plus a new all-servers bulk-ban option

• Continuing the multi-server rollout (Stage 1 v0.18.71, Stage 2 v0.18.74, Stage 3 v0.18.77): /tempban and /dz-kick records now track independently per DayZ server instead of being shared across a guild's servers, and both gained an optional server: option; omit it and nothing changes for the 95% of guilds running one server. Warnings stay shared across all of a guild's servers, since a Discord warning isn't tied to any one game server.
• New: all-servers:true on /tempban start and /dz-kick start applies the ban across every DayZ server configured for the guild at once (each with its own role swap/Nitrado credentials), instead of running the command once per server by hand ; /tempban release also gained all-servers:true to lift a bulk ban everywhere in one go. Reports back per-server so a failure on one server never blocks the others.
• Fixed a real gap found while doing this: /player online's banned-player note only checked the aliased single-server ban lists, so it would've silently gone blank for a 2nd+ server ; the dashboard's Player Punishments page had the same gap for temp-bans, kicks, and fines.

v0.18.77Multi-server Stage 3: cash economy, store, zones, base pings, factions, and bounties now track per server

• Continuing the multi-server rollout (Stage 1 v0.18.71, Stage 2 v0.18.74): Cash balances, the store (items/kits/spawn locations), custom classnames, admin-drawn zones, base pings, factions, and bounties now all track independently per DayZ server instead of being shared across a guild's servers. /dz-store, /classname, /zone, /baseping, /faction, and /bounty all gained an optional server: option, following the same pattern already used everywhere else; omit it and nothing changes for the 95% of guilds running one server.
• Factions get their own separate roster per server (so two servers can each have their own "Reapers" faction with no conflict) ; bounty costs/payouts stay on the shared server-wide Dollars economy, only the bounty listings themselves are per-server.
• Fixed several real bugs uncovered while doing this: /zone's autoban (and /baseping's) were reading Nitrado credentials from the wrong place for a 2nd server, meaning a ban could silently fire against the wrong server's account ; /faction leaderboard was reading stale, pre-Stage-2 combat stats ; both zone and base-ping auto-ban sweeps only checked one server per guild instead of every one of them.

v0.18.76New: /remind personal reminders and /invites tracking

• /remind create in:<30m/2h/1d/1w> text:<>; set a personal reminder ; BenchBot pings you back in the same channel when it's due. /remind list and /remind cancel manage your own pending ones (up to 25 at a time).
• /invites leaderboard and /invites lookup; tracks which invite link a new member used to join and credits whoever invited them, so you can see who's actually bringing people in. Backfills automatically ; no setup needed.

v0.18.75Auto-Mod escalation + custom warning text now on the dashboard too

• The Auto-Mod dashboard page now has everything /automod config warn_text and /automod escalation added on the Discord side last update: a Warning Text column per check, and a new Escalation section (auto-timeout/ban once a member crosses a warning threshold). Previously these were Discord-command-only.
• Also fixed the dashboard's action label to say "Delete + Warn" instead of just "Delete", matching what it's actually called on the Discord side.

v0.18.74Multi-server Stage 2: rotation, base damage, heatmap, leaderboard, player stats, achievements, online-count now track per server

• Continuing the multi-server rollout (Stage 1 shipped v0.18.71): rotation pools, base-damage schedules, event cleanup, heatmap sampling, the leaderboard, the weekly digest, player stats, loot-feed samples, position tracking, online-count, and DayZ achievement progress now all track independently per DayZ server instead of being shared across a guild's servers. Every affected command (/rotation, /basedamage, /heatmap, /leaderboard, /player, /activitylog, /lootfeed, /online-count, /achievements dayz) gained an optional server: option, following the same pattern /setup nitrado already used; omit it and nothing changes for the 95% of guilds running one server.
• Fixed several real bugs uncovered while doing this: /player online|locations|track and the Live Players heatmap were reading the wrong (shared) runtime state for anyone who'd already added a real 2nd server, so that server's online players were invisible ; /online-count, /rotation, and /basedamage were reading Nitrado/FTP credentials from the wrong place for a 2nd server ; and /online-count's background refresh only ever checked one server per guild instead of every one of them.
• /achievements wipe now correctly clears every server's combat/survival progress, not just the first one, since that progress is no longer shared.

v0.18.73Fix: dashboard Zones page 404 ; warning text box too small to type in

• Fixed a real bug: the dashboard hub's "Zones" card linked to a URL that didn't exist (a leftover mismatch from when the page was built), so clicking it just showed a bare "Cannot GET" error instead of the Zones page. Added a regression test that checks every hub card links somewhere real, so this class of bug can't silently ship again.
• The Punishments page's "Warning text" box is now a proper multi-line text area (was a single-line field, so longer warnings got cut off with no way to see what you'd typed or start a new line).

v0.18.72New: automod Delete + Warn now logs a real warning, escalation, and /warn + /warnings

• Auto-mod's "Delete + Warn" (and plain "Warn only") action now logs a real, trackable warning to the same history the dashboard's Punishments page uses; previously it only posted a one-time public chat notice with no lasting record. Delete + Timeout and Delete + Ban are unaffected (already a standalone consequence).
• New /automod config warn_text: option; write your own custom wording per check (spam, mass mentions, invites, links, censored words) instead of the built-in reason text ; say "default" to reset it.
• New /automod escalation; admins can configure an automatic timeout or ban once a member reaches a set number of total warnings (from auto-mod AND manual warnings combined). Fires once, right when the threshold is crossed.
• New /warn and /warnings commands; mods can issue a warning directly in Discord and look up a member's warning history, without opening the dashboard. Both share the exact same warning ledger and escalation as auto-mod and the dashboard, so every warning source counts toward the same total.

v0.18.71New: multi-server support; up to 5 DayZ servers per Discord guild (Stage 1)

• Laid the foundation for running multiple DayZ servers on one Discord guild (up to 5). Every server gets a Server Name to tell them apart.
• /setup server-add, /setup server-list, and /setup server-remove manage a guild's servers. /setup nitrado and /setup map now accept an optional server: option; with only one server configured (the normal case today) nothing changes, you're never prompted.
• The dashboard's Server Config page now lives at a per-server URL ; the old link keeps working automatically for every guild that only has one server.
• This is the first of several stages; feeds, economy, zones, and moderation still operate on a guild's first/only server for now and will move to true per-server tracking in upcoming updates.

v0.18.70Fix: delayed online-count voice channel ; sped up every Nitrado-polling feed

• Fixed a real bug in the online-count voice channel (the one showing "🟢 Online: N" at the top of a server): it swept every server in one sequential line under a single shared lock, so if one server's channel got stuck behind Discord's own strict rename rate limit, EVERY other server's count froze too, silently, with no error logged. Each server now updates independently, with a hard 20s cap so a stuck rename can never hang the others.
• Found and fixed the exact same bug shape in 4 more places that periodically talk to Nitrado on a timer: /tempban, /baseping auto-action, /zone autoban, and /dz-kick's ban-reversal sweeps all had the identical one-slow-server-blocks-everyone flaw (basePing's and zone's sweeps could additionally abort entirely if one server errored, silently skipping the rest ; also fixed).
• The main 30-second log poller now fetches a server's ADM and RPT logs at the same time instead of one after the other: roughly halves that part of every poll cycle.
• /altcheck (alt-account detection) now pulls its FTP and Nitrado data sources concurrently instead of sequentially, and downloads its (up to 40) log files in parallel batches instead of one at a time: a long-running server's /altcheck could previously take 40 sequential round-trips just to gather files.

v0.18.69New: /achievements wipe

• /achievements wipe (Admin) permanently resets every player's achievement progress on the server, both Discord-linked (economy) and DayZ-gamertag (combat/survival) records, in one go, with a confirm/cancel button first (same safety pattern as /dz-store admin cash-wipe).
• Also strips any Discord role an achievement auto-grants from whoever currently holds it, so roles stay consistent with the now-cleared progress instead of leaving stale badges behind.

v0.18.68Fix: stale online-player list ; clarify why a banned player still shows online

• Fixed a real production bug: a busy guild sending many individual kill/death/hit/build embeds one at a time could stall that guild's ENTIRE poll cycle for 60-90+ seconds, and since every guild shares one polling gate, that stall silently delayed the online-player list (and everything else) for every other server too, even ones with nothing going on. Individual embed sends are now dispatched with bounded concurrency instead of strictly one after another.
• /player online now flags a currently-online player who has an active /tempban, /dz-kick, /baseping auto-ban, or /zone auto-ban record with a note explaining why they're still listed: this server has no RCON/BattlEye access, so a ban only blocks a *future* reconnect; it can't force-disconnect a session that's already connected. That's real game-server behavior, not a stale list.

v0.18.67New: draw a zone on the map (final stage of the Zone system)

• The Zones dashboard page now has a "Draw a Zone" tool; click points directly on your server's map (Chernarus+, Livonia, or Sakhal) to outline an irregular shape instead of typing in a center + radius. Existing zones render as translucent outlines for reference while drawing.
• A drawn zone can serve any purpose (Cash reward, Autoban-Kill, Autoban-Build); enable any combination in one form, since this is the only place a non-circular zone can be created at all.
• This completes the 4-stage Zone system: Sakhal map support, the /zone command, the numeric-entry dashboard page, and now polygon drawing; admins can now fully configure autoban and Cash zones by command or by hand-drawing them on a real map.

v0.18.66New: dashboard Zones page (3rd stage of the Zone system)

• The new /zone Discord command now has a dashboard counterpart: a Zones page listing every zone (any purpose) with Remove, plus a numeric-entry form for creating/updating autoban zones (same fields as /zone create: name, X/Y, radius, trigger, tiered ban lengths, offense window).
• Cash-reward zone creation stays on the existing Store & Economy page (linked from the new Zones page): this keeps one place per purpose, matching how the Discord commands are already split between /dz-store and /zone.
• Reachable from the server hub once an admin grants the 'zone' Moderator Permission (dashboard: Moderator Permissions page).

v0.18.65New: /zone; admin-drawable autoban zones (2nd stage of the Zone system)

• /zone create <name> <x> <y> <radius_m> <trigger:kill|build> <tier1/tier2/tier3>; draw a circular zone that auto-bans on a Nitrado level (with an escalating, tiered duration + DM notice, same proven mechanism /baseping's own auto-action already uses) whenever a kill happens inside it (kill trigger) or a base/flag/stash gets placed inside it (build trigger). Run /zone create again against the same name to add the other trigger to the same zone.
• /zone list / /zone remove: a unified view across every zone regardless of purpose (autoban or Cash reward), complementing /dz-store's existing cash-only zone list.
• Under the hood, the old cash-only zone store (gd.cashZones) is now a single unified gd.zones list shared by every zone purpose; existing Cash zones migrated automatically, /dz-store zone-add|remove|list keep working exactly as before.
• Gated behind a new 'zone' Moderator Permission an admin can grant from the dashboard's Moderator Permissions page.

v0.18.64New: Sakhal map support (first stage of the upcoming Zone system)

• Sakhal is now a selectable map everywhere Chernarus+/Livonia already were: /setup map, the dashboard's Server Config map picker, rotation/base-damage/teleport/event mission-folder targeting, and heatmap rendering (real 15,360x15,360 size, matching Chernarus+).
• 13 real Sakhal town names are in for /mapdistance-style "nearest town" lookups (Petropavlovsk-Sakhalinsky, Severomorsk, Nogovo, Aniva, Burukan, Tumanovo, Orlovo, Rybnoye, Rudnogorsk, Matrosovo, Yasnomorsk, Sovetskoye, Zhupanovo): every Major Town and Town from Sakhal's real settlement list. Smaller villages aren't covered yet (not available from this project's data source for Sakhal) ; unmatched spots just show raw coordinates instead, same graceful fallback every map already has beyond its known towns.
• This is the first of several planned pieces building toward a new Zone system (admin-drawable zones for autoban, cash rewards, and more), more to come.

v0.18.63Embed Builder dashboard: color picker, live preview, unlimited-feeling fields

• The dashboard's Embed Builder page got a real overhaul: a color swatch/picker next to the hex field (still type an exact code if you want, or just click Default to clear it), a live preview panel that updates as you type showing roughly what the sent embed will look like (color bar, fields grouped inline the way Discord actually lays them out, image/thumbnail, footer/author), and fields are now Add/Remove buttons instead of a fixed wall of 10 blank rows, and the real cap is now 25, matching what /embed on Discord (and Discord itself) already allows, not an arbitrary lower dashboard-only limit.
• Also fixed the Description box rendering as a tiny unstyled default browser textarea instead of matching every other field on the page: a real, previously-unnoticed gap where this dashboard's shared styling never actually covered textareas at all.

v0.18.62New: Player Punishments; a combined ban/kick/fine/warning dashboard page

• New Player Punishments page on the dashboard: the live ban list, one small form each to issue a ban, kick, fine, or warning, and a combined Punishment History showing all four together, most recent first. Fines dock a player's Corna Store balance directly ; warnings are a plain logged note with no side effects. Gated behind its own Moderator Permission, same as every other dashboard page.
• Every action requires a real, resolvable Discord member and re-checks the same Administrator/bot-admin-role protection /tempban and /dz-kick already enforce: a real admin can't be banned, kicked, fined, or warned from this page, even by gamertag override.

v0.18.61Fix: /server-monitor set silently saved an invalid dot-typo'd host

• /server-monitor set already defended against pasting "1.2.3.4:2302" straight from Nitrado's panel (stripped the :port automatically), but a "1.2.3.4.2302" dot-typo, a real one found live on a production server, sailed straight through unvalidated, silently saving a broken host and leaving the uptime check failing forever with no error ever shown to whoever set it up.
• Now rejected up front with a clear message telling you to use : instead of . for the port.

v0.18.60New: /dz-kick, kick a player off the DayZ server

• New /dz-kick start user:<@member>; kicks a player off the DayZ server. There's no way to instantly disconnect one connected player on console (no RCON access), so this works as a 5-minute auto-reversing in-game ban through Nitrado instead, the closest real equivalent; it never touches Discord roles, unlike /tempban. The player gets DMed right away making it clear it's a kick, not a ban, and exactly when they can reconnect.
• Reuses the same auto-reversal safety net /tempban and /baseping's auto-ban already rely on: if the unban fails to go through on schedule, BenchBot keeps retrying automatically and posts a warning to the Moderation Log rather than leaving someone kicked with no one noticing.
• /dz-kick list shows everyone currently kicked, same shape as /tempban list.

v0.18.59New: Restart/Stop/Start Server buttons on the dashboard

• Server Config on the dashboard now has Restart Server, Stop Server, and Start Server buttons under Live Server Status, mirroring /restart: each asks for a confirmation click first since they immediately disconnect every player.
• Fixed Live Server Status showing a raw/blank map value instead of the server's actual configured map (same root cause as the earlier /status fix; Nitrado's own settings.general.map field isn't reliable, so this now reads the map BenchBot already has configured), and added a Last Restart / Status Changed timestamp.

v0.18.58New: /restart, restart the DayZ server on demand

• New /restart confirm:true restarts the DayZ server right now, straight from Discord; no more needing to go into Nitrado's panel directly. Immediate, no player warning, and not delegable via Moderator Permissions (real Administrator/bot-admin-role only) since it disconnects every player on the server the moment it runs.
• A restart triggered this way shows up in /logs restarts the same as any other restart, once it actually completes.

v0.18.57New: /logs; download RPT/ADM logs, and a 24h restart history

• New /logs download type:<rpt|adm> sends the server's current log file straight to Discord as a downloadable attachment; no more digging through Nitrado's file manager. If a log's too large for Discord to attach, it's truncated to the most recent portion (which is almost always what you actually want to check) rather than failing outright.
• New /logs restarts; there's no real "restart log" on Nitrado's side, so the bot now tracks its own: every time it detects a real server restart, it's logged with a timestamp, kept for 24 hours. /logs restarts shows them newest-first with how long the server stayed up between each one, plus a downloadable copy: the actual point being to see whether restarts are landing on schedule or clustering suspiciously close together.
• Both gated by a new Server Logs moderator permission, delegable like most other admin-config features.

v0.18.56New: ticket category folders, and a live players heatmap

• Ticket categories used to only be distinguishable by name/topic: every ticket still landed in the same shared "Tickets" folder in the sidebar regardless of type. /ticket category-add now takes an optional parent_category, so e.g. donation tickets and staff-support tickets can land in separate Discord folders. Existing categories with none set keep using the shared folder exactly as before ; also on the Ticket Categories dashboard page.
• New /setup players-heatmap enabled:<> [interval-minutes]; a live map of exactly who's online right now, edited in place in the Heatmap channel instead of reposting every time, refreshing on your own set interval (default 2 min, skips the render entirely if nothing's actually moved).

