Overview

In 2026 OGame 0.84 Open Source — a faithful revival of the classic OGame v0.84 with its original 2000s design — went through two intense development waves: January–February and August–September. In that time the master branch absorbed 559 commits from 82 merged pull requests (about +434 thousand / −82 thousand lines across ~1,448 files).

The year’s headline achievements:

• A real mod subsystem: self-contained mods with hooks, an admin mod panel, and four bundled mods — GalaxyTool, Space Storm, Deep Space Horror and the minimal example BogusMod.
• A deep architecture refactoring: modular game core, typed core methods, a unified page router, and the long-running separation of page controllers from page views (MVC migration).
• Golden-page regression testing: full-page HTML snapshots of every game page rendered on an in-memory SQLite engine, for all seven supported languages, compared against the preserved OldDesign snapshots.
• Security and stability fixes, including the XSS in alliance names, crashes after attacks, the original OGame missile (IPM) algorithm, and dozens of gameplay bugs.
• Full developer documentation: the Mod Developer Manual (HTML + wiki), Doxygen docs for the game core, PHPStan-clean code, and test suites bundled inside the mods themselves.

All issue and pull-request numbers below link to the repository on GitHub. The digest is compiled from the master-branch history and the current state of the code as of September 3, 2026.

The year in numbers

Activity rhythm of the year (commits on master per month):

Wave 1 (PR #167–#247) ran January 9 – March 6 and rebuilt the engine foundations. Wave 2 (PR #250–#286) ran August 18 – September 3 and brought the test harness, the final round of bug fixes and the documentation. The repository itself is used as a live testing ground by the team: much of the code in 2026 was written and reviewed with the help of AI coding agents (commit trailers of the form Co-authored-by: DeepSeek Harness <deepseek-harness@noreply.local>).

Timeline

Engine architecture

2026 opened with an intensive engine refactoring that ran from January to March and continued in waves through August. It made the old codebase substantially more maintainable without changing the gameplay.

Separate core modules #167

Early January: 27 engine modules were moved out of the web-accessible game/ root into a self-contained game/core/ (36 flat PHP modules + .htaccess denying web access), loaded in dependency order by the core.php bootstrap. Modules are focused files with a clear responsibility: database (db.php facade + db_mysql.php/db_sqlite.php), user, planet, fleet, queue, production, battle, messages, alliance, mods, utils and more. Later the unified object registry techs.php (GIDs, maps, IsBuilding/IsFleet/…) and the constants file defs.php were added, the alliance engine was split into ally.php/allyapps.php/allyranks.php/buddy.php submodules, and the DB layer gained the SQLite backend used by the tests.

Complete typization of core methods #169

All core methods received full PHP type declarations (parameter and return types). Together with PHPStan (see below) this turned a dynamically-typed legacy codebase into one where most type errors are caught at analysis time, before they can reach a running universe.

Unified page router #171

Routing is now data-driven through game/router.json: index.php became a single front controller that maps ?page=… keys to handlers via a declarative table (path, loca, flags, and a new "mvc": true marker), and mods can add routes through the route hook. The admin panel got its own second router, game/pages_admin/admin_router.json (26 ?mode entries, route_admin hook). Today 37 page keys are routed; 31 are MVC pages and only 6 remain old-style — the admin shell itself and the special bare/external pages ainfo, bericht, logout, phalanx, pranger.

Page controller / view separation (MVC) #191

The year’s longest-running refactoring. Game pages previously mixed request handling, business logic and HTML output in single files. Now each page is a class in game/pages/ extending the abstract Page: controller() handles the GET/POST logic and returns whether to render, view() renders; the front controller calls them inside the shared page lifecycle. Migration on master, verified by the "mvc": true flag in router.json: 0 before Jan 26 → 1 (Jan 26, #195, resources) → 2 (Feb 3, #208) → 7 (Feb 16, #234: +overview, notes, buildings, techtree) — stayed 7 through March (#235–#247 were fixes) — then jumped to 31 of 37 routed pages on August 20 (#260, bulk conversion plus regression fixes so the golden snapshot suite passes). All 26 admin modes were converted as well (classes Admin_*). The last six old-style entries are deliberately bare/external pages: the admin shell and ainfo, bericht, logout, phalanx, pranger. The migration plan itself was drafted on June 25 (kept on the branch, not merged into master’s tree).

