feat: game lobby service

lobby/internal/service/approveapplication/service.go

@@ -0,0 +1,307 @@
+// Package approveapplication implements the `lobby.application.approve`
+// message type. It reserves the applicant's race name, transitions the
+// application from submitted to approved, creates the matching active
+// membership, opens the gap window when the new approved count equals
+// max_players, and publishes the lobby.membership.approved intent.
+package approveapplication
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+	"galaxy/notificationintent"
+)
+
+// Service executes the public-game application approval use case.
+type Service struct {
+	games        ports.GameStore
+	memberships  ports.MembershipStore
+	applications ports.ApplicationStore
+	directory    ports.RaceNameDirectory
+	gapStore     ports.GapActivationStore
+	intents      ports.IntentPublisher
+	ids          ports.IDGenerator
+	clock        func() time.Time
+	logger       *slog.Logger
+	telemetry    *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the target game record for status verification.
+	Games ports.GameStore
+
+	// Memberships persists the new active membership and supplies the
+	// approved-count for the gap-window decision.
+	Memberships ports.MembershipStore
+
+	// Applications loads the target application and applies the
+	// submitted → approved transition.
+	Applications ports.ApplicationStore
+
+	// Directory canonicalizes the race name and reserves it for the
+	// applicant.
+	Directory ports.RaceNameDirectory
+
+	// GapStore records the gap-window activation timestamp when the
+	// new approved count equals max_players.
+	GapStore ports.GapActivationStore
+
+	// Intents publishes the lobby.membership.approved intent.
+	Intents ports.IntentPublisher
+
+	// IDs mints the new opaque membership identifier.
+	IDs ports.IDGenerator
+
+	// Clock supplies the wall-clock used for DecidedAt, JoinedAt,
+	// gap-activation time, and the notification's OccurredAt.
+	Clock func() time.Time
+
+	// Logger records structured service-level events.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.application.outcomes` and
+	// `lobby.membership.changes` counters. Optional; nil disables
+	// metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new approve application service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new approve application service: nil membership store")
+	case deps.Applications == nil:
+		return nil, errors.New("new approve application service: nil application store")
+	case deps.Directory == nil:
+		return nil, errors.New("new approve application service: nil race name directory")
+	case deps.GapStore == nil:
+		return nil, errors.New("new approve application service: nil gap activation store")
+	case deps.Intents == nil:
+		return nil, errors.New("new approve application service: nil intent publisher")
+	case deps.IDs == nil:
+		return nil, errors.New("new approve application service: nil id generator")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:        deps.Games,
+		memberships:  deps.Memberships,
+		applications: deps.Applications,
+		directory:    deps.Directory,
+		gapStore:     deps.GapStore,
+		intents:      deps.Intents,
+		ids:          deps.IDs,
+		clock:        clock,
+		logger:       logger.With("service", "lobby.approveapplication"),
+		telemetry:    deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to approve one application.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindAdmin per the
+	// README message catalog.
+	Actor shared.Actor
+
+	// GameID identifies the game referenced by the request path; it
+	// must match the loaded application's GameID.
+	GameID common.GameID
+
+	// ApplicationID identifies the target application.
+	ApplicationID common.ApplicationID
+}
+
+// Handle authorizes the actor, validates the application + game state,
+// reserves the race name, transitions the application, persists the
+// membership, opens the gap window if appropriate, and publishes the
+// lobby.membership.approved intent on success.
+func (service *Service) Handle(ctx context.Context, input Input) (membership.Membership, error) {
+	if service == nil {
+		return membership.Membership{}, errors.New("approve application: nil service")
+	}
+	if ctx == nil {
+		return membership.Membership{}, errors.New("approve application: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: actor: %w", err)
+	}
+	if !input.Actor.IsAdmin() {
+		return membership.Membership{}, fmt.Errorf(
+			"%w: only admin callers may approve applications",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+	if err := input.ApplicationID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+
+	app, err := service.applications.Get(ctx, input.ApplicationID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+	if app.GameID != input.GameID {
+		// Defensive: opaque ids must not leak across games.
+		return membership.Membership{}, fmt.Errorf(
+			"approve application: application %q does not belong to game %q: %w",
+			app.ApplicationID, input.GameID, application.ErrNotFound,
+		)
+	}