v0.18.55Fixed: base-ping auto-bans could get silently stuck claiming "banned" when they weren't

• Found during an audit, not a live report: if a base-ping auto-ban's Nitrado write failed (network hiccup, bad token), the bot's own record was marked 'active' forever with no retry; the offender was never actually banned in-game, but the bot's records and /baseping bans said otherwise. The 30s sweep now retries a failed ban every cycle until it actually lands (or Nitrado gets reconfigured), instead of giving up silently after the first attempt.
• Also fixed a deeper version of the same bug: a persistent Nitrado outage doesn't throw an exception (it retries internally, then returns nothing), so the old code could mistake "couldn't even check the ban list" for "already banned, nothing to do" and falsely report success; now matches /tempban's own, already-correct handling of that exact case.

v0.18.54New: fully customizable achievements ; admins can add and remove your own

• The achievement list was hardcoded before ; now every server can build its own. /achievements custom-add label:<> desc:<> source:<> operator:<>=|>|=> threshold:<> [role] creates one from a fixed, structured menu of trackable stats; kills, deaths, longest kill distance, playtime, longest life survived, bench max, range rank, net worth (per currency), or shop purchases; no code, just pick a stat and a number. The optional role option auto-grants a Discord role the moment it unlocks, same mechanism /achievements role-set already uses.
• custom-edit/custom-remove manage what you've added (autocomplete), custom-list shows every one with its condition. The exact same builder is also on the dashboard's new Custom Achievements page; build/edit on one surface, see it reflected on the other. Gated by a new Custom Achievements moderator permission, delegable to a trusted mod role like most other admin-config features.
• Custom achievements show up automatically in /achievements me and /achievements dayz right alongside the built-in ones, and post the same live unlock announcement.

v0.18.53New: /baseping auto-action, escalating, configurable auto-bans

• Base pings could only alert before ; now each zone can optionally auto-ban whoever triggers it, for real, through Nitrado. /baseping auto-action name:<> enabled:<> trigger_on:<presence|kill|both> turns it on per zone; presence (entering it) and/or kill (a kill happened while the killer was standing inside it, the Conquest-style 'get a kill in spawn, get banned' case).
• Every offense bans ; duration escalates with repeat offenses within a rolling window (tier1/tier2/tier3, e.g. 1h/6h/1d, window_days default 30), then auto-reverses on schedule same as /tempban. The banned player gets a DM explaining why, if their gamertag is linked to a Discord account.
• /baseping bans lists everyone currently auto-banned ; /baseping unban gamertag:<> ends one early. /baseping list now shows an auto-ban tag next to any zone that has it configured.

v0.18.52Fixed: /status always showing Map: ? ; added a Last Restart field

• Fixed a real reported bug, live-verified against production: /status read the map from a Nitrado field (settings.general.map) that doesn't actually exist on the API response, so it always showed "?" even on a fully configured, running server. It now reads the map from the bot's own /setup map configuration, the same source heatmap/loot map already trust.
• /status now also shows a Last Restart field (relative time, e.g. "3 hours ago") sourced from Nitrado's own status-change timestamp; labeled Status Changed instead if the server is currently stopped.

v0.18.51Ticket channels now show category in the name and topic

• Real reported gap: a ticket's category already showed in /ticket list, the dashboard, and the embed inside the channel, but never in the channel name or topic, the two places staff actually scan first. Ticket channels are now named ticket-<category>-<username>-<id> (e.g. ticket-player-report-johndoe-42) instead of just ticket-<username>-<id>, and the channel topic shows the category right away (still combines with priority once /ticket priority is set, same as before).

v0.18.50Fixed: /player online always saying nobody was online

• Fixed a real reported bug, same root cause the Online Count channel fix caught last update: Nitrado's DayZ query never actually returns player names (query.players is always empty, regardless of real occupancy), so /player online's old check always said "No players currently online" even with people actually connected. It now lists real gamertags from the bot's own live log tracking (runtime.playerState, the same source /player locations already uses successfully), not Nitrado's broken player list.

v0.18.49New /setup heatmap-auto, recurring automatic heatmap posts

• Heatmaps no longer need someone to run /heatmap every time. /setup heatmap-auto enabled:<> categories:<> interval-days:<> sample-days:<> (admin, or the Server Config dashboard page) posts a fresh heatmap to your Heatmap channel automatically on a recurring schedule ; pick which categories (kills, deaths, dynamic events, vehicle spawns, or all), how often, and how many days of samples each post shows. Runs alongside the existing on-demand /heatmap command, which still works exactly as before.

v0.18.48New /embed recurring scheduling (Phase 3 of 3 ; feature complete)

• /embed create's wizard gained a Schedule Recurring button, and the dashboard's Embed Builder page got the matching option ; set which days (or every day), which times (24h, one or more per day), and a timezone, and it posts automatically on that recurring schedule, indefinitely, via the same sweep as one-time scheduling. This completes the Embed Builder ; fully custom embeds (title, description, color, image, thumbnail, footer, author, up to 25 fields), built on Discord or the dashboard, sent now, once later, or on a repeat.

v0.18.47New /embed scheduling (Phase 2 of 3: one-time)

• /embed create's wizard gained a Schedule Once button ; give it a duration (30m, 2h, 1d, 1w) and it sends automatically once that time passes, no one needing to be online to trigger it. The dashboard's Embed Builder page got the matching option. /embed list now shows a scheduled embed's send time ; /embed send id:<> still works anytime regardless of any pending schedule. Recurring schedules ("every Monday at 6pm") land next update.

v0.18.46New /embed; build a fully custom embed (Phase 1 of 3: manual send)

• New /embed create name:<> channel:<#> ; a guided popup wizard for a fully custom embed (title, description, color, image, thumbnail, footer, author, up to 25 name/value fields), with a live preview updating after every step. /embed list|send|delete manage what's saved. The same builder is also on the dashboard's new Embed Builder page; build or edit one there instead if you'd rather use a form than Discord popups. Scheduling (send later, or repeating) is coming in the next two updates ; for now, every embed sends on demand only (Send Now or Save as Draft).

v0.18.45New /whoami; self-diagnose exactly what access BenchBot sees you as

• New /whoami shows exactly what BenchBot currently sees you as in the server you run it in: real Discord Administrator, BenchBot Admin role, BenchBot Moderator role (and which specific permissions it's been granted), and Bot Developer status. Deliberately open to everyone with no permission required to run it, so it still works to self-diagnose even if something else is wrongly denying you access. Confirmed live: DEV_USER_IDS was already correctly configured ; the bot developer's unconditional access already applies in every server the bot is in, by design, since it's a plain ID check with no per-guild state.
• Fixed a real gap found during this audit: the Bot Trap's admin-exemption check was missing the developer bypass every other admin-equivalent check in this bot carries; the bot's own developer, with no real Administrator permission or bot-admin role in a given server, could get instantly banned by their own bot-trap for posting in the wrong channel. Now exempt everywhere, unconditionally, same as every other admin-only check.

v0.18.44New /player-hub; a no-commands-needed button panel for players

• New /player-hub setup posts a persistent "Player Hub" panel with 5 buttons: Link Gamertag, Balance, Store, My Stats, Leaderboard. Built for players who don't know or don't want to learn slash commands ; Link opens a small popup asking just for a gamertag (the same /link set logic underneath, just no typing a command), Balance shows Dollars + Cash together at a glance, Store and Leaderboard open the exact same browsers /dz-store view and /leaderboard already show, and My Stats shows achievement progress on both sides (Discord-side always, DayZ-side once linked). /player-hub remove stops tracking the channel without deleting the panel message.

v0.18.43New "longest life" survival achievements, plus role rewards on unlock

• New longest-single-life tracking, distinct from cumulative playtime ; a life spans from spawn until death, however many times you reconnect in between, and resets fresh at every death. Three new DayZ-side achievements off it: Surviving (2h), Hardened (6h), Untouchable (24h), visible via /achievements dayz.
• New /achievements role-set achievement:<> role:<@role> (admin) auto-grants a Discord role the instant any achievement unlocks; Discord-side ones (bench rank, wealth, ...) grant immediately ; DayZ-side ones (kills, playtime, longest life, ...) only work for a gamertag with a real /link on file, since that's the only place this bot connects a gamertag to a Discord account. /achievements role-remove undoes it (doesn't take the role back from anyone who already has it) ; /achievements role-list shows the current mappings.

v0.18.42Fixed: Online Count channel always showing 0 ; new /welcome customization

• Fixed a real reported bug: the Online Count voice channel (/online-count) always showed 0 players, even with people actually on the server. Root cause, confirmed live against production: Nitrado's DayZ server query never actually returns a player-name list (always empty, regardless of real occupancy), which is the field this read ; it now reads the same live player-count field every other part of the bot (/status, /player online, /mapdistance, the dashboard) already used correctly.
• New /welcome config to customize the embed new members see in the Welcome channel: title, message, color, and a banner image, plus toggles for the avatar thumbnail and member-count field. {user}/{username}/{server}/{membercount} substitute into the title and message. /welcome preview posts it right now using you as a stand-in for a new member ; /welcome view shows the current config ; /welcome reset clears everything back to default. Off by default (opt-in via Moderator Permissions, no dashboard page yet).

v0.18.41New /channel embed-mode; post feed events individually instead of batched

• Every live feed normally groups all of a poll cycle's same-type events into one embed (e.g. 10 builds in one cycle become 1 message). New /channel embed-mode type:<> mode:<batched|individual> lets you opt any event type out of that per-cycle grouping ; set to individual, each event posts as its own embed as soon as it happens instead of waiting to be bundled with the rest of the cycle. Matching checklist on the dashboard's Channel Management page. Off (batched) by default for every type ; on a very busy server, switching a high-volume type to individual can mean a burst posts as several separate messages instead of one, taking a little longer to fully post.
• /channel list now also notes which event types are currently set to post individually, if any.

v0.18.40/store renamed to /dz-store, plus player-to-player Cash pay

• /store is now /dz-store ; "DZ" for DayZ, marking every command tied to the real DayZ-currency economy at a glance, distinct from the Discord-side minigame currencies (/economy, /casino, /bench, /range, ...). Every subcommand carries over unchanged (view, balance, setlocation, buy, admin).
• New /dz-store pay to_player:<> amount:<> ; send some of your own Cash directly to another player, no admin needed. Same self-service gamertag resolution as buy/balance/setlocation (uses your /link if you don't pass one). Logged to the same transaction table /economy audit reads, under its own type so the two currencies' fraud-pattern scans never mix.

v0.18.39Fixed: /channel create|set rejecting a typed-out event type

• Fixed a real reported bug: typing an event type's exact visible label (e.g. "Death (no attacker)") instead of tapping the autocomplete suggestion, easy to do on mobile, submitted that raw label text instead of the real value, and got rejected as "Unknown event type" even though it was a completely valid choice. /channel create and /channel set now also accept an exact (case-insensitive) match on the visible label, not just the underlying value.

v0.18.38Live online-player-count voice channel

• New /online-count setup|remove ; creates (or points at an existing) voice channel whose NAME shows the live DayZ online-player count, e.g. "🟢 Online: 12". Locked so nobody can actually join it. Discord limits how often a channel name can change, so this updates every few minutes rather than instantly.
• /help now also documents /server-monitor (it was missing entirely) and the Admin web dashboard's description no longer says only 2 commands are covered, it's 27+ areas now.

v0.18.37Fixed: Bot Trap and Auto-Mod ban actions silently failing

• Fixed a real, live-confirmed bug: Bot Trap (and Auto-Mod's ban action) called message.member.ban(); which requires the offender to already be in the bot's member cache. An account that just joined and immediately posted (exactly the profile both of these exist to catch) is very often NOT cached yet, so the ban call silently did nothing while the message still got deleted and reported, making it look like it worked. Both now ban by the raw user ID instead, which needs no cached member at all, and a failed ban is now actually logged and flagged in the Moderation Log ("Bot Trap Triggered; Ban Failed") instead of failing invisibly.

v0.18.36Exclude channels from the Moderation Log

• New /channel modlog-exclude channel:<#> stops message edits/deletes in that specific channel from posting to the Moderation Log, even when one's configured ; /channel modlog-include undoes it. Matching checklist on the dashboard's Channel Management page. Only affects message edit/delete logging; joins, leaves, nickname/role changes, and bans still always log for every channel.

v0.18.35Combine feeds into one channel

• New /channel set type:<> channel:<#existing> (and the matching dashboard form on Channel Management) points an event type at a channel that already exists, instead of always creating a new one. Point any number of types at the same channel to combine them ; e.g. send kills, deaths, and hits all to one #combat-feed instead of three separate channels. No restriction on which types can share a channel, including the normally-private ones (stash, mod-log, bot-trap) ; that's on you to keep intentional.
• /channel list now also shows the Welcome channel type added last update ; it was missing from that display (the dashboard's channel dropdowns already had it).

v0.18.34Fixed: developer dashboard access on a server you've joined but aren't an admin of yet

• Fixed a real bug: the bot's developer always had full dashboard access to a server they weren't personally a Discord member of, but if they DID join a server (e.g. to help configure it) before being granted real Administrator or a bot-admin-role there, the dashboard treated them as a completely unprivileged member instead; showing the Moderator Permissions empty state instead of the real hub. Discord commands were never affected by this, only the dashboard.

v0.18.33New Welcome channel

• New Welcome channel type ; set one up with /channel create type:Welcome or /setup auto-channels, and every new member gets a public embed there with an @-mention, their avatar, and a running member count. Nothing else to configure ; same 'having the channel set is the on/off switch' behavior as every other feed channel.

v0.18.32Temp-ban + transcripts: dashboard and /help catch-up

• Fixed: an admin had no way to actually grant the tempban permission to a moderator ; it existed in the data model and gated the command, but never got a checkbox on the Moderator Permissions dashboard page. Added, plus a regression test so a future new permission can't ship the same gap silently.
• /help now documents /tempban and /setup player-role|ban-role, and the /ticket entry no longer says 'metadata only'; it's been a full transcript since last update.

v0.18.31Temp-ban now bans in-game too

• /tempban start now also bans the player's DayZ gamertag through Nitrado (settings.general.bans), not just the Discord-side role swap from last update ; /tempban release and the automatic expiry sweep now lift the in-game ban too, at the same time as the role swap reverses.
• Verified directly against real production Nitrado data before shipping (not assumed) ; a gamertag is required for the in-game half (provide one with /tempban start's gamertag option, or have the player /link set theirs first): the Discord role swap always happens regardless, even with no gamertag on file.

v0.18.30Temp-ban mechanic (Discord side)

• New /tempban start|release|list ; temporarily swaps a member's role (their normal role off, a 'ban' role on) for a set duration (e.g. 30m, 2h, 1d, 1w), then automatically swaps it back once the sentence is up: no admin follow-up needed. Set the two roles once with /setup player-role and /setup ban-role.
• Protects against being used on real admins/BenchBot-admin-role holders. If a temp-banned member leaves and rejoins mid-sentence, the ban role is re-applied automatically instead of quietly expiring.
• In-game Nitrado banning (the other half of this feature) isn't wired up yet in this release ; only the Discord-side role swap is live so far. That's landing in a follow-up update once it's been verified against a real server.

v0.18.29Ticket transcripts

• Closing a ticket now attaches a full text transcript (every message, timestamps, authors, attachment links) to the existing ticket-closed log post: the conversation used to just disappear along with the deleted channel, leaving only a metadata summary behind.
• The 'closing in N seconds' countdown before a ticket's channel is deleted is now 10 seconds instead of 5, giving the transcript a bit more room to finish reading a long conversation before the channel is gone.

v0.18.28Moderator Permissions now enforced on the dashboard too

• The same 24 permissions from last update now also gate the matching dashboard pages, not just the Discord commands: a moderator granted (say) Teleporters can open /g/<server>/teleport but gets blocked from every other page, exactly matching what their role can do in Discord. /banlist and /tickets pages keep working exactly as before.
• Fixed a real access bug found while wiring this up: a signed-in member with no BenchBot Moderator role at all could load the Banlist and Tickets dashboard pages, because those two default to on for every server. Server-config, Moderator Permissions, ticket setup, auto-channel setup, and cash-wipe stay admin-only on the dashboard, matching Discord.

v0.18.27Moderator Permissions now enforced on the Discord side

• 24 more commands now check the Moderator Permissions an admin grants (Server Config → Moderator Permissions) instead of requiring full Administrator: /altcheck, /automod, /basedamage, /baseping, /bounty admin, /casino global-chips, /channel, /classname add|remove, /createevent, /detect, /economy audit, /faction admin, /giveaway, /keyword, /link admin, /links add|remove, /loadout, /lootfeed channel, /reactionrole, /rotation (setup-ftp's credential entry stays admin-only), /server-monitor, /store admin (cash-wipe and cash-import stay admin-only), /suggestion resolve, /teleport, /whitelist.
• /ticket and /banlist keep working exactly as before ; those two already enforced this. /ticket category-add|category-remove now have their own separate permission from the rest of /ticket, matching the dashboard's Ticket Categories having its own page.
• The dashboard side of these 24 (server-config pages, not just Discord commands) is the last piece ; landing next.