Resource as GameObject #180

January: resources stopped being three hard-coded numbers and became first-class game objects, each with its own GID (GID_RC_METAL=700, GID_RC_CRYSTAL=701, GID_RC_DEUTERIUM=702, GID_RC_ENERGY=703, GID_RC_DM=704). techs.php gained IsResource() and typed resource maps; unified price/duration/production math and fleet transport/capture handling let resources flow through every object-generic mechanism, and new hooks (add_resources, page_resources_get_bonus, page_buildings_get_bonus) give mods and pages one shared production pipeline (documented in wiki/ru/resources.md).

Why it matters

These changes are the precondition for everything else in this digest: a typed, modular, router-driven core with separated controllers is what makes the mod subsystem, the golden tests and the PHPStan-clean state possible at all — and it lets contributors touch one page without breaking the whole game.

Mods: framework and content

The mod subsystem is the big gameplay story of 2026. A mod is a self-contained folder under game/mods/ declaring a class that extends GameMod (game/core/mods.php). The core finds mods by folder, loads them in activation order, and calls their hooks at fixed points of the engine — from queue events and production bonuses to fleet missions and battle statistics. Mods are installed by an administrator through the new admin section (pages_admin/admin_mods.php), which appends them to the modlist setting and calls install(). Full reference: the Mod Developer Manual and wiki/en/mods.md.

GalaxyTool #214 #216 #217

February: the Galaxytool — previously an always-on core feature — became a built-in but optional mod with its own game page (pages/galaxytool.php) and admin section, localized in six languages (de, en, es, fr, it, ru). A periodic queue event (weekly by default) writes snapshots of the universe into temp/ (galaxy coordinates, top-1000 statistics, alliance statistics), and the user page lists growing/falling/inactive players against the previous snapshot. Administrators tune the refresh period (1–30 days) on the new admin_galaxytool.php page; the mod must be enabled per universe and no GalaxyTool code remains outside the mod folder. The same branch also migrated the whole admin area to MVC (#216) and added the route_admin hook (#217).

Space Storm #172

Started in January and completed in September, Space Storm is a demonstration mod that stress-tests the engine’s global modifiers (its Readme stresses it is an engine testbed, not balanced content). A periodic global event — the Cosmic Storm — ticks hourly and changes the rules of the whole universe: one or more of ten effects (fleet speed −30–50%; 5% instant arrival / 1% lost for 1–2 hours; armor −20% & shields +30%; doubled fuel consumption & +25% deuterium output; spy reports delayed 1–5 min & espionage −2; Energy Collapse with −40% energy and a chance to freeze a random building/research; defense shields +10%; 20% of output converted to a random resource; Transport between own planets disabled; attackers lose 5% of their fleet after a win). A new planetary building, the Reality Stabilizer (GID_B_REALITY_STAB), can only be built during a storm (+0.5% energy per level); each completed level imprints the active storm type on the planet and unlocks per-level counters for those effects. All of it is implemented purely through hooks — battle effects scale unit stats per battle on the battle-engine frontend (battle_unit_stats), the engine backend is untouched. Development milestones: January wave (#173–#193: skeleton, table-driven requirements, first mechanics, can_build/build_end/page_infos hooks), February wave (#209–#230: bonus panel, production/fuel hooks, the core queue-freeze feature FreezeQueue in #213, fleet/spy hooks, the production-at-storage-cap guard), and the September completion (#273– #275): all ten effects and stabilizer counters finalized, en/de localization added (languages now ru/en/de), auto-unfreeze on Energy Collapse (frozen tasks unfreeze when energy recovers) and stabilizer spy protection via the new spy_protection hook (+1 espionage defense per 2 stabilizer levels), and the tests moved inside the mod as a standalone PHPUnit suite.

Deep Space Horror #189

Three giant space monsters — the Amoeba (“Planktonic Devourer”), the Guardian (“Wandering Monolith”) and the Leviathan (“Galactic Juggernaut”) — roam the universe. Each is simultaneously a galaxy “planet”-object and a fleet, exists in a single instance per universe, and carries unique artwork. A monster’s fleet flies (mission “Preparing the hyperjump”) to its Abyss Portal; on arrival it destroys the portal, occupies the spot and, if inhabited planets are in range, an automatic carpet-bombing battle begins against every regular planet in a radius around the portal (P±1 / P±2 / P±3 by monster), including defenses and ACS holding fleets, with more rounds than a normal fight (+1/+2/+3). Movement between portals follows per-monster AI: the Amoeba drifts nearby, the Guardian walks a predictable spiral across the galaxy, the Leviathan jumps to random galaxies.

The battles run through the battle engine’s frontend with no backend edits — the January wave even included a massive BattleEngine rework (#199: PHP battle core and the C++ BattleEngine rewritten) plus unified battle reports and debris calculations, which the mod then uses. If defenders destroy the monster, its remains are distributed between the participants proportionally to their contribution (Amoeba 2.5M deuterium, Guardian 10M crystal, Leviathan 40M metal), personal “Abyss Trophy” messages are sent and a universe-wide broadcast announces the kill; slain monsters respawn at a random point after 24–72 real hours via a one-shot queue event. Languages: ru + en.

In September the mod was audited (#284): battle losses are now written back end-to-end, the trophy is distributed and respawns scheduled (the core helper SetPlanetFleetDefense only writes columns a planet actually has), a standalone PHPUnit suite with 38 tests (25 pure-logic + 13 DB, running on in-memory SQLite) now ships inside the mod, and the 670-line development log was rewritten into a readable structured Readme with English localization added.

BogusMod

Added in early January as the minimal example: one DB column, its own resource, a menu item and a page — the “hello world” of the mod system.

Security and fixes

Security

• XSS in alliance name and notes (#165, merged #263 #264): alliance names/tags and notes, player names, ACS union names and buddy/note text are now HTML-escaped at output across ~30 pages; notes are stored raw and escaped on render (previously double-encoded). Stored-XSS paths closed; XssTest regression suite added.
• Empty-session fix and CheckParameters during install (Sep): an empty session string can no longer authenticate as the technical logged-out account, guests hitting internal pages are redirected home, and the installer validates all fields/ranges and DB reachability before touching tables.
• DB credentials no longer leak: backtraces use DEBUG_BACKTRACE_IGNORE_ARGS (#245), AddDBRow escapes strings via mysqli_real_escape_string, mysqli exceptions are not thrown during connect (Mar).

Combat

• Original OGame missile (IPM) algorithm restored (#61, merged #272): ABMs intercept IPMs 1:1 and leftover damage destroys the defender’s stored missiles once all defenses are gone.
• Statistics update immediately after a missile attack (#145, merged #283): attacker (IPM cost) and defender (destroyed defenses) scores adjust at once, not at the next full recalculation.
• Rocket attack fixes (Feb): IPM damage used the hardcoded unit 503 instead of GID_D_IPM and the overview event list read the wrong variable; launching IPMs now really decrements the planet’s stored missile count (wrong array key).
• Crash after an attack fixed (#231); crash after espionage fixed (#228 — the spy report read a non-existent energy field and rand() got a float bound); expedition battle fixed (missing unit-list guards); AddShipyard and Graviton research fixed (stale planet reads, cost deductions against non-stored resources).
• battle_max setting, hard caps MAX_BUILDINGS_LEVEL/MAX_RESEARCH_LEVEL = 99, enforced in the queue and UI (#221); ACS, expedition battles and fleet dispatch reject fleets above battle_max with localized errors.

Economy and planets

• Negative planet resources when playing as admin fixed (#117, merged #276): resource add/subtract clamps results at zero in PHP, plunder and debris harvesting guard negative inputs; SetPlanetFleetDefense only writes columns the planet actually has.
• Merchant “max” button no longer exceeds storage capacity (#82, merged #277): trades cap to free storage and the capacity check compared crystal against the metal cap — fixed.
• Production above the storage cap no longer ticks (Feb); IsEnoughResources checks player and planet resources separately (Jan); dark matter exposed as the GID_RC_DM resource (Feb); officer expiry moved from global queue events to reliable per-user timers (Jan); debris cleanup uses the unified metal/crystal columns (Jan); logout page honors the player’s skin (Feb).

Exploration

• Expedition visit counter with a cooldown to Farspace and Farspace cleanup (#174, merged #278): a position can be visited ~3×/hour without extra depletion; unused Farspace objects are cleaned by a dedicated weekly queue task — both visible in the admin queue page.

Stability and admin

• PHP 8.x warning cleanup ran all year (deprecated float→int conversions, undefined keys, unserialize(), mysqli reporting).
• Admin: “Check CRON” button in the admin queue page, cron robustness, Botstrat editor with JSON import/export, null-safe planet-name helpers (AdminPlanetName, user list shows “–” for accounts without a home planet), the Source-Check integrity page comparing engine/page file checksums, and vacation mode via a reusable EnableVacation method.

Testing

Before August, the project had only a handful of ad-hoc tests. In two weeks the team built a real regression harness that today renders whole pages and compares them against golden snapshots.