v0.18.26New Moderator Permissions dashboard page, and a real dashboard nav fix

• Fixed: a BenchBot Moderator couldn't actually reach the web dashboard at all before this; the server list and the per-server hub page both only checked for full Administrator, so a mod-only account hit a wall before ever seeing a page meant for them.
• New Moderator Permissions page (Server Config → Moderator Permissions) lets an admin choose exactly which dashboard sections the Moderator role can open. A moderator's dashboard now shows only the sections they've been granted, not an all-or-nothing view.
• This is groundwork, not the full rollout yet: /ticket and /banlist (Discord + dashboard) are the only two features that actually check these permissions today, same as before this update. Every other checkbox on the new page is real and saves correctly, but doesn't do anything to enforce access yet ; each remaining feature gets wired up to it over the next few releases.

v0.18.25Groundwork for granular BenchBot Moderator permissions

• First step of a multi-part rollout: an admin will soon be able to choose exactly which features the BenchBot Moderator role can use, per feature, instead of the current all-or-nothing (tickets + banlist only). This release is infrastructure only ; nothing changes yet for any server, existing mod-role setups keep working exactly as before.

v0.18.24New /whitelist ; manage the Nitrado server whitelist from Discord

• New /whitelist add | remove | list (admin) ; type in a gamertag and BenchBot adds it straight to this server's Nitrado whitelist, no need to open the Nitrado panel. list also shows whether whitelist enforcement itself is currently on or off.

v0.18.23New /store admin cash-import ; bulk-migrate balances from another bot

• New /store admin cash-import ; upload a CSV (gamertag,balance) or JSON file to bulk-set Cash balances, for moving a server's players over from another killfeed/economy bot without everyone starting from zero. Previews what would change first (new vs. updated records, any unparseable rows) ; re-run with confirm:true to actually apply it. add_to_existing:true adds to current balances instead of overwriting them.

v0.18.22Fixed /player locations showing stale, undated position times

• "Server Time" on /player locations is a bare HH:MM:SS with no date straight from the ADM log, and a reconnected player keeps their last-known position until a fresh ping arrives; so two online players' displayed times could be hours or days apart with nothing showing which was stale. Now shows how long ago each position was actually recorded (e.g. "14:32:07 (3m ago)"), sourced from a real timestamp rather than the ambiguous server clock string alone.

v0.18.21Reaction role panels can post in Announcement channels

• /reactionrole create's channel picker only allowed standard text channels, so Announcement channels (a common home for a rules/roles panel) silently didn't show up as an option. Now allows both.

v0.18.20New /promo command

• Added /promo: a ready-to-post green embed with the DayZ Nerd Squad logo, a short pitch for the community/BenchBot, and links to dayznerdsquad.com and the Discord invite, meant for partner servers to share.

v0.18.19Special thanks update

• Updated Austin's (formerly listed as "Blackout Austin") credit on the welcome page and /about embed to also recognize being a top donor funding the project, alongside testing/feedback.

v0.18.18Special thanks tag fix, part 2

• The earlier fix (v0.18.8) only removed the stray "DZB Creator" tag from Jarv's credit on the public welcome page: the /about embed's Special Thanks field still had it. Removed there too.

v0.18.17Admin Base Pings

• New /baseping add|edit|remove|toggle|list: define a base by name/x/y/radius_m, and the moment a tracked player's position falls inside it, an alert posts with a real @-mention (a faction's leader/co-leader via mention_faction, and/or a specific mention_user).
• Fires once on entry, not repeatedly while camped inside; cooldown_min is a jitter backstop, not a periodic reminder.
• Needs an alert channel; set one per base ping, or a server-wide default in Server Config.

v0.18.16/faction replaces /clan

• Self-serve factions with leader + co-leader roles and a shared Cash bank, replacing the old single-owner, currency-less /clan (existing clans migrate automatically).
• create/join/leave act on your own gamertag (optional once linked); join needs a leader/co-leader's /faction accept.
• kick/promote/demote/transfer-leader manage roles; bank deposit|withdraw|balance moves Cash in/out the shared bank (withdraw needs leader/co-leader).
• disband (leader) or an empty roster ends the faction.

v0.18.15DayZ server uptime monitor

• New /server-monitor command: set a server's IP + query port and it gets checked every 60 seconds via a direct A2S status query, independent of Nitrado's own log/API polling.
• Posts to an admin-configured channel when the server stops responding (after 3 consecutive missed checks, to avoid a false alarm from one dropped packet) and again the moment it's back.
• /server-monitor status shows a live check plus current monitor config at any time.

v0.18.14Security fix: prototype pollution in /keyword and dashboard behavior-detection config

• Both the dashboard's keyword/behavior-detection config pages and the /keyword command used an admin-supplied name directly as an object key. A specially-crafted name ("__proto__") could corrupt shared internal state instead of just that one setting.
• Fixed by validating names before they're used as keys, in both the dashboard routes and the /keyword command.

v0.18.13Fixed mobile dashboard navigation

• The dashboard nav bar was hiding its entire link list (including "Your Servers") on phone-width screens with no menu to bring it back; mobile visitors had no way to navigate the dashboard at all.
• Replaced it with a working menu button that opens/closes the same links in a dropdown.

v0.18.11Loadout Generator moved to Nerd Squad Labs

• Removed the dashboard's Loadout Generator page (/g/:guildId/loadout); it never touched any per-guild data, so it fit Labs' "tool" model better than the dashboard's "configure the bot for my server" model.
• Rebuilt at dayznerdsquad.com/tools/loadout-generator, on Labs' own item/attachment database instead of a static classname list; full equipment slots plus weapon attachments, exports the same spawn-ready JSON format.
• The Discord /loadout command is unaffected; it's a separate code path and still works the same.

v0.18.10Auto-mod action label fix

• Renamed the /automod "Delete" action to "Delete + Warn"; it already posted the public warning notice on every hit, the label just never said so, which read as if a delete+warn option was missing.

v0.18.9Command usage logging

• Every slash command invocation is now recorded to the SQLite mirror (guild, user, command, subcommand, timestamp); bot.log rotates after a few days, so this was previously the only way to answer "has anyone actually used this recently."
• New /dev usage-stats (developer only): total invocations, unique users/servers, and top commands over a configurable lookback window.

v0.18.8Special thanks tag fix

• Corrected Jarv's credit line on the welcome page; dropped a stray "DZB Creator" tag that shouldn't have been there.

v0.18.7Mascot v4, angular skull eyes, no more mud

• Third pass on the nav mascot: v2's bared-teeth detail turned into an illegible dark smudge at real 20px size, so it's gone; diamond-shaped angular eye sockets read as skull-like without needing fine detail that dies at small sizes.

v0.18.6Mascot redrawn to match the real reference art

• Redrew the nav mascot again against the actual hooded-skull reference art (previous pass read as a generic ghost); sharper hood peak, skull eye sockets, nasal cavity, and a bared-teeth jaw line.

v0.18.5Redrawn mascot, real member reviews on the homepage

• Redrew the mascot mark in the nav to a cleaner hooded-skull badge.
• Added a "What people are saying" section to the homepage with real reviews from the Discord server.

v0.18.4A little visual polish, new mascot, outlined login button

• Added a small goggles-and-skull mark next to the site name in the top nav, replacing the plain dot.
• The "Login with Discord" button is now outlined instead of solid-filled, matching the rest of the site's button language.
• Cleaned up how the corner-bracket panel decoration and button styles are defined internally: no visible change, just less duplicated code to keep in sync.

v0.18.3Nerd Squad Labs is now a real tab on the site

• Added a "Labs" link to the top nav on every page, pointing at labs.dayznerdsquad.com: the DayZ modding tools site is now reachable from the main site instead of only being a bare URL you had to already know.

v0.18.2Stop announcing the dashboard runs on Express

• The dashboard no longer sends the "X-Powered-By: Express" header on every response; a small, free piece of recon info for anyone probing the site that had no reason to be public.

v0.18.1Dashboard no longer leaks internal error details

• A bug hitting any dashboard page used to be able to show a raw internal error (file paths, line numbers) instead of failing quietly. It now always shows a plain "something went wrong" message and logs the real details privately instead.

v0.18.0Security overhaul; VPN/proxy detection, rate limiting, stronger headers

• Dashboard logins from a known VPN, proxy, or datacenter address are now flagged and posted to a developer alert channel (configurable via /dev security-channel): this only notifies, it never blocks anyone from logging in.
• Added rate limiting to every mutating dashboard action and to the login callback, on top of the existing login-page limit.
• Hardened the dashboard's security headers: added HSTS, a Referrer-Policy, a Permissions-Policy, and tightened the Content-Security-Policy against clickjacking and base-tag injection.
• The bot now warns on startup if secrets are being stored unencrypted or the dashboard session secret is weak, instead of staying silent about it.
• Patched a handful of transitive dependency vulnerabilities flagged by npm audit.

v0.17.1Badge wordmark now fills the ring instead of floating small in the middle

• Bumped up the text size and trimmed the padding on the hero's DayZ Nerd Squad badge so it fills the circle the way the real logo does.

v0.17.0Homepage hero now matches the real DayZ Nerd Squad badge logo

• The hero's "DayZ Nerd Squad" wordmark is now laid out like the actual badge logo; DayZ in a bold script over a divider line over "Nerd Squad" with a ® mark, all inside the ring: instead of stacked plain text. Also added a real self-hosted script font for it, since the previous system-font cursive wasn't guaranteed to even be installed.

v0.16.0Removing the bot now automatically clears stored secrets

• When BenchBot is removed from a server, its Nitrado token and FTP password are now cleared automatically. Everything else, stats, economy, tickets, rotation history, is kept, so re-adding the bot later doesn't lose that history. Updated the Privacy Policy to match.

v0.15.1Add a copyright line to every page footer

• "© 2026 DayZ Nerd Squad™. All rights reserved." now appears in the footer alongside the legal links, on every page.

v0.15.0New: Legal pages; Privacy Policy, Terms, Cookies, and Copyright

• Added /legal with four sub-pages (Privacy Policy, Terms of Service, Cookie Policy, Copyright/DMCA), linked from the footer of every page. Written in plain language to accurately describe what this site and bot actually collect and do: not a generic template.

v0.14.0Fix: developer access to other servers' dashboards actually works now

• The dashboard already intended for the bot's developer to be able to open any server's dashboard for support, even one they haven't personally joined on Discord, but clicking through 404'd anyway because the underlying permission check still required actual membership. Fixed the check itself, dev-gated as before.

v0.13.6Fix: root-caused why the background sometimes silently failed to render

• Found and fixed the actual bug behind the background issues from the last few updates: a negative-layer positioning trick that could make Chrome silently drop the whole effect on certain pages. Rebuilt it on a safer positioning approach that renders reliably everywhere, and tuned the brightness down slightly now that it reliably shows up.

v0.13.5Fix: background wasn't rendering at all on the homepage

• The homepage's main content area and footer had an extra blur effect the dashboard didn't have; combined with the background canvas, it was silently preventing the background from rendering at all there (confirmed live: not even a plain test box would show up). Removed it; the background now renders on the homepage the same as everywhere else.

v0.13.4Fix: background now shows through behind panels too, not just in the gaps

• Panels and cards were fully opaque, so the falling-code background only showed in the empty space around content instead of feeling like it covered the whole page. They're now translucent with a blur, so the code is visible (softened) behind everything, not blocked by it.
• Fixed the new favicon actually being blocked by the same security policy that was just fixed for avatars, data URIs needed their own allowance.

v0.13.3Background is now a dense, continuous scroll of code

• The falling-code background was too sparse: one line per column with long gaps between refreshes. Every column is now a continuously scrolling, densely stacked stream (like scrolling through a real log), always covering the visible screen behind whatever page you're on.

v0.13.2Redesign: the background is now clean scrolling code, grid-aligned, no smear

• Rebuilt the falling-code background: columns are now wide enough that lines never overlap each other, aligned exactly to the page's coordinate grid, and there's no more fade/trail smear; it now reads as clean text sliding through the grid instead of a streaky blur.

v0.13.1Fix: the new background animation was too faint to actually see

• The falling-code background from the last update was real but nearly invisible; low opacity, small text, sparse coverage. It's now noticeably brighter, denser, and immediately visible on page load instead of taking a while to populate.
• Fixed a missing favicon (was silently 404ing on every page).

v0.13.0Site-wide visual overhaul: real typography, a tactical background, sharper dashboard styling

• New self-hosted display and code fonts everywhere: the old font stack silently fell back to a generic system font for almost everyone; headings and labels now actually render in the intended condensed industrial typeface.
• Every dashboard page (not just the homepage) now has a subtle animated background of drifting code lines and a faint tactical coordinate grid, instead of a flat black fill.
• Panels, buttons, tables, and forms across the whole dashboard got a sharper pass: corner-bracket panel accents, a clearer color-coded severity stripe on save banners, refined hover states.
• Fixed a long-standing bug where Discord profile pictures never actually loaded in the top nav: the security policy was silently blocking them.

v0.12.2Loadout Generator: add cargo items in bulk with a quantity field

• The cargo Add form now has a quantity field; add several of the same item in one click instead of clicking Add repeatedly, each copy auto-placed in its own cell.
• If a container runs out of room partway through a batch, whatever fits gets added and the banner says how many made it in.

v0.12.1Loadout Generator: one-click cargo, SCARH + Desert gear added

• Adding an item to a backpack or vest is now a single click: the dashboard finds a legal spot for you (auto-rotating if needed) instead of asking you to pick a position on a second page.
• Added the SCARH (including the black variant) with its magazine and Holo Optic, plus Desert-camo Plate Carrier Vest, Pouches, and a Desert Tortilla backpack.

v0.12.0Loadout Generator overhaul: real 2D cargo grids, wider attachment coverage

• Backpacks and vests now use their real internal cargo grid; pick an item, see every legal spot it can go, and place it with rotation support. A running slot counter keeps you from over-filling any container.
• Cargo automatically gets cleared out if it no longer fits; swap to a smaller backpack or unequip a vest pouch and anything that no longer has room is removed and called out on screen, instead of silently going stale.
• More weapons and rigs now expose their real attachment points, including additional magazine sizes for the M4A1/M16A2 and the Smersh Vest's utility buttpack.
• Fixed the finished-loadout instructions to reference the correct file: drop the JSON into spawnGearPresetFiles in the player data block of cfggameplay.json.

v0.11.0New: Live Ticket Management; the dashboard now covers every admin command

• Manage open tickets right from the dashboard: claim, unclaim, transfer, set priority, rename the channel, open a private staff thread, add/remove a member, send a close request, or close immediately; plus a Close All for every open ticket at once.
• This wraps up the full dashboard push: everything with real admin configuration is now available on the web, not just in Discord.

v0.10.0New: Reaction Roles are now on the dashboard

• Post a reaction-role panel, add or remove emoji-to-role mappings, and stop tracking a panel, all from the dashboard.
• Paste an emoji the same way Discord's own chat box would insert one (a unicode character, or a custom emoji tag); there's no dashboard emoji picker yet.

v0.9.0New: Full Server Setup is now on the dashboard

• One-click setup of every BenchBot feed, dynamic-event, game, utility, and ticket channel, plus the BenchBot Admin role: the same thing /setup auto-channels does in Discord, now with a button. Safe to run more than once.
• A matching "Remove All" action tears every auto-created channel back down, gated behind a confirmation checkbox.

v0.8.0New: Loadout Generator is now on the dashboard

• Build a full DayZ loadout right from the dashboard: every equipment slot, weapon attachments (magazines, optics, buttstocks, and what's inside a holster/sheath), and cargo, then download the ready-to-use JSON file.
• Every equipment slot shows its complete item list on the web (no 24-item cap like Discord's dropdown), so nothing's hidden behind a search box anymore.

v0.7.0New: Event Creation is now on the dashboard

• Create airstrikes, gas strikes, custom vehicle spawns, and hordes right from the dashboard: one page instead of Discord's step-by-step menu, plus a live spawn list you can remove from or (for hordes) adjust the zombie count on.
• Scheduled cleanups (auto-removal 15 minutes after the next restart) are shown right on the same page.

v0.6.0New: Channel Management, Loot Feed, Giveaways, Ticket Setup, and the rest of Server Config are now on the dashboard