• In-memory DB backend for tests (#250): db.php became a facade choosing between the live mysqli backend and the new db_sqlite.php (PDO SQLite, in-memory), selected via DB_CONNECTION=sqlite. It translates MySQL-isms (LOCK TABLES, SET @var:=, AUTO_INCREMENT) so the real game code and schema run in PHPUnit without a MySQL server; FixtureBuilder fills a full 3-player universe fixture (moons, in-flight fleets, queues, messages, alliance, bans, debris…).
• Golden Pages suite (#251 #257 #259 #270 #271): GoldenPagesTest (122 test methods) boots pages exactly like game/index.php (router, auth, mods, loca), normalizes volatile output (timestamps, sessions, IDs, localized durations) and compares the HTML with stored snapshots; UPDATE_GOLDEN=1 regenerates them. Coverage: 707 snapshot files = 101 HTML per language × 7 languages (de, en, es, fr, it, jp, ru), including ~25 POST-request scenarios for every POST page (fleet recall, shipyard builds, trader exchange, IPM launch, alliance actions…) and guard tests that enforce every routed page and every POST page has a snapshot. On September 1 the snapshots were compared against the OldDesign archive (the classic design preserved in the external ogamespec/OldDesign repo) to prove layout parity, and missing jp_jp loca was completed. The suite immediately caught regressions introduced by the MVC refactoring — which were then fixed.
• Unit tests for the fixes: RocketAttack, RocketAttackStats, TraderStorage, NegativeResources, Farspace, Xss, Notes, Homepage and DbSqlite tests (11 classes, 191 test methods in total) cover the specific bugs listed in the previous section.
• Per-mod standalone PHPUnit suites: Space Storm (22 test methods) and Deep Space Horror (38 test methods) each ship testing/ with their own phpunit.xml, bootstrap and DB tests on the in-memory SQLite backend (#275, #284), so mod development does not pollute the project-wide suite.
• PHPUnit updated to 10.5.62 (#198).

Documentation and quality

• Mod Developer Manual (#286): mod-manual-en.html / mod-manual-ru.html in Evolution styling plus wiki/en/mods.md and wiki/ru/mods.md — a 13-section guide with the folder layout, the GameMod API, mod pages and admin routing, localization, queue events and a full 38-hook reference with call sites, plus real-mod scenarios.
• Doxygen documentation for game/core (#262): +4,200 lines of API comments across 37 core files (Doxyfile in the repo root, output gitignored).
• PHPStan cleanup (#266): level-8 analysis of game/ and wwwroot/ (config from January) reached zero errors in August — the committed report shrank from 5,671 lines (Jan) to “[OK] No errors”. Real bugs surfaced by the analyzer (an unquoted array key, a filectime() typo, a removed each(), missing __DIR__) were fixed, and intentional structures flagged as dead code were restored with ignore markers.
• Wiki: new pages and big updates through the year — mods manual (en+ru), golden-pages testing, install (incl. Docker), feed, queue, bonuses and more.
• Readmes rewritten: Deep Space Horror got a full readable document in September (#284); Space Storm’s Readme documents every effect and hook.

Localization

• Project-name localization (#233): OGAME_INT / OGAME_LOC macros let the game’s name and interface text be localized per language.
• Registration flow localized and stabilized: REG_NEW, REG_CHANGE, REG_GREET_MAIL, REG_GREET_MSG, REG_FORGOT, EMAIL_BARRIERFREI; isValidEmail moved into utils; registration and maintenance pages reworked.
• Mod locales: Space Storm in en/de/ru, Deep Space Horror in en/ru, GalaxyTool in six languages.
• Golden-page snapshots in all seven languages keep translations honest page by page.

Deployment and PHP 8.x

• Docker: the Dockerfile and deployment story were overhauled (Jan–Sep) — compose.yaml, battle engine inside the container, install checks; the wiki gained a full Docker install guide and links to community deployments.
• PHP 8.x compatibility: all 8.x/8.2 deprecation warnings (float-to-int, unserialize, mysqli reporting) fixed through the year; php.ini guidance updated.
• git hygiene: LF line endings enforced via .gitattributes; PHPStan and PHPUnit configs and reports versioned with the code.

Team and links

Repository: github.com/ogamespec/ogame-opensource. Main development and code review: ogamespec. A substantial part of the 2026 work was executed with the help of AI coding agents whose commits carry the trailer Co-authored-by: DeepSeek Harness <deepseek-harness@noreply.local> — this digest itself was compiled by such an agent on the branch 282-digest-year-2026 (issue #282).

• Issues and pull requests: issues / pulls
• Docs: Mod Developer Manual (EN) · Mod Developer Manual (RU) · wiki/en/mods.md
• This digest: Русская версия