• Server Config now also covers the default channel, bot-trap, BenchBot Admin/Moderator/Auto roles, and encrypted backup export/import: all with live channel/role pickers, a first for the dashboard.
• Keywords can now be scoped to specific channels from the dashboard, matching what /keyword channel-add already did in Discord.
• New pages: Channel Management (create event channels, bulk visibility), Loot Feed (channel + an inline spawn map), Giveaways (start/list/reroll), and Ticket Setup (post the panel, or run quick setup), 4 more pages, 22 per-guild total.
• Developers now also get a Global Watchlist Review page (approve/deny pending reports), separate from each server's own dashboard.

v0.5.0New: Store/Economy, Server Config, Keywords, Teleporters, Ticket Categories, and the Global Watchlist are now on the dashboard

• Dashboard now covers Store & Economy (cash config, give/take/set balances, earning zones, items, kits), Server Config (Nitrado credentials, map, farewell DM, live server status, channel routing), Keywords, Teleporters, Ticket Categories, and the guild-scoped half of the Global Watchlist, 6 more pages, 18 total.
• This is the first batch of "quick win" modules from the larger dashboard-parity push ; several harder areas (event creation, loadout generator, live ticket management, and the rest of server setup) are still coming in later updates.

v0.4.0New: 10 more admin features now configurable from the dashboard

• Dashboard now covers Casino (global chips toggle), Economy (audit report), Custom Classnames, Links, Gamertag Links (admin), Bounty config, Automod (checks + word list), Behavior Detection (all 7 detectors), Alt Account scan, and Suggestion resolution, 12 pages total, up from 2.
• New per-server hub page (click "Manage" from Your Servers) links to every dashboard page for that server in one place.

v0.3.2New: persistent site-wide nav bar, dashboard reskinned to match the homepage

• A real top nav bar (Home, Discord, contextual links, login/logout) now appears on every page, public homepage and admin dashboard alike, replacing the earlier per-page dropdown. Always a way back to Home from anywhere in the dashboard.
• The whole dashboard (Rotation, Base Damage, Your Servers, Recent Logins) is reskinned to match the public homepage's black/green DayZ Nerd Squad identity, instead of a generic admin-panel look bolted onto a branded homepage.

v0.3.1New: dashboard page-picker dropdown, including a way back to the homepage

• Every logged-in dashboard page now has a "Go to…" dropdown in the header; Home (About Us) and Your Servers always, plus a quick link between Rotation and Base Damage when you're already on one of those for a server. Previously there was no way back to the public homepage once logged in.
• New /about route: always shows the public homepage regardless of login state, giving the dropdown a stable destination.

v0.3.0New: dashboard login audit log ; developers see every guild in the picker

• New developer-only /logins page: a real "who logged into the dashboard, from where" view (username, Discord ID, IP, location, timestamp), instead of only being visible by grepping bot.log by hand. Bot-wide and developer-only on purpose: this bot serves several unrelated Discord communities, and login IPs/locations from one guild's admins have nothing to do with another's.
• The guild picker now lists every guild the bot is in for developers, not just ones they personally administer; matches the bypass /g/:guildId routes already granted developers, just makes the picker consistent with what clicking through already allowed.

v0.2.9Homepage: SEO basics (meta description, social preview tags, robots.txt, sitemap.xml)

• The public homepage had no meta description or Open Graph/Twitter card tags: both search engine snippets and link previews (Discord, etc.) were showing nothing useful. Added a real description plus social preview tags, a robots.txt pointing at a new sitemap.xml, and a canonical URL tag.

v0.2.8Fix: login cookies scoped to the wrong domain (root vs. dashboard subdomain)

• Cookies default to "host-only"; dayznerdsquad.com and dashboard.dayznerdsquad.com count as different hosts under that rule, even though one looks like a subdomain of the other. This caused two confirmed bugs, reproduced live: a session started on one domain wasn't recognized on the other, and clicking "Login with Discord" from the root domain's welcome page failed every single time (the state cookie got set on the wrong host for the callback, which always lands on the dashboard subdomain). Cookies are now explicitly scoped to the whole domain, fixing both.

v0.2.7Dashboard login: longer state-cookie window

• The login-state cookie (protects the OAuth handshake against CSRF) lasted 5 minutes ; extended to 30. Real-world delay reading Discord's consent screen, entering 2FA, etc. was hitting "Login failed; invalid or expired state" more than it should.

v0.2.6Fix (actual root cause): dashboard login was never reaching the session check

• Found it: GET / branched on req.hostname to decide between the public homepage and the real dashboard, added when a second domain was still expected to work. PebbleHost's reverse proxy doesn't forward the original Host header the way that logic assumed, so on the live server req.hostname never matched and every single request got intercepted before ever reaching the session-checking code; explaining why bot.log kept confirming successful logins while the browser stayed logged out no matter what, through two earlier fix attempts that addressed real but ultimately unrelated issues (Set-Cookie/redirect handling, caching). That hostname branching only ever existed for the second-domain case, which is no longer in use, so it's removed outright; GET / is hostname-independent now.

v0.2.5Fix attempt #2: dashboard login still not sticking in the browser

• The single-Set-Cookie-header fix in 0.2.4 wasn't enough; bot.log kept confirming successful logins server-side while the browser stayed logged out. Two more changes: every dashboard response now sends Cache-Control: no-store (a caching layer serving a stale pre-login page for "/" after the redirect is a real candidate), and the post-login redirect no longer uses a 3xx status; it's a 200 page with a client-side refresh instead, since a redirect response combined with Set-Cookie was the other suspect. Root cause still not 100% confirmed ; this needs a live retest.

v0.2.4Fix: dashboard login silently failed to actually log you in

• /auth/callback was setting two Set-Cookie headers in the same response (clearing the old login-state cookie, and setting the new session cookie) ; confirmed live that the login completed successfully server-side (Discord auth, code exchange, session built) but the browser never ended up logged in; most likely the hosting reverse proxy only forwarding one Set-Cookie header per response. Now sends exactly one per response ; the state cookie is left to expire on its own short (5 min) lifetime instead of being explicitly cleared alongside the session cookie.

v0.2.3Dashboard: about-me landing page, login rate limiting, login IP logging

• dashboard.dayznerdsquad.com's logged-out page now shows the same about-me content (Bench's story, community highlights, Discord invite) as the public homepage, with a clear "Login with Discord" link through to the actual admin dashboard: instead of a bare login screen. Since PebbleHost's reverse proxy only supports one domain per server, this consolidates everything onto the one domain that's actually reachable.
• /auth/login is now rate-limited (20 attempts per IP per 10 minutes): the one truly public, unauthenticated entry point, now that the dashboard is actually internet-exposed.
• Every successful dashboard login now logs the admin's IP address (and best-effort city/region/country) to bot.log, for visibility into who's accessing it.

v0.2.2Fix: dashboard + homepage were rendering completely unstyled

• The dashboard's Content-Security-Policy header (default-src 'self') was silently blocking every inline <style> (and now <script>) tag on every dashboard page and the public homepage: confirmed live in a real browser (plain unstyled HTML, no visible error). No build step means no separate CSS/JS files to point a stricter policy at, so style-src/script-src now explicitly allow 'unsafe-inline'. Automated tests use fetch(), which never enforced CSP, so this went unnoticed since the dashboard first shipped in v0.2.0.

v0.2.1New: public homepage at the root domain, alongside the admin dashboard

• The bot's web server now answers on two audiences from the same process/port: the admin dashboard on its own subdomain, and a public homepage (Bench's own story, what the community offers, special thanks, and a Join Discord button) on the root domain / www; branching on which hostname the request came in on. No new port or config needed beyond pointing both domains at the same reverse-proxied port.
• The homepage's story section reuses the exact same text as /about (now a shared export) rather than a separately maintained copy, so the two can never drift apart.

v0.2.0New: admin web dashboard (foundation + /rotation, /basedamage)

• A browser-based admin dashboard, gated behind Discord login (OAuth) ; only shows servers where you're actually an admin (real Administrator, or this bot's own configured admin role), checked live against Discord every time, same as every admin command already does. Runs in the same process as the bot, on its own opt-in port (unset = fully disabled, same convention as the existing /health endpoint).
• Covers /rotation (view pool/status, trigger a rotation, enable/disable) and /basedamage (view schedule, set timezone, apply now) so far ; everything else is still Discord-only. More commands move over gradually: see ARCHITECTURE.md's "Adding dashboard support for a feature" for the pattern.
• Requires the bot's host operator to configure it (DASHBOARD_PORT/DASHBOARD_BASE_URL/DASHBOARD_CLIENT_SECRET/DASHBOARD_SESSION_SECRET in Bone.env, a matching OAuth redirect in the Discord Developer Portal, and, separately, pointing your host's reverse proxy at the port once you're ready to make it reachable). Nothing changes for servers that don't set this up ; it stays fully inert.
• Adds a new dependency (Express) ; deploying it requires node deploy.cjs --with-deps once, in addition to the usual deploy, or the bot won't start at all on a host that doesn't already have it.

v0.1.104Fix: horde zombie count, part 2 ; the territory zone had its own separate cap

• Bug: on top of the children-max fix from the last update, a horde's territory zone (env/zombie_territories.xml) has its OWN independent population cap (smin/smax/dmin/dmax), hardcoded to 100 regardless of requested count. Confirmed live: nominal=200 with this still at 100 actually capped at 100.
• Horde creation and Edit Zombie Count both now set the zone's dmin/dmax to match the requested count (smin/smax stay 0, matching vanilla's own purely event-driven zones like infected villages/cities, as opposed to a static pre-placed patrol).
• This should be the actual full fix ; between this and the last update, every hardcoded population cap on a horde (nominal, children max, and now the zone's own cap) tracks the requested count.

v0.1.103Fix: hordes silently capped at 20 zombies no matter what zombie count was set

• Bug: every horde's children were hardcoded to max="2" each at creation, regardless of the group's target count (nominal). DayZ can only actually reach nominal if the SUM of every child's own max is at least that high, so this silently capped most hordes around 20 (matching the also-hardcoded default target) no matter how high nominal was later set via Edit Zombie Count.
• /createevent's Horde creation form now asks for zombie count up front (previously only zone radius) ; each child's own max is now set to match, so the real cap actually is what you asked for.
• Edit Zombie Count now updates every child's max alongside nominal, so existing under-provisioned hordes can be fixed by just re-running it with the intended count.

v0.1.102/teleport: visible marker objects

• /teleport create now takes an optional marker_classname (e.g. a sewer cover) ; a PRA trigger box is completely invisible in-game, so without something physically marking the spot there was no way to know where to stand. Spawns at every real trigger point (just origin for one-way, both ends for two-way), using the same object-spawner mechanism /store buy already uses.
• Unlike the teleport's own origin_y/dest_y, the marker's height does NOT auto-snap to terrain; give it a real Y or the marker may spawn buried or floating. The create confirmation warns if no height was given.
• /teleport remove and the temporary auto-cleanup (15 min after restart) both clean up the marker too, not just the teleport itself.

v0.1.101/teleport: height (Y) is now optional

• /teleport create no longer requires origin_y/dest_y ; DayZ resolves both the trigger box and the destination to the real terrain surface at the given X/Z regardless of the stored height, so most teleporters only need X/Z. Still overridable for the rare case you want a specific elevation (e.g. a particular floor of a building).
• Confirmed against a real cfggameplay.json that playerRestrictedAreaFiles does live under WorldsData, as /teleport already assumed ; no behavior change there, just removes the last open question from last update's entry.

v0.1.100New: /teleport ; in-game teleporters

• /teleport create name:<> mode:<temporary|permanent> direction:<one-way|two-way> origin_x/y/z:<> dest_x/y/z:<> ; standing in the origin spot moves a player to the destination. Temporary auto-removes it 15 minutes after your server's next restart (same toggle /createevent already has); two-way also creates the return trip back. Same FTP credentials as /rotation.
• /teleport list shows what's configured; /teleport remove name:<> (autocompletes) deletes one, whether it was ever actually used or not.
• Brand new mechanism for this bot (DayZ's Player Restricted Area files) ; recommend testing on a low-stakes spot first before relying on it for anything important.

v0.1.99/help ; how to hide commands from regular members

• New /help entry (Setup & Configuration) explaining Discord's own command-visibility settings ; Server Settings → Integrations → BenchBot lets you hide any command from members without the right role, on top of this bot's own admin/mod/dev gating. Easy to miss since it's not surfaced anywhere else, so it's now spelled out step by step.

v0.1.98Backup restore, repeated-error alerting, and CI

• /setup backup-import: the other half of /setup backup-export : restores a server's BenchBot data from a backup file + its one-time passphrase, on this server or a different one. Completely overwrites whatever's currently saved, so it requires confirm:true, and keeps a local safety copy of the pre-restore data either way. Nitrado/FTP credentials are never included and always need reconfiguring afterward.
• Split the Setup & Configuration help category in two (new "Automation & Tickets" category) ; it was pushing right up against Discord's per-embed size limit and had no room left for new entries.
• New, developer-only: repeated process-level errors (several within a short window) now get alerted to a configurable channel (/dev error-channel), instead of only ever being visible in the raw server log. This bot already deliberately keeps running through an unexpected error rather than crashing (a full restart isn't reliable on this host) ; this just makes sure that doesn't go silently unnoticed if it starts happening a lot.
• Added a CI pipeline ; every push now automatically runs the same checks (syntax, lint, types, the full test suite) that were previously only ever run by hand before a deploy.

v0.1.97/help audit ; a few real features that were missing from it, plus a channel-setup gap

• /setup auto-channels now also creates the Chat and Cash Earned feed channels ; both were valid /channel create types already actively used by the live feed, but auto-channels silently skipped them, so they only ever showed up if you knew to add them by hand.
• /help now documents /setup mod-role (a lighter permission tier than bot-admin-role, for day-to-day moderation only: banlist, ticket claim/close), /setup backup-export (encrypted data backup download), /keyword channels-add/channels-remove (server-wide keyword channel scoping), /basedamage enable/disable/schedule-list, and /game currencies ; all real, already-shipped features that had never made it into the reference menu.

v0.1.96Kill feed: hit location shown, raw coordinates now optional ; link notifications

• Kill feed now shows which body part was hit (when the log line captured one), alongside the existing weapon and distance.
• Kill feed raw Coordinates now respect the existing /setup location-format setting, same as dynamic events already do ; "town" (the default) shows the Nearest Town instead of raw numbers, falling back to Coordinates only when no town is nearby. Switch back with /setup location-format format:coordinates.
• /link set and /link admin set now post a notice to the Moderation Log channel (if one is configured with /setup) when someone links their account ; the reply to the person linking stays private, this just gives admins visibility without having to ask around.

v0.1.95Fix: a bot restart could silently skip a scheduled rotation

• Bug: if the bot was offline for even a minute or two at an exact scheduled trigger time (a redeploy, a host restart, a crash), that whole day's rotation for that time just never happened, with no error, no message, nothing to explain why. Fixed ; a scheduled time now catches up automatically within 3 hours of when it was supposed to fire, so brief downtime around a scheduled time no longer means a silently missed rotation.
• /rotation times add now switches trigger mode to "specific times" automatically (told to you in the reply) ; one less step to set up a schedule, no more separately running /rotation trigger mode:<specific times> first.

v0.1.94New: /rotation can trigger at specific daily times

• /rotation trigger mode now has a third option: "At specific times". Set a timezone with /rotation times timezone zone:<IANA>, then add one or more daily trigger times with /rotation times add time:<HH:MM> ; e.g. time:17:00 for once a day, or time:5:00,19:00 (comma or dash both work) for twice a day. /rotation times remove/list manage the list, /rotation status shows them.
• Each configured time fires its own independent rotation, once a day ; "5:00-19:00" means "fire at 5:00 and fire at 19:00", not a continuous window (rotation swaps which pool files are active, it doesn't have an on/off state to hold open for a range).

v0.1.93Fix: /rotation pool list was hiding the file path once a name was set

• Bug: once a pool entry had a friendly name (e.g. "Dambog Convoy"), /rotation pool list/status stopped showing its actual file path at all ; the only value pool edit/remove actually match against. Typing that friendly name into pool edit/remove (the only value visible) failed with "isn't in the pool", even though the entry was right there.
• Fixed ; the file path now always shows alongside the name. /rotation pool list also now shows each entry's announcement description underneath it (if one is set), truncated to 80 characters.
• pool edit/remove now also recognize when you typed a friendly name instead of the file path, and tell you exactly which path to use instead of just failing.

v0.1.92/fuck renamed to /f__k

• Renamed /fuck to /f__k ; asterisks aren't allowed in Discord command names, so underscores stand in for the censored letters instead, matching the f**k censoring already used in its embed text. Everything else about the command (flavor text, gifs, availability everywhere) is unchanged.

v0.1.91/smd and /fuck now work everywhere

• Removed the NSFW channel restriction from /smd and /fuck ; they now work in any channel, same as the other four action commands.
• Any spelled-out profanity actually shown in the embed (the punch flavor line, the /fuck embed title) is now asterisk-censored, since these can post outside NSFW-marked channels.

v0.1.90/kiss gifs added

• /kiss now has its own curated gif list, same as the other five action commands ; it was shipped without one last version.

v0.1.89New: /hug, /kiss, /punch, /smd, /fuck, /crashout

• Six new action commands ; each posts a flavor-text embed plus a random gif aimed at whoever you target with user:<@member>, drawn from a hand-picked list per command (not a live search) so what posts is always something actually vetted. /smd and /fuck are NSFW-flagged (Discord restricts those two to channels marked NSFW, or DMs) since they're the crude two of the six ; /hug, /kiss, /punch, /crashout aren't restricted.
• /kiss doesn't have any curated gifs yet ; posts flavor text only until some are added.

v0.1.88New: /rotation pool edit

• New /rotation pool edit file:<> lets you update an already-added pool file's name, coordinates, announcement title, or description without re-adding it. This already worked by re-running /rotation pool add with the same file (it upserts), but that wasn't obvious from the command itself ; edit makes it a dedicated, discoverable action. /rotation pool add still works the old way too, nothing removed.

v0.1.87New: /support, and a clearer /rotation

• New /support ; get a link to the developer's support server (DayZ Nerd Squad) for bug reports, questions, or feature requests.
• /rotation reworked for clarity. /rotation schedule's three unrelated settings (trigger mode, interval, and how many pool files are active) are split up: /rotation trigger now covers only when a rotation fires, and /rotation pool active-count count:<n> covers how many pool files are live at once.
• Both /rotation status and /rotation pool list now spell out the actual pattern your pool size + active count produces, e.g. "1 active out of 8 at a time ; cycles through 8 groups of 1" or "5 active out of 10 at a time ; cycles through 2 groups of 5" ; the two example configs (one file live out of a larger pool; half the pool in / half out) both already worked, they just had no way to see or configure that from the command itself.

v0.1.86New: /purgechannels ; delete a whole category in one shot

• New /purgechannels category:<#category> (admin) permanently deletes a category and every channel inside it, message history included. Shows exactly which channels are about to go and requires a confirm click first, same safety pattern as /purge and /store admin cash-wipe.
• A separate command from /purge, not a subcommand of it ; Discord doesn't allow mixing a command's own options with subcommands, so folding this into /purge would've broken /purge amount:<> for every admin already using it.

v0.1.85New: fully editable ticket categories

• The 5 ticket categories (Player Report, Ban Appeal, ...) used to be fixed for every server. New /ticket category-add label:<> description:<> and /ticket category-remove index:<> (see /ticket category-list for the numbering) let each server customize its own list ; shown both on the panel's category picker and in /ticket createticket.
• /ticket createticket's category field is now search-as-you-type instead of a fixed dropdown, so it can reflect a server's actual (possibly customized) category list instead of Discord's static built-in choices.
• Removing a category doesn't touch tickets already opened under it ; they keep showing the old name until closed.

v0.1.84Fix: /link now warns before linking a gamertag that's never played here

• /link set and /link admin set now check whether the gamertag being linked has ever actually been seen on this server (real recorded stats, or currently online) before linking it ; if not, they warn instead of silently succeeding, and need confirm:true to proceed anyway.
• Found from a real case: an admin linked a member to a gamertag that turned out to belong to a different platform's account and had never once appeared in this server's logs. The link itself "worked" with no error, but every downstream command reading off it (Cash balance, achievements, stats) then silently showed nothing, with no indication the gamertag was ever wrong in the first place.
• This still can't verify real ownership (no RCON on this console server, same limitation as before) ; it only confirms the gamertag itself is real on this server, which catches the much more common typo/wrong-platform mistake.

v0.1.83New: /basedamage ; schedule raid protection by time and day

• New /basedamage ; turn base damage (and, independently, container damage) off during scheduled windows by day of week and time of day, e.g. "protected every night 10pm-6am" or "protected all weekend."
• Set a timezone once with /basedamage timezone, then build a schedule with /basedamage schedule-add/schedule-remove/schedule-list ; /containerdamage has the same controls for the separate container-damage flag.
• DayZ only reads this setting when the server itself restarts, and this bot can't force a restart, so nothing gets kicked off schedule changes ; the bot just keeps the setting queued and ready, and it takes hold whenever the server next restarts for any reason. /basedamage status shows both what's queued and what's actually live right now.

v0.1.82Clarity pass 2: the rest of the bot, plus a couple of real bugs it turned up

• /events is now /activitylog ; "event" already means five different things across this bot (DayZ dynamic events, admin-created events, rotation pool entries, bench/range bonus moments), so the generic connect/disconnect/kill/position log gets its own name.
• Fixed a leftover from the last update: several bench/range shop items and flavor lines still said "PR" instead of "best"/"record" (Wraps slot label, Personal Trainer, Wrist Wraps/Knee Sleeves/Full Support Gear, Adrenaline Shot, and two of the three legendary-moment flavor lines).
• /ticket add|remove|transfer|priority|rename|thread were labeled "(staff)" but actually required full Administrator ; fixed to match their label, so anyone with the configured mod role can use them, same as claim/unclaim/closerequest already could.
• Player-visible messages no longer show raw internal log tags ("Source: ADM/RPT") ; removed from /player locations and every live feed embed (position, connect, disconnect, death).
• /channel list now shows friendly channel-type names instead of internal slugs (e.g. "Territory Flag" instead of "flag"). /status no longer shows raw byte-offset debug info.
• Event/rotation announcements: dropped the internal "rotated in" phrasing, no longer show a raw file path when an admin didn't set a friendly name, and a nameless entry now just says "New Event" instead of "New Event: Unnamed Event".
• Assorted smaller wording fixes across /achievements, /classname, /distance, /dev, and a dead leftover menu entry removed from /createevent.

v0.1.81Clarity pass: friendlier names and wording across the player-facing commands

• /bench pr is now /bench best, matching /range best ; "PR" is renamed "Best Lift"/"Best Distance" everywhere it shows up.
• /link whoami is now /link status. /opt is gone ; its job moved to /casino global-chips (admin), right next to the rest of the casino settings it actually controls.
• /ban-smile is now /fake-ban. /leaderboard's wealth category was mislabeled "Cash" when it's actually Dollars ; fixed, plus "KDR" now spells out "Kill/Death Ratio".
• New /game currencies ; a plain-language rundown of all six currencies (Dollars, Plates, Bullets, Cash, Chips, Salvage), what each is for, and how to earn/spend it.
• Assorted description and reply wording cleaned up across /store, /economy, /bounty, and elsewhere for anyone new to the bot.

v0.1.80New: developer override, dev-only guild deactivation, and manual banlist review

• The bot's developer now passes every admin/moderator-gated command in any server, joined or not yet configured ; no more depending on that server's own permission setup to fix or configure things.
• New /dev guild-deactivate/guild-reactivate/guild-list (developer only) ; makes the bot go fully quiet in a specific server (no commands, no messages, no polling) without leaving it or losing its data.
• The global watchlist used to auto-verify an entry the instant 2 servers reported the same gamertag, with no human review. New reports still show up immediately as Unverified, but reaching Verified now requires an explicit approval in a review channel ; a new "Rejected" tier records an explicit decline separately. Already-verified entries were grandfathered so nothing regresses.

v0.1.79New: /keyword channels-add ; mass-scope every keyword response at once

• Restricting where keyword responses fire used to mean scoping each keyword individually via /keyword channel-add, one at a time. New /keyword channels-add/channels-remove set a server-wide channel list instead ; once any are set, every keyword response (including ones added later) only ever fires in those channels, full stop. /keyword list now shows this alongside each keyword's own scope.

v0.1.78New: moderator role, encrypted backup export, and confirm-before-delete on bulk actions

• New /setup mod-role: a lower-trust role (below full admin) that can now handle day-to-day banlist reports/disputes and ticket claim/close, without needing full Administrator access.
• New /setup backup-export; download this server's full BenchBot data as an encrypted file, on demand. Nitrado/FTP credentials are always redacted from the export. No restore command yet.
• /purge and /ticket closeall now ask for confirmation (same Danger/Cancel button style as /store admin cash-wipe) before permanently deleting messages or closing every open ticket: both used to fire immediately with no way to back out.

v0.1.77Fix: Cash balances now display as real currency, not raw floats

• A Cash balance could display as something like 1002284.8332666666: the automatic playtime reward was crediting a raw, un-rounded fractional amount straight to the ledger instead of rounding to the nearest cent. Every Cash amount and balance shown anywhere (/store, purchase confirmations, the Cash Earned feed, admin give/take/set) now renders like real currency: $1,002,284.83, capped at 2 decimal places with a dollar sign.

v0.1.76Internals: non-blocking data persistence, wider retry coverage, richer health metrics

• Saving guild/global data used to write to disk synchronously, blocking the whole bot for every write: now fully async, with a new per-file write queue so two saves to the same file (a command racing a poll cycle, say) always land safely in order instead of corrupting each other.
• Sending a live-feed batch to Discord now retries once on a timeout or a 5xx before giving up, instead of silently dropping the whole batch on a single blip.
• /health's JSON now also reports memory usage, last poll-cycle duration, pending-write queue depth, and retry/failure counters: purely informational, no change to the existing healthy/unhealthy signal.

v0.1.75Style: every embed, reply, and DM now uses a semicolon instead of an em dash

• Purely cosmetic ; every user-facing string across the bot (embed titles/descriptions/fields, replies, DMs, autocomplete text) had its em dashes (; ) swapped for semicolons (;). Code comments were deliberately left untouched.

v0.1.74New: /setup farewell-dm ; opt this server out of the farewell DM

• The farewell DM added last version is opted in by default (unchanged) ; /setup farewell-dm choice:No now lets a server opt out entirely, same yes/no framing /casino global-chips already uses for the shared Casino Chip economy. /setup view shows current status.

v0.1.73New: a farewell DM when a member leaves

• Whenever someone leaves (or is kicked from) the server, the bot now DMs them a short, warm goodbye ; thanks for the time spent, an invitation for feedback, signed "; {Guild Name} Admins". No setup required, and it fails silently for anyone with DMs closed or who has blocked the bot.
• Sent alongside the existing Moderation Log "Member Left" post, not instead of it ; the two are independent (the DM has no channel dependency at all).

v0.1.72New: Cash Earned feed ; players now actually see when they earn Cash from playing

• Cash earned from live gameplay (kills, PvP hits, base building, flag raises, playtime, travel, zone visits) used to only ever silently update a gamertag's balance ; nothing ever told a player it happened. Set up a Cash Earned channel (/channel create) and every payout now posts there: who, how much, and what triggered it (with location, when the triggering event had one).
• Naturally rate-limited by each reward's own existing cooldowns/thresholds (unlike the loot feed), so this uses the same per-event batching every other feed already uses, not a condensed summary ; routed through the normal REPORT_CASH_EARNED toggle (on by default).
• A reward configured to 0 (an admin turning that source off via /store admin config) now correctly produces no notification either, instead of announcing "earned 0 Cash."

v0.1.71/bounty overhaul: configurable duration, paid tracking pings, full admin config

• Duration is no longer a fixed 14 days ; /bounty place gained duration_days (extending past the server's basic duration costs a per-day fee) and tracking:true, a paid add-on that pings the target's last-known location in the bounty channel on a repeating interval. Both are one-time, non-refundable costs, charged up front alongside the reward ; only the reward itself is escrowed and refunded on cancel/expiry/unclaimed-expiry, same as before.
• New: /bounty admin config ; minimum and maximum reward, the free "basic" duration and the cost per extra day, the maximum duration a placer can pay up to, tracking's one-time cost and ping frequency, and the claim window (previously a fixed 7 days). Every number in this feature is now tunable per server.
• /bounty list now shows each bounty's duration and flags tracked ones.

v0.1.70New: /lootfeed map ; a color-coded map of where loot has actually spawned

• New: /lootfeed map [days] renders a dot per recorded loot spawn location on your server's map, color-coded by classname ; the top classnames (by how often each has spawned) each get their own color, everything else shares one "Other" color, with a legend in the reply naming each. No on-image text (same reason /player track uses colors instead of labels ; no font is guaranteed to be installed on this host), so identity comes from the legend, not the image itself.
• Backed by a new bounded history (up to 5,000 recent "added" spawns, oldest evicted first) recorded automatically whenever the loot feed is on ; depleted/removed events aren't plotted, since they mark something that was already there going away, not a new spawn location.
• Read-only and open to everyone, same treatment as /heatmap and /player track ; only /lootfeed channel (the auto-posting config) is admin-gated.

v0.1.69Loot feed gets its own dedup budget ; high volume can no longer evict other feeds' recent history

• A busy loot cycle (hundreds of add/depleted/removed events) previously shared the same 500-entry recent-events cache as every other feed type ; enough loot in one cycle could evict recently-seen kills/hits/chat/etc. purely because of volume, not because they were actually stale, risking a rare double-processed non-loot event (double-counted Cash/stats, a duplicate feed line).
• Loot events now dedupe against their own separate, much larger budget (5,000 vs. the shared 500) ; this was the one real correctness cost of routine loot volume; everything else about it (parsing cost, per-event bookkeeping, and ; most importantly ; the single condensed Discord message per cycle regardless of count) was already cheap and doesn't scale with volume.

v0.1.68Fixed: a single failed Discord login could take the whole bot fully offline

• Caught live: client.login() rejected on a transient Discord API 500 (fetching gateway info, before the websocket even opens) ; with nothing else keeping the event loop alive yet (no timers/listeners exist until 'ready' fires), the whole process quietly exited instead of crashing loudly. PebbleHost's own auto-restart then backed off after a couple of quick repeats, leaving the bot fully offline until someone noticed and restarted it by hand.
• Login now retries with capped exponential backoff (5s up to 5 minutes), indefinitely, on any transient failure ; a Discord API hiccup or network blip self-heals the moment it clears instead of requiring manual intervention. An actual invalid/revoked token (401) is treated as the permanent misconfiguration it is and does NOT retry forever ; logged clearly instead of buried under identical retry lines.

v0.1.67New: /lootfeed ; a condensed feed for Central Economy loot placement/cleanup

• New: /lootfeed channel channel:<> designates where the bot posts a condensed summary of routine loot activity ; items added, depleted (fully used up), and removed (cleaned up) by the server's own economy. Off by default via a new REPORT_LOOT setting (Bone.env) even after a channel is set ; this is the single highest-volume thing this bot can parse, so it stays opt-in.
• Deliberately condensed: one embed per poll cycle with pure aggregate counts (e.g. "+ Added: 47 ; BalaclavaMask_White x12, ZmijovkaCap_Red x8...") and the top spawned classnames, never a message or field per individual item the way every other feed here works ; a busy server can log hundreds of these lines a cycle.
• A routine performance-warning line ("[CE][LootRespawner] ... is hard to place, performance drops") is correctly ignored ; it's diagnostic noise, not a real add/cleanup event.
• /setup view now also shows the configured Loot Feed Channel alongside the rest of your config.

v0.1.66Added Community Terms & Software License notice to onboarding and /setup view

• The bot now posts a one-time welcome message when it joins a new server (in the system channel, or the first channel it can post in) introducing /setup and including: "By using DayZ Nerd Squad™ services, you acknowledge and agree to our Community Terms and Software License."
• The same notice now appears in /setup view's footer, so it stays visible any time an admin checks their configuration ; not just once on joining.

v0.1.65New: /keyword channel-add | channel-remove ; stop keywords firing in unrelated channels

• A keyword fires in every channel by default, same as before ; but you can now restrict one to specific channels with /keyword channel-add word:<> channel:<>, and undo it with channel-remove (removing the last restricted channel reverts a keyword to firing everywhere again).
• /keyword list now shows each keyword's current channel scope alongside its response text.
• Existing keywords from before this update are unaffected ; they keep firing everywhere until you explicitly scope them.

v0.1.64Removed /store sell

• /store sell and item-add's sell_price option are gone ; Corna Store is buy-only now. Existing catalog items keep whatever sellPrice they had stored, but nothing reads it anymore.

v0.1.63Fixed: purchases now actually spawn ; Corna Store rewritten to use this server's real object spawner

• A live test purchase confirmed the previous mechanism (writing a custom event into db/events.xml + cfgeventspawns.xml, the Central Economy system) completed and deducted Cash but never actually spawned anything ; this server's mission setup uses DayZ's separate "Custom Files" object spawner (the same vanilla mechanism /rotation already manages for its own file pool) for admin-placed static objects, not a CE event.
• /store buy now writes purchases into custom/BenchBotStore.json, registered once in cfggameplay.json's object spawner list ; confirmed against a real live spawner file's exact schema (field names, nesting, and pos/ypr axis order) before shipping, not guessed from documentation. Still spawns after the next restart and is auto-removed 15 minutes after that, same as before.
• Saved locations now include height/elevation, not just X/Y ; this file format has no terrain-snap fallback the old mechanism had, so an accurate height matters. /store setlocation gained a height option; last-known in-game positions already had this data captured (poller.js) but it was never surfaced until now.
• /store buy gained optional x/y/height options to spawn at custom coordinates for just that one purchase, without touching your saved location ; the player now genuinely chooses between "use my saved spot" and "type coordinates this time," not just one or the other.
• The "no saved location yet" button (added last version) now opens a 3-field modal (X/Y/Height) prefilled from your last known in-game position when available ; accept as-is to use it, or edit any field to enter your own.
• The Purchase Complete confirmation now shows the actual spawn coordinates and nearest town, so a purchase is never silently opaque about where it's headed.
• A saved location from before this update (missing height) is treated the same as "no location" ; you'll be prompted to set one again with the new 3-field flow rather than risk a purchase spawning with a broken/missing elevation.

v0.1.62/store is now Corna Store ; visual identity, easier location-setting, bulk economy admin tools

• The shop is now branded Corna Store throughout, and every /store embed has its own color and 🛒 icon instead of sharing UI_COLOR.gold + the generic money icon with every Discord-side minigame (/economy, /casino, /bench, /bounty, /expedition, ...) ; Cash now reads as visibly different from Dollars/Plates/Bullets/Chips/Salvage, not just a different word.
• Fixed a real label collision behind that confusion: /economy and /bank balances showed a "Cash:" row under your Dollars ; now labeled "On Hand:" so it no longer looks like the same currency /store uses.
• /store buy now offers a 📍 Set Location button right in its "no saved location yet" reply ; opens a coordinate form and saves it in place, instead of only pointing you at a separate /store setlocation command.
• Every gamertag option that means "your own gamertag" ; /clan create|join|leave|disband ; is now optional and falls back to your /link, matching how /store's own commands already worked. No player should ever have to type their gamertag twice once linked.
• New: /store admin config starting_balance ; sets the Cash a brand-new gamertag starts with (applies the moment their ledger record is first created, however that happens).
• New: /store admin cash-give-all ; pays every gamertag with an existing Cash balance at once.
• New: /store admin cash-wipe ; permanently deletes the entire Cash ledger (balances, earn cooldowns, travel progress) after a button confirmation. Everyone restarts fresh at starting_balance next time they're touched.

v0.1.61Feed cleanup: emoji channel names, clearer hit/death/location info

• Every channel /setup auto-channels creates now leads with its own emoji instead of a "dayz-" word prefix (e.g. #dayz-kill-feed is now #💀-kill-feed) ; applied consistently across feeds, dynamic events, games, utilities, and tickets. /remove auto-channels already knows the new names, so it still cleans up correctly.
• /setup auto-channels no longer creates a dedicated chat-log channel ; /channel create type:chat is still available any time you want one manually.
• The hit feed now shows the victim's remaining HP when the log line includes it.
• The kill feed no longer attaches a zoomed map-crop image ; the embed's own coordinates/nearest-town/map-link fields already cover it without an extra render per kill.
• The death feed no longer reports a hedgy "Likely Dehydration + Bleeding (N sources)" ; active bleeding (fast blood loss) is now reported as the cause outright whenever any bleed source is present, since low water/energy are near-universal by the time any survivor dies and aren't a reliable co-factor. Dehydration/Starvation only show up when there's no bleeding to explain it.
• "Nearest Town: Wilderness" is gone for good ; nearestTown now looks within 1000m (down from 2000m) and simply omits the Nearest Town field (or falls back to coordinates, for the one field that only shows one or the other) when nothing is actually nearby, instead of showing a hollow placeholder next to coordinates that were already right there.

v0.1.60New: /store admin Cash commands, and /remove auto-channels

• New: /store admin cash-give|cash-take|cash-set ; directly credit, debit, or override any gamertag's Cash balance. cash-take clamps at 0 instead of going negative; cash-set is a hard override for correcting mistakes.
• New: /remove auto-channels ; the "off switch" for /setup auto-channels. Deletes every channel/category it created (feeds, dynamic events, games, utilities, tickets), requires confirm:true since this is permanent and takes each channel's message history with it. A category is only removed once it's empty, so anything renamed or added manually is left alone. Run /setup auto-channels again any time to recreate everything from scratch.

v0.1.59More ways to earn Cash: PvP hits, base building, flag raising

• Landing a hit on another player, placing a base structure (fence, watchtower, shelter, etc.), and raising a territory flag now all pay out Cash automatically, on top of the existing kill/playtime/travel/zone rewards.
• PvP-hit rewards are cooldown-gated per attacker-victim pair, not a single global cooldown ; so it throttles two players farming each other on repeat without also throttling someone fighting several different real opponents in a row.
• Base-building and flag-raising rewards use a flat per-player cooldown each, since there's no "pair" involved in a solo construction action.
• All six new rates are tunable via /store admin config: hit_reward, hit_cooldown_min, build_reward, build_cooldown_min, flag_reward, flag_cooldown_min.

v0.1.58/store UX overhaul: /store view replaces /store list

• /store view browses Items, Kits, and a new My Account category via a dropdown that swaps the embed in place ; same pattern /shop view already uses. Each item/kit shows a live affordability indicator based on your own balance (if linked via /link, or you can still pass gamertag directly) plus a ready-to-copy buy command, so you never have to remember or retype an exact name.
• My Account shows your Cash balance and saved spawn location together in one place, alongside prompts to /link or /store setlocation if either isn't set yet.
• /store admin's configuration subcommands are unchanged ; this overhaul is entirely player-facing browsing, not the admin catalog-management commands.

v0.1.57/store is complete: zones and selling (4/4)

• New: /store admin zone-add|zone-remove|zone-list ; repeatable, cooldown-gated Cash rewards for visiting a defined area (a real "reason to travel there" mechanic, not a one-time discovery bonus). Any live event with coordinates counts as a visit, not just position pings, so actively playing in a zone (fighting, building) earns it too.
• New: /store sell classname:<> qty:<> ; pays out Cash for anything an admin gave a sell price via item-add's sell_price option. Self-attested, same trust model as everywhere else in this bot that reads a player-claimed value.
• This closes out the /store + Cash economy build: real-item purchases with saved spawn locations, kits, automatic earning (kills/playtime/travel/zones), selling, and account linking, all shipped incrementally over the last several updates.

v0.1.56New: Cash is now earnable automatically ; kills, playtime, travel (3/4)

• Every player kill, every hour spent online, and every 1000m actually traveled now pays out Cash automatically ; no command needed, it just accrues in the background from the same live feed everything else reads. Rates are tunable via /store admin config kill_reward | playtime_reward_per_hour | travel_reward_per_1000m.
• A single unrealistic position jump (reconnecting across the map, a teleport) is not counted as travel ; only genuine, plausible movement between two real position pings.
• Still coming: earning Cash by selling items back, and zone-based rewards for visiting specific places.

v0.1.55New: /link ; link your Discord account to your gamertag

• /link set gamertag:<> links your account (self-attested ; there's no way to automatically verify you own a gamertag, same trust model /clan and /bounty already use ; an admin can fix a bad link with /link admin set). /link remove, /link status, and /link lookup gamertag:<> round it out.
• /store's gamertag options are now all optional ; link once, then /store balance, /store setlocation, and /store buy all use your linked gamertag automatically if you don't specify one. Built as a general-purpose primitive (src/lib/guards.js's requireGamertag()), not store-specific, so future features needing player identity can reuse it too.

v0.1.54New: /store buying is live ; kits, saved locations, one-time spawns (2/4)

• /store setlocation gamertag:<> [x] [y] saves where your purchases spawn (omit x/y to use your last known in-game position). /store buy gamertag:<> item:<>|kit:<> deducts Cash and spawns the purchase there after your DayZ server's next restart ; removed automatically 15 minutes after that restart so it only ever spawns once, reusing the exact same mechanism /createevent's Vehicle spawns already use.
• New: kits (/store admin kit-add|kit-additem|kit-removeitem|kit-remove) ; bundle several different classnames under one price and one purchase.
• Still coming: automatic ways to earn Cash (kills, playtime, travel, zones) and /store sell.

v0.1.53New: /store foundation ; a real-item shop, priced in a new Cash currency (1/4)

• First stage of a new real-item shop: /store list (browse), /store balance gamertag:<> (public), and /store admin item-add|item-remove (configure what's for sale, classname autocompletes against /classname's 1,941+ entry catalog).
• Cash is a brand-new currency, tracked per gamertag rather than per Discord account ; deliberately separate from the existing Dollars/Bullets/Plates economy that powers /bench, /range, /casino, /economy (those are untouched).
• Not live yet: actually buying something (items spawn at a location you save, removed automatically 15 minutes after the next server restart so they only ever spawn once), kits, and the several ways to earn Cash (kills, playtime, travel, zones, selling items). Coming in the next few updates.

v0.1.52New: Weekly Recap Digest ; a narrated "this week" summary, auto-posted every 7 days

• Set up a Weekly Recap Digest channel (/channel create type:weeklydigest or /setup auto-channels) and the bot posts a recap there once a week: top killer, most deaths, longest kill (only counts a genuinely new personal-best distance, not just any kill), the most-contested zone that week resolved from real kill locations, and top clan if /clan is in use.
• All numbers are scoped to that week specifically ; diffed against a snapshot taken at the last digest, not the all-time totals /leaderboard already shows. A brand-new server's first digest lands a week after setup, not immediately with empty stats.

v0.1.51New: /clan ; self-serve clans and a clan leaderboard

• /clan create|join|leave|disband|list|leaderboard. Membership is by gamertag, self-attested (same trust model as /bounty claim) ; no Discord account linking involved. /clan leaderboard ranks clans by combined member kills, pulling from the same stats /leaderboard already tracks.
• Ownership passes automatically to another member if the owner leaves; a clan disbands itself automatically once its last member leaves.

v0.1.50New: Raiding detection ; /detect's 7th heuristic

• Fires when a player places an improvised explosive, or dismantles a base structure (fence, watchtower, territory flag, barbed wire, shelter), somewhere far from anywhere they've actually been seen recently ; a proxy for "this looks like someone else's base," not their own. Uses the same movement history /player track already collects, not a new log format.
• Same admin controls as the other 6 detectors: /detect status/toggle/config raiding, its own cooldown, posts to the shared behavior-alert channel (or its own via /channel create type:raiding).
• /channel list's 6 individual behavior-alert fields (already at Discord's 25-field cap) are now one consolidated field alongside the new 7th ; same technique already used for dynamic-event sub-types.

v0.1.49Fix: /rotation now cycles through the pool in order instead of drawing randomly

• Previously each rotation randomly shuffled whichever pool files weren't currently active ; no immediate repeat of the same file, but no guarantee every file ever got a turn either (could favor a handful of entries indefinitely while skipping others). Now it's a sequential cursor: every file in the pool is visited once before any repeat, wrapping back to the start after the last one.

v0.1.48New: AI-generated rotation announcement text

• /rotation pool add now takes an auto_generate:true option ; when set and no description is given, the bot writes a short radio-dispatch-style announcement itself instead of you typing one. Generated once at creation time (not per-announcement) and stored the same way a manually-typed description is, so {town}/{server} substitution and everything else works identically either way.

v0.1.47New: /ask ; a player-facing AI command

• Open to everyone, no permission gating ; ask it DayZ questions or just chat. 30-minute cooldown per person (only charged on a successful answer, so a hiccup doesn't burn your window).
• Runs on the Claude API. If no key is configured yet, it replies with a friendly "not set up" message instead of erroring.

v0.1.46New: Death Cards ; a shareable kill snapshot on every solo kill

• Every kill feed post now includes an auto-generated image when exactly one kill happens in that cycle: a zoomed map crop centered on the kill location with a crosshair marker. Reuses the same map-background rendering /heatmap and /player track already use, so it needs no new setup and automatically uses your real map images if you've added them.
• Killer/weapon/distance stay in the embed's own fields as text (not baked into the image) ; kept the image itself clean and avoided any font-availability risk on the host.
• Multi-kill cycles keep the existing plain embed (no image) ; one image slot can't represent several different kill locations at once.

v0.1.45Fix: hordes couldn't spawn in towns, and their zone was named wrong

• Horde events created via /createevent used a 100m saferadius and 500m distanceradius by default ; DayZ requires that much clear space from every other active CE event before a spawn is allowed, which city centers essentially never have, so a horde dropped in a town would silently never spawn at all. Both are now 0 by default (cleanupradius, which only governs loose-item cleanup and doesn't block placement, is unchanged).
• Also fixed a naming bug: a horde's territory zone (env/zombie_territories.xml) must be named exactly the same as its event (db/events.xml) ; this was using two different naming conventions, which meant every horde's zone silently never matched its event. Browse/Remove/Edit fall back to the old naming for any horde created before this fix, so existing ones stay manageable.
• New: /createevent → Edit Zombie Count lets you change an existing horde's zombie count without recreating it from scratch.

v0.1.44Fix: dynamic-event/vehicle-spawn feeds were completely silent on some servers

• Found the actual root cause behind every dynamic-event and vehicle-spawn channel (heli crash, military convoy, police situation/car, santa's sleigh, train, contaminated area, vehicle spawns) never receiving anything: this bot only recognized one RPT spawn-log phrasing ("(child) Spawned Name EventID:[N] CurrentID:[N] at [...]"), but some servers only ever emit a second, differently-phrased family instead ("[CE][DE] [Name] Spawning: EventID:[N] CurrentID:[N] at [...]") ; which simply matched nothing, silently. Both formats are now recognized side by side, including the same candidate-position-retry collapsing added for the first format. Routine NPC/economy spawns this line family also logs (vendors, survivor NPCs, mortars, ...) are deliberately excluded rather than dumped into the catch-all channel.

v0.1.43Removed RPT health monitoring ; too much engine noise, too little signal

• The generic RPT error/warning scanner added in 0.1.38 turned out to mostly surface routine modded-server engine chatter (missing model geometry, physics layer mismatches, missing animation files, type-inheritance config errors, preset load errors) no matter how many noise patterns got added to its exclusion list ; a losing game against every DayZ/Enfusion diagnostic category. Removed entirely rather than keep chasing it. RPT's actual value to this bot is Central Economy dynamic-event/vehicle spawns, which was already a separate, dedicated feed (and just got its own fix in 0.1.42) ; that's what stays.

v0.1.42Fix: duplicate-looking dynamic-event/vehicle spawns from CE placement retries

• Central Economy retries several candidate positions for one spawn attempt before settling on a spot (confirmed real sample: the same VehicleBoat spawn logged 12 times at the exact same millisecond, each with different coordinates) ; every retry was being reported as its own separate spawn event. Now collapsed to one event per spawn (CurrentID), keeping the last-logged position.

v0.1.41Fix: log downloads could silently re-fetch the whole file instead of just new bytes

• Found the likely root cause behind two earlier symptoms at once ; an RPT error count that never seemed to shrink cycle to cycle, and the sustained Nitrado HTTP 500s on log downloads: some Nitrado file-download URLs don't honor the Range request this bot sends to fetch only new bytes, and silently return the ENTIRE file with a 200 instead of a 206 Partial Content. That was being treated as "just the new bytes," re-parsing everything from byte 0 every cycle and advancing the tracked offset by the full file size instead of the true delta ; which snowballs into a nonsensical offset within a few cycles and would explain the file becoming unservable. Now detected and handled: the response is sliced locally to just the true new portion, and the offset tracks the real file length either way.

v0.1.40RPT health: ignore missing-asset load failures too

• "Can't load ..." engine errors (missing/mismatched mod animations, models, textures ; confirmed real sample: ~326/cycle of "Can't load sakhal/Anims/cfg/skeletons.anim.xml" on one server) are now excluded from RPT health monitoring, same treatment as the other known-benign mod-asset noise. Not something actionable from this bot, so it no longer counts toward totals or shows up in the health digest.

v0.1.39Critical fix: /player track was silently crashing every poll cycle

• playerTrackSamples (added in 0.1.36 for /player track) was missing from loadGuildData()'s per-field merge ; every already-saved guild file came back with it undefined, so the very first position ping each cycle threw and aborted that entire poll cycle before anything got sent to Discord. Fixed, and added a regression test that checks every defaultGuildData() field survives loading a save file that predates it, so this class of bug can't silently ship again.

v0.1.38RPT health monitoring ; surfaces real errors, ignores engine noise

• Every poll cycle now scans the freshly-downloaded RPT chunk for genuine engine errors/warnings, filtering out known-benign noise (mismatched model geometry, unknown object classes, physics interaction-layer warnings ; the kind of lines that fire constantly on a modded server and mean nothing). Real errors always get logged to bot.log immediately; if any turn up, a summary embed posts to the Moderation Log channel too, throttled to once per 15 minutes so an ongoing issue doesn't spam. This is exactly the kind of signal that would have caught the recent 300MB+ runaway RPT file causing Nitrado download failures without needing a manual log dig.

v0.1.37Real map backgrounds are live

• Chernarus and Livonia map images are now in place at data/maps/ ; /heatmap and /player track render against the real map instead of the plain grid fallback from now on. No command changes; this just activates the background-image support added in 0.1.36.

v0.1.36/player track + own Utilities channel category + map backgrounds

• Added /player track ; plots recorded position pings on the map, either for one named player or every currently online player at once (each in its own color, up to 8 at a time), similar to how iZurvive plots live player positions. Backed by a new bounded per-player ping history, fed from genuine position-ping events only (not every kill/hit/build, so it stays an accurate movement trail).
• /setup auto-channels now creates a "🛠️ BenchBot Utilities" category for mod-log, suggestions, giveaways, bot-trap, and a new dedicated heatmap channel ; split out from the DayZ event feeds since these are on-demand/interactive rather than a streaming feed. /heatmap and /player track now post there automatically when it exists.
• Both map renderers now use a real map image as the background automatically if one is dropped in at data/maps/<mapSlug>.png ; falls back to the existing grid background if none is present. This project doesn't source or bundle map imagery itself (licensing); deploy.cjs picks up whatever's in data/maps/ automatically once added.

v0.1.35Fix: spurious duplicate position events + auto-bans now purge messages

• Found and fixed a real bug behind the Player Position Updates feed looking flooded with redundant entries: the position-line pattern matched "Player \"X\" ... pos=<...>" anywhere in an ADM line with no anchor, so every single kill, hit, construction, connect, disconnect, teleport, chat, or emote line ; which all carry pos=<...> of their own ; was ALSO silently generating a second, spurious position event alongside its real one. It's now anchored to only match genuine standalone position-ping lines. Internal position tracking (used by /player locations) now reads coordinates directly off whichever event just happened instead of relying on that side effect, so nothing about location freshness was lost.
• Auto-bans (bot-trap, auto-mod) now also purge the banned user's messages across the whole server ; up to Discord's own 7-day maximum ; instead of leaving everything but the one triggering message in place.

v0.1.34Developer-locked commands + flagged bot-trap channel

• /resetlogs is now locked to the bot's developer only (whoever owns this bot's Discord application, plus anyone listed in the new DEV_USER_IDS setting) ; no server's own Administrator or BenchBot-admin role can run it anymore, since it resets bot-internal parsing state rather than anything server-specific.
• The bot-trap channel is no longer disguised ; /setup auto-channels now creates it as an obviously-named "do-not-post-here" channel with a pinned warning embed and a matching channel topic, and /setup bot-trap now posts that same warning when an admin manually designates an existing channel. Anyone but staff who posts there is still banned instantly, unchanged.

v0.1.33Fix: ID collisions on fast concurrent /ticket, /giveaway, /suggest

• A full diagnostic pass found a real race condition in three places: /ticket (via the public "Open a Ticket" button), /giveaway start, and /suggest each computed their next ID before an awaited Discord API call (creating the channel/sending the message) and only recorded it afterward ; two calls close together (a fast double-click, or two different members acting seconds apart) could compute the same ID before either was recorded, corrupting later lookups. Each now reserves its ID immediately, synchronously, before any network call, with a rollback if that call fails.

v0.1.32Crash safety net + /about credits update

• Added global unhandledRejection/uncaughtException handlers ; an error anywhere in the process (including any of the many fire-and-forget async calls throughout the bot) used to be able to kill the whole process with nothing written to bot.log, making a real crash indistinguishable from the process just being idle. Every such error is now logged with a full stack trace first.
• /about now also credits Purejukes and NVG's for working alongside Bench on the community, and Blackout Austin for testing.

v0.1.31Moderation Log + Suggestions (stage 4 ; Server Tools batch complete)

• New Moderation Log ; automatic logging of message edits/deletes, member joins/leaves, nickname/role changes, and bans/unbans, once a Moderation Log channel is set up (/channel create or /setup auto-channels). Auto-Mod actions and triggered Bot Trap events already routed here since their own updates; this is everything else.
• New /suggest text:<> posts to this server's Suggestions channel with 👍/👎 reactions pre-added. New /suggestion resolve id:<> status:<accepted|denied|implemented> [reason] (admin) updates the original post to show the outcome; /suggestion list shows what's still pending.
• This completes the Server Tools batch started a few updates ago: Purge, Auto Role, Links, Auto-Mod, Bot Trap, Reaction Roles, Giveaways, Moderation Log, and Suggestions.

v0.1.30Reaction Roles + Giveaways (stage 3 of the Server Tools batch)

• New /reactionrole create | addrole | removerole | list | remove ; post a panel, then attach emoji → role mappings to it one at a time. React to get the role, remove your reaction to lose it ; real emoji reactions, not buttons. Works indefinitely across bot restarts, same guarantee as the ticket panel button.
• New /giveaway start | reroll | list ; react with 🎉 to enter, winners picked automatically when it ends (checked every 30s, independent of the DayZ poll cycle so it works even without Nitrado configured). /giveaway reroll re-picks from the current reactors at any time after ending.
• Both rely on the GuildMessageReactions intent added in the previous update, plus message/reaction partials so reaction events keep working on messages the bot hasn't seen since its last restart.

v0.1.29Auto-Mod + Bot Trap (stage 2 of the Server Tools batch)

• New /automod ; 5 independently toggleable checks (Spam/Flood, Mass Mentions, Discord Invite Links, External Links, Censored Words), each with its own configurable action (Warn, Delete, Delete + Timeout, Delete + Ban). Spam/Mentions/Invites default on with a mild Delete action; Links/Words default off since they're more prone to false positives. Every hit posts a notice in the channel it happened in, as requested.
• New /setup bot-trap channel:<#channel> ; a decoy channel that instantly bans (and deletes the message from) anyone who posts there, except real Administrators or the bot-admin role.
• Both route their record of what happened to the new Moderation Log channel type (/channel create or /setup auto-channels).

v0.1.28Server Tools: /purge, /setup auto-role, /links (stage 1 of a bigger batch)

• New /purge amount:<1-100> [user] (admin) bulk-deletes recent messages in a channel, optionally filtered to one user.
• New /setup auto-role role:<@role> automatically assigns a role to every new member who joins ; omit role to turn it off.
• New /links list | add | remove ; a curated list of useful links (rules, resources, socials, ...); list is public, add/remove are admin-only.
• Under the hood: the router now centrally wires every Discord gateway event (message edits/deletes, member joins/leaves/updates, bans, reactions), not just slash commands ; the foundation for the auto-mod, bot-trap, reaction-role, giveaway, logging, and suggestion systems coming in the next few updates. New non-privileged intents (GuildMessageReactions, GuildModeration) plus the already-enabled Server Members intent are wired in for that.

v0.1.27Fix: /createevent Vehicle and Horde spawns silently ignored by the server

• Custom Vehicle Spawn and Horde events created via /createevent were being written to db/events.xml without a type prefix DayZ's engine needs to figure out what kind of spawner they are ; confirmed against a real server log: "[DynEvent] 'X' will be ignored :: failed to determine spawner type!" for both an OffroadHatchback vehicle spawn and a horde. They were accepted by the bot and looked correct on inspection, but the DayZ server itself was silently dropping them at load ; nothing ever actually spawned.
• Vehicle spawns now write as Vehicle<classname>BenchBotEvent, hordes as InfectedBenchBotHorde_N, Airstrike/Gas Strike as StaticBenchBotAirstrike/StaticBenchBotGasstrike ; matching the prefix convention DayZ's own vanilla dynamic events already use internally (confirmed against this server's own bundled db/events.xml ; every vanilla Static* event follows this exact pattern).
• Backward compatible with anything already on the server from before this fix: Browse and Remove still recognize the old, unprefixed names, and creating a new Airstrike/Gas Strike/repeat vehicle pick reuses an existing old-named block instead of fragmenting it into two. Any vehicle/horde already silently failing to spawn needs to be removed and recreated once for the corrected name to take effect ; the old entries themselves aren't automatically fixed in place.

v0.1.26Dynamic Event channels moved to their own category

• /setup auto-channels now creates a separate "🔥 BenchBot Dynamic Events" category for the Central Economy spawn feed (the 7 specific event-type channels plus Vehicle Spawn and the Other/Unrecognized catch-all), instead of mixing them into "📡 BenchBot Feeds" with connects/kills/chat/etc. Bounty/Achievement/Leaderboard channels stay in the regular Feeds category ; they aren't part of the RPT spawn feed.

v0.1.25Dynamic Event Spawn feed split into per-type channels

• The Dynamic Event Spawn feed no longer dumps every spawn into one combined channel ; it now sorts each spawn into one of 7 specific event types (Heli Crash, Military Convoy, Police Car, Police Situation, Santa's Sleigh, Train, Contaminated Area), each routable to its own channel, plus a catch-all "Other/Unrecognized" channel for anything that doesn't match. Classification is based on the actual spawned classname, cross-checked against this server's own bundled DayZ mission files (both Chernarus and Livonia) rather than guessed ; Heli Crash in particular is confirmed against a real captured RPT line from earlier this session.
• /setup auto-channels now creates all 7 new channels (plus the existing catch-all and Vehicle Spawn channels) automatically, sorted into the same "BenchBot Feeds" category as everything else.
• /channel create's event-type picker switched from a fixed dropdown to search-as-you-type ; the full type list (now 30+ entries) no longer fits Discord's 25-choice cap for a dropdown.
• Note on confidence: Heli Crash, Santa's Sleigh, Contaminated Area, and Train are matched on unambiguous classnames. Military Convoy vs. Police Car vs. Police Situation lean on a shared naming convention (a "_DE" suffix + keyword) found consistently across this server's bundled mission files for both maps ; solid, but not verified against a real captured RPT line the way Heli Crash was. If any of the three look miscategorized in practice, flag it and it can be tightened.

v0.1.24/ticket closeall

• New /ticket closeall (admin) closes every currently open ticket at once, same as running /ticket close on each ; usable from anywhere, not just inside a ticket channel. Each one is still individually logged to the Ticket Log channel like a normal close.

v0.1.23Ticket system: quicksetup, claim/priority/threads, and auto-channels coverage

• /setup auto-channels now also creates a "Tickets" category with the panel channel (button posted automatically) and an admin-only ticket-log channel, plus routes the Bounty, Achievement, and Leaderboard feed channels ; previously all four needed to be set up by hand via /channel create.
• New /ticket quicksetup configures just the ticket side (staff role, log channel, panel) in one step, without touching every other feed/game channel.
• New in-ticket management commands, mirroring what dedicated ticket bots offer: /ticket add | remove a user, claim | unclaim | transfer ownership, priority (Low/Medium/High/Urgent ; shown in /ticket list and the channel topic), rename the channel, thread opens a private staff-only thread, close [reason] and closerequest (asks the opener to confirm before closing) as slash-command alternatives to the Close Ticket button. /ticket createticket opens a ticket without needing the panel button.

v0.1.22New /ticket support system

• New /ticket panel posts a persistent "Open a Ticket" button ; anyone can click it, pick a category (Player Report, Ban Appeal, Gear/Loss Claim, General Support), and get a private channel with the bot-admin role, under an auto-created "Tickets" category. A Close Ticket button (opener or admin) closes it and deletes the channel a few seconds later.
• New /ticket list (admin) shows everything currently open. A new Ticket Log channel type records who opened/closed each ticket and its category after the channel itself is gone ; metadata only, not a full message transcript.
• Under the hood: this is the first feature in the bot built on a persistent button, one that has to keep working indefinitely for anyone, across restarts ; every other interactive flow (/shop view, /createevent, ...) uses a short-lived collector scoped to one reply instead. Required adding real central button/select-menu dispatch to the router alongside the existing modal/autocomplete routing.

v0.1.21Live leaderboard channel + real-time achievement announcements

• New auto-updating Leaderboard channel type (/channel create) ; one message showing all 4 /leaderboard categories at a glance (top 5 each), edited in place as things change instead of reposted, and skipped entirely on cycles where nothing actually moved.
• New Achievement Unlocked channel type ; posts the moment anyone actually crosses a milestone instead of only surfacing it when someone runs /achievements to check. Combat/Survival unlocks are detected live off the same feed events that already update the stat ledger; Economy/Game unlocks (bench/range rank, wealth, first purchase) are swept once per poll cycle against current state rather than instrumenting every command that could change them.
• /bounty's fulfillment channel (added last version) works the same way and was already live ; just needed a Bounty Fulfilled channel set up via /channel create to route it.

v0.1.20New /heatmap

• New /heatmap category:<kills|deaths|dynamic events|vehicle spawns> [days] ; renders an actual density-map image (not a text approximation) from a new bounded position-sample log fed by the same live feed everything else already reads. No real DayZ satellite map is used (avoids licensing/scraping concerns) ; just a coordinate grid and faint town markers derived from this bot's own town reference data, with sample density rendered as overlapping warm blobs that brighten where activity clusters.
• Requires a new image-rendering dependency (@napi-rs/canvas) ; degrades to a clear error message rather than any crash if that hasn't been installed on a given deployment yet.

v0.1.19New /leaderboard, /achievements, and /bounty

• New /leaderboard ; per-server rankings (not bot-wide, unlike /expedition leaderboard): Wealth, Combat Kills, Combat KDR, Survival Playtime, one category picker like /help and /shop view. Backed by a new persisted per-gamertag stat ledger fed from the live kill/death/disconnect feed.
• New /achievements me | dayz ; small starter set of milestones (bench/range rank, wealth, first purchase on the Discord side; kills, longest confirmed kill, and playtime on the DayZ side). The two sides can't be linked to each other ; this is a console bot, and nothing anywhere in it maps a Discord account to a gamertag ; so achievements/leaderboards show real gamertags directly rather than pretending a connection exists.
• New /bounty place | list | cancel | claim ; player-vs-player bounties on a gamertag, paid from your own escrowed currency, auto-detected the moment that gamertag dies to another player in the live feed and announced in a new configurable Bounty feed channel. Claiming is a self-attested step (same trust model /banlist reports already use) since there's no way to auto-verify which Discord user actually got the kill. Unclaimed bounties refund automatically after 14 days (or 7 days past fulfillment).

v0.1.18Fixed a real location bug in the Dynamic Event / Vehicle Spawn feeds

• Fixed the root cause of Dynamic Event and Vehicle Spawn locations being wrong: the RPT central-economy spawn line ('(child) Spawned X ... at [X,Y,Z]') is a raw engine vector dump where Y is always height, not a ground coordinate ; but the parser was feeding that height value into the nearest-town lookup as if it were the real second ground coordinate, silently pulling every spawn's reported location toward whichever town happened to sit near that elevation band instead of where it actually spawned.
• Confirmed against a real captured spawn line before and after the fix, and against this codebase's own established x/z-ground, y-height convention (the same one /createevent already uses for cfgeventspawns.xml positions) ; the two were previously inconsistent for this one feed.
• Player positions, kills, deaths, and every other ADM-sourced feed were unaffected ; that log format already puts both ground axes first.

v0.1.17/shop view crash fixed ; now a category picker instead of one oversized message

• Fixed a real, live crash: /shop view with no category filter sent all three currency categories combined into one message, and Discord's 6000-char embed budget is a per-message total across everything in it, not per-embed ; that combination exceeded it and the command failed outright (confirmed from a real production error).
• /shop view now works like /help ; a dropdown to browse Dollars/Plates/Bullets one at a time, swapped in place, instead of a wall of text (or a crash). Passing a category directly (e.g. /shop view category:plates) still jumps straight to that one, same as before.

v0.1.16Full codebase review ; two currency-duplication bugs, a credential-loss bug, and a dozen smaller fixes

• Found and fixed two real currency-duplication bugs: a fast double-click on /casino blackjack's Stand or /expedition's Bank It could credit the same win/loot twice (both only guarded against re-entry after an await a second click could slip through before it landed). /expedition go also had no guard against stacking unlimited concurrent runs, letting its cooldown be bypassed entirely for repeated free loot.
• Found and fixed a credential-loss bug: if DATA_ENCRYPTION_KEY was ever wrong or got rotated, every guild's Nitrado token and FTP password got silently overwritten with nothing on the very next save ; which happens automatically on every boot. A failed decrypt now leaves the original value untouched instead of wiping it.
• The Discord client had no error handler at all ; a routine websocket hiccup could have taken the whole bot down as an uncaught exception. Added shard-error and warning handlers too.
• FTP mission-file writes (/rotation, the old /eventspawns) now roll back if the final rename fails, instead of potentially leaving the live server missing that file entirely. /status, /map, and /player online now defer before their sometimes-slow Nitrado calls instead of routinely failing with a stale-interaction error.
• The live behavior-detection feed no longer produces false Dupe/Boost/Join-Kill alerts (or silently masks a real one behind a cooldown) from the event backlog right after every restart, and Join-Kill alerts now point at the accused killer's actual location instead of their victim's.
• Smaller fixes: a near-max-length chat message could silently drop its whole batch past Discord's field cap; the error router's DM fallback used to send a redundant, misleading message even when the in-channel reply had already worked; a roulette refund could be lost if Discord's own reply failed; blackjack's Double had no server-side hand-size check; milestone bonuses under-paid when a single jump crossed more than one threshold at once.

v0.1.15/eventspawns replaced entirely by /createevent ; one guided command

• /eventspawns (11 subcommands across two subcommand groups) is gone, replaced by a single /createevent command with a fully dropdown- and modal-driven flow: pick Create / Browse / Remove / Scheduled Cleanups, then a category (Airstrike, Gas Strike, Custom Vehicle Spawn, or Horde), then whatever that category needs ; a vehicle from a real 20-option list, one or more zombie types from a real 15-group list (now including Infected Mummy), or straight to coordinates.
• Every category writes a fixed, purpose-built event (BenchBotAirstrike, BenchBotGasstrike, a per-vehicle-type event, or an auto-numbered BenchBotHorde_N) instead of borrowing a vanilla event's tuning like the previous version did ; Airstrike is a genuine new mechanic (an explosion effect), not just more helicopter-crash positions.
• New: an optional "remove after restart" toggle on every creation. When enabled, whatever was just injected ; the position, or for a horde the whole event and territory zone ; is automatically removed 15 minutes after your DayZ server's next restart (not 15 minutes after creation; it still needs that one restart to actually go live first). Scheduled removals survive both a DayZ server restart and a bot restart, and show up under /createevent's own Scheduled Cleanups view.

v0.1.14/eventspawns reworked around player-facing categories, plus a new Airstrike event builder

• /eventspawns add and addmany no longer work off a hand-maintained list of blocked filler types ; they now only offer event types that fall into one of four real categories: Vehicles, Heli Crashes, Gas Strikes, and Airstrikes. Anything else (ambient wildlife, police/military filler, and now also the Infected* family and StaticAirplaneCrate) is left alone by this tool ; use /eventspawns horde for infected hotspots, which already had its own correct mechanism. /eventspawns types|list|remove still show and manage everything really in the file, filler included.
• /eventspawns types now groups its list by category instead of one flat alphabetical dump, with an Other section for everything not currently creatable through this tool.
• New /eventspawns create category:airstrike name:<text> ; defines a genuinely new custom event (writes a new <event> block into db/events.xml, something this tool has never done before) by combining a real StaticHeliCrash's tuning with wreck and supply-crate loot, then adds a matching empty entry to cfgeventspawns.xml so /eventspawns add can immediately start placing positions for it. Needs a server restart before the new event definition takes effect.

v0.1.13Reliability pass ; logging, polling, rotation, dedup, and a real README

• Fixed a real crash path: the file logger had no error handler on its write stream, so a failed write (disk full, permissions) could take the whole bot down instead of just failing to log. It now falls back to console-only logging on a write failure, and skips opening the log file at all during automated tests so test runs can never touch or fight over the real bot.log.
• The 30-second poll loop can no longer overlap itself ; if one cycle is still running (a slow Nitrado response, for example) when the next one would fire, it now skips instead of starting a second cycle in parallel and duplicating requests or racing log-read offsets.
• /rotation can no longer race itself either ; it's fired in the background from the poll loop without waiting for it, so a slow FTP round trip used to leave a window where the next cycle could decide a rotation was due again and start a second one over the same remote file. Now locked per-server.
• The live-feed duplicate-event filter no longer grows without bound for the life of the process, and no longer collides two different same-second events from the same player (e.g. two builds one second apart) into looking like the same event ; the key now reflects everything that actually happened, not just when and who.
• README.md rewritten from scratch ; it was still describing a Python predecessor (bot.py, pip, .env) that hasn't existed for a while. Now covers actual setup, the real Node/Discord-based /setup flow, FTP-dependent features, per-guild vs. global state, and deployment.

v0.1.12/help rebuilt as a category browser, new /game list

• /help is no longer two static walls of one-liners ; it's now a dropdown you use to browse by category (Setup & Configuration, Detection & Moderation, DayZ Reference, Games & Economy, Misc), and every entry actually explains how the command works instead of just listing its subcommands.
• New /game list ; a dedicated, paged guide to every game and economy command with real detail: currency, cooldown, payout ranges, and the actual mechanic (push-your-luck odds, injury/jam chance, rob success rate, and so on). /help's Games & Economy category stays short on purpose and points here for the full rundown.
• /changelog's Prev/Next paging got pulled out into a shared helper, now reused by /game list too, instead of being copy-pasted.

v0.1.11Filler event types locked out of /eventspawns, plus horde territory zones

• A curated set of vanilla filler event types (StaticPoliceCar, StaticPoliceSituation, StaticMilitaryConvoy, StaticTrain, Staticpoxmortar, ambient wildlife, and the Christmas-only events) can no longer be added through /eventspawns add or addmany. Nothing changes in your real cfgeventspawns.xml ; this only stops new positions for those types being created through the bot; /eventspawns types | list | remove still work on them normally.
• New /eventspawns horde types | add | addmany | list | remove manages zombie horde territory zones in env/zombie_territories.xml (a real vanilla DayZ mission file, not a mod) ; the mechanism behind persistent infected hotspots like InfectedArmy and InfectedVillage. Set a center point, radius, and how many infected spawn as players approach (dynamic) vs. are always present (static, costlier on performance).
• horde types only lists group names actually defined in db/events.xml with the right settings to read from this file ; nothing is invented, and it's flagged if a group is currently turned off there.
• Same safe backup-then-swap FTP write pattern as the rest of /eventspawns and /rotation.

v0.1.10New /eventspawns ; add spawn positions to cfgeventspawns.xml

• New /eventspawns add lets you drop a new spawn position (X/Z, optional facing angle and elevation) onto any event type that already exists in cfgeventspawns.xml on your Nitrado server ; vehicles, heli crashes, item piles, and more.
• New /eventspawns addmany opens a form for pasting several positions at once (one "x z angle height" per line) instead of running /add repeatedly.
• New /eventspawns list shows every current position for a type with a number next to each; /eventspawns remove deletes one by that number.
• New /eventspawns types lists every event name defined in the file with its current position count, and the type field on every subcommand quick-searches that list as you type.
• Edits go straight to the live file over FTP with the same safe backup-then-swap pattern /rotation uses ; takes effect on the next server restart. This only adds spawn points, not new event types, and doesn't touch db/events.xml's nominal/min/max, so a reminder to check those is included in every reply.

v0.1.9Admin commands now configurable per-role, not just server Administrator

• New /setup bot-admin-role lets you grant BenchBot admin access (setup, channels, detect, rotation, banlist, keywords, and more) to a role that isn't full server Administrator ; point it at an existing role, or leave it blank to auto-create "Bench Bot Admin." Assign the role to members the normal Discord way.
• /setup auto-channels now also creates (or reuses) this role in the same one-shot setup.
• New /channel visibility lets you multi-select several feed channels at once and flip them all admin-only or public in one go, instead of editing each channel's permissions by hand. /channel list now shows a lock icon next to channels that are already admin-only.
• Every previously Administrator-only command still works exactly the same for real server Administrators ; this is additive, not a replacement.

v0.1.8New dynamic event / vehicle spawn feed

• New automated feed posts when the server spawns a dynamic event (heli crash sites, AI survivor encounters, and similar) or a vehicle ; routes through /channel create and /setup auto-channels exactly like every other feed.
• New /setup location-format lets you choose whether spawn locations show as a town name or exact coordinates on this feed.
• Routine ambient wildlife and animal spawns are deliberately excluded ; this feed is for "something worth going to look at," not routine background spawning.

v0.1.7Connect/disconnect feeds show session length

• The connect feed now shows Time Offline (how long since that player's last disconnect, or "First seen this session" if the bot has no record of one).
• The disconnect feed now shows Time Online (how long that session lasted, or "Unknown" if the bot restarted mid-session and missed the connect).

v0.1.6/detect ; automated player behavior detection

• New automated feed watches the live ADM log for 6 exploit patterns and posts an alert embed the moment one trips: Underground (clipping below the map), Skywalk (float/rapid altitude gain, including sit-then-rise), Dupe (connect-cycling), Boost (rapid Fireplace/Garden Plot stacking + altitude gain), Camping (staying in one small radius), and Join-Kill (a kill within minutes of connecting).
• New /detect status shows every detector's current thresholds and on/off state in one place. New /detect toggle turns any detector (or all of them) on or off. New /detect config <name> tunes each detector's numbers ; depth, radius, windows, cooldowns, all admin-configurable, all optional (omit an option to leave it as-is).
• Every alert is a heuristic signal for admin review, not proof ; same framing as /altcheck. No auto-ban; these are alert-only.
• Alerts route through /channel create and /setup auto-channels exactly like every other feed ; auto-channels creates one consolidated, admin-only #dayz-suspicion-alerts channel for all 6 by default.

v0.1.5/expedition ; real inventory, sellable loot, pricier gear

• Found items now go into a real inventory instead of converting straight to Salvage ; /expedition go banks the actual items (Bent Dog Tags, Sealed Sidearm Case, etc.), not a currency amount.
• New /expedition inventory shows everything in your loot bag ; item, rarity, and current sell value each and combined.
• New /expedition sell item:<name> [quantity] cashes loot in for Salvage ; sell one at a time, a stack, or item:all to clear the whole bag at once.
• Case gear's Salvage bonus now applies when you sell instead of when you find ; upgrade Case before a big sell-off and it immediately pays off on everything in your bag.
• Streak multiplier moved from boosting Salvage to boosting Score earned per bank ; Salvage now only comes from actually selling loot.
• All expedition shop prices went up roughly 3.75x across every tier and the Stash Rumor consumable ; the old prices were getting cleared out in a handful of runs.

v0.1.4/expedition ; dense stat-block embeds, no more photos

• Run, bank, and bust embeds dropped the site/loot photos entirely in favor of dense stat blocks ; every push now shows This Find, Push Status, Run Total, Streak, and Rank side by side instead of one flavor line and a picture.
• /expedition sites is back to a single embed listing all four sites with their exact rarity bias numbers (e.g. Rare +6, Legendary +3) instead of vague flavor text.
• /expedition profile and /expedition leaderboard got the same tightened, numbers-forward treatment ; leaderboard now shows salvage alongside score on every entry.

v0.1.3/expedition balance pass ; pick your site, way more gear

• New /expedition go site:<name> ; pick NWAF Ruins, Rustbelt Docks, Red Cross Camp, or Smuggler Row yourself instead of a random site every run; the whole run now stays at that one site instead of jumping around on every push.
• New /expedition sites ; browse what each site favors before committing to a run.
• Legendary odds were tuned way down ; a couple of gear pieces could previously push them past 25% per roll, now capped hard. Pushing deeper still nudges your odds up a little, rewarding the added risk.
• New Boots gear slot (4 tiers) raises how many times you can Push Deeper before being forced to bank. Every gear slot also picked up a Tier 4 rung gated behind Apex Raider rank.
• New consumable, Stash Rumor ; guarantees your next /expedition go opens on a legendary find.
• Every site now shows a real photo in the run embeds and in /expedition sites.

v0.1.2New /expedition minigame ; push your luck

• New /expedition go ; head into NWAF Ruins, Rustbelt Docks, Red Cross Camp, or Smuggler Row and find something right away, then choose: Bank It and keep the haul, or Push Deeper for a bigger one at rising risk of losing the whole run.
• Salvage and score earned fund gear across 5 slots (Pack, Kit, Radio, Case, Instinct) via /expedition shop | buy, plus rank, streak, and milestone progression.
• Rank, streak, milestones, and the leaderboard are bot-wide across every server this bot is in, same as Chips ; one expedition identity everywhere, not per-server.

v0.1.1The big one ; full internal rebuild, security, and reliability

• Completely rebuilt from a single 6,000+ line file into a properly organized codebase with real automated tests ; nothing changes for you day to day, but future fixes and features should land faster and with fewer surprises.
• Nitrado tokens and FTP passwords are now encrypted at rest instead of stored as plain text.
• Nitrado API calls now automatically retry on timeouts and server errors instead of just failing outright ; should quietly resolve a chunk of the transient log-fetch failures from before.
• Economy and Casino Chip balances now have a real database backup running alongside the existing save files, for extra protection against data loss.
• New /economy audit (admin) flags accounts suspiciously paying each other back and forth in a short window ; a common sign of currency being laundered between two accounts.
• If a command fails, you'll now get a DM explaining what happened and what to do, instead of just silence.
• Multiple servers now get their logs polled in parallel instead of one at a time, keeping things fast as more servers join.
• Fixed: a natural blackjack (dealt 21 immediately) was crashing instead of paying out 3:2 ; it now pays out correctly.

v0.0.2Mobile tap-to-copy, and a round of crash fixes

• Player gamertags and Discord usernames shown in embeds (feeds, leaderboards, /banlist, /altcheck, /player locations, casino/economy results) now render as tappable code text instead of bold, so tapping one on Discord mobile copies it straight to your clipboard.
• Fixed /help throwing an error on every use ; it had grown past Discord's 25-field-per-embed limit over the last few updates. Split into two embeds.
• Fixed /shop view (no category filter) failing every time ; real custom-emoji icons are ~35-40 characters each versus 1 for the old text glyphs, and cramming all three currencies' items into one embed pushed it over Discord's 6000-character budget. Now one embed per currency.
• /banlist list and /banlist search got the same fix pre-emptively (large results could hit the same 6000-character ceiling as the watchlist grows) ; both now split across multiple embeds automatically when needed.

/banlist goes global, with a verification system

• Every /banlist report is now shared across every server on this bot, not just the reporting server ; added by any admin, anywhere, visible everywhere immediately.
• New tiering so one admin can't unilaterally get someone bot-wide blacklisted: a gamertag stays Unverified (a lead, not a verdict) until 2+ independent servers report it, at which point it becomes Verified.
• New /banlist dispute lets any server flag another server's report as questionable ; if disputes catch up to reports, the entry flips to Disputed rather than being silently deleted, so the history stays visible.
• /banlist remove now only retracts your own server's report; other servers' reports on the same gamertag are unaffected.
• Existing per-server entries were migrated in automatically as that server's own report ; nothing already added was lost.

Visual overhaul, starting Chips, and watchlist wording

• Every embed in the bot restyled with one consistent look ; 89 custom full-color icons (uploaded as Benchbot's own Discord emoji, not sourced from emoji.gg), covering every command, the shop catalog, loadout builder slots, /distance terrain tiers, bench/range event tiers, and now the live connect/disconnect/kill/death/hit/chat feeds too.
• New players get a one-time 100 Chips starting balance the first time they touch Bench's Casino.
• /banlist wording now describes it as a shared, verified watchlist meant for copying into other servers' banlists.

/changelog ; see what changed

• New /changelog command ; newest entry first, with Prev/Next buttons to page back through history.

Bench's Casino rework ; global Chips economy

• /casino global-chips lets a server admin switch this server's casino games to a new shared Chips currency, kept separate from each server's local Dollars.
• /casino deposit | withdraw | balance move value between this server's Dollars and your shared Chips ; win on one server, cash out on another.
• All casino games (coinflip, dice, roulette, slots, high-low, blackjack) work with either currency depending on this server's setting.

/banlist ; server watchlist

• New /banlist add | remove | list | search | export command ; a categorized (hacker/exploiter/griefer/DDoS/scammer/other) player watchlist with known alts and notes, exportable as plain text for other admins.

Feed overhaul ; coordinates and kill/death/hit detail

• Connect/disconnect/kill/death/hit/chat feed embeds now include coordinates and the nearest town.
• Kill and hit feeds classify PvP vs. infected vs. animal vs. environmental, plus weapon, distance, and body part when available.
• Death feed attempts to identify the likely cause (bleeding, dehydration, starvation) from the server's own stats line.

/altcheck ; alt-account suspicion scan

• New /altcheck command scans ADM logs for behavioral signs of alt accounts (fast account handoffs, low overall play footprint), with repeated-pattern clustering across accounts.
• Explicitly presented as suspicion signals for admin review, not proof ; console DayZ exposes no IP or platform ID to confirm a match.