+	if app.Status != application.StatusSubmitted {
+		return membership.Membership{}, fmt.Errorf(
+			"approve application: status %q is not %q: %w",
+			app.Status, application.StatusSubmitted, application.ErrConflict,
+		)
+	}
+
+	gameRecord, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+	if gameRecord.GameType != game.GameTypePublic {
+		return membership.Membership{}, fmt.Errorf(
+			"approve application: game %q is not public: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+	if gameRecord.Status != game.StatusEnrollmentOpen {
+		return membership.Membership{}, fmt.Errorf(
+			"approve application: game %q is not in enrollment_open: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+
+	cap := gameRecord.MaxPlayers + gameRecord.StartGapPlayers
+	currentActive, err := shared.CountActiveMemberships(ctx, service.memberships, gameRecord.GameID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+	if currentActive >= cap {
+		return membership.Membership{}, fmt.Errorf(
+			"approve application: roster full (%d active >= %d cap): %w",
+			currentActive, cap, game.ErrConflict,
+		)
+	}
+
+	canonical, err := service.directory.Canonicalize(app.RaceName)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+
+	if err := service.directory.Reserve(ctx, gameRecord.GameID.String(), app.ApplicantUserID, app.RaceName); err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+
+	now := service.clock().UTC()
+	updateErr := service.applications.UpdateStatus(ctx, ports.UpdateApplicationStatusInput{
+		ApplicationID: app.ApplicationID,
+		ExpectedFrom:  application.StatusSubmitted,
+		To:            application.StatusApproved,
+		At:            now,
+	})
+	if updateErr != nil {
+		// Concurrent mutation lost the CAS race. Release the
+		// reservation we just made so it does not orphan; the user
+		// may retry submission later under the same canonical key.
+		if releaseErr := service.directory.ReleaseReservation(ctx, gameRecord.GameID.String(), app.ApplicantUserID, app.RaceName); releaseErr != nil {
+			service.logger.WarnContext(ctx, "release reservation after approve cas failure",
+				"application_id", app.ApplicationID.String(),
+				"err", releaseErr.Error(),
+			)
+		}
+		return membership.Membership{}, fmt.Errorf("approve application: %w", updateErr)
+	}
+
+	membershipID, err := service.ids.NewMembershipID()
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+	memberRecord, err := membership.New(membership.NewMembershipInput{
+		MembershipID: membershipID,
+		GameID:       gameRecord.GameID,
+		UserID:       app.ApplicantUserID,
+		RaceName:     app.RaceName,
+		CanonicalKey: canonical,
+		Now:          now,
+	})
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+	if err := service.memberships.Save(ctx, memberRecord); err != nil {
+		return membership.Membership{}, fmt.Errorf("approve application: %w", err)
+	}
+
+	// Gap-window trigger: count after Save now includes the new
+	// membership, so if it equals max_players we just crossed the
+	// threshold. The worker reads gap_activated_at to time
+	// out the gap; auto-transition to ready_to_start is its job.
+	if currentActive+1 == gameRecord.MaxPlayers {
+		if err := service.gapStore.MarkActivated(ctx, gameRecord.GameID, now); err != nil {
+			service.logger.WarnContext(ctx, "mark gap activation",
+				"game_id", gameRecord.GameID.String(),
+				"err", err.Error(),
+			)
+		}
+	}
+
+	intent, err := notificationintent.NewLobbyMembershipApprovedIntent(
+		notificationintent.Metadata{
+			IdempotencyKey: "lobby.membership.approved:" + memberRecord.MembershipID.String(),
+			OccurredAt:     now,
+		},
+		memberRecord.UserID,
+		notificationintent.LobbyMembershipApprovedPayload{
+			GameID:   gameRecord.GameID.String(),
+			GameName: gameRecord.GameName,
+		},
+	)
+	if err != nil {
+		service.logger.ErrorContext(ctx, "build membership approved intent",
+			"membership_id", memberRecord.MembershipID.String(),
+			"err", err.Error(),
+		)
+	} else if _, publishErr := service.intents.Publish(ctx, intent); publishErr != nil {
+		service.logger.WarnContext(ctx, "publish membership approved intent",
+			"membership_id", memberRecord.MembershipID.String(),
+			"err", publishErr.Error(),
+		)
+	}
+
+	service.telemetry.RecordApplicationOutcome(ctx, "approved")
+	service.telemetry.RecordMembershipChange(ctx, "activated")
+
+	logArgs := []any{
+		"game_id", gameRecord.GameID.String(),
+		"game_status", string(gameRecord.Status),
+		"application_id", app.ApplicationID.String(),
+		"membership_id", memberRecord.MembershipID.String(),
+		"user_id", memberRecord.UserID,
+		"race_name", memberRecord.RaceName,
+		"canonical_key", string(canonical),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "application approved", logArgs...)
+	return memberRecord, nil
+}

lobby/internal/service/approveapplication/service_test.go

@@ -0,0 +1,396 @@
+package approveapplication_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/applicationstub"
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/gapactivationstub"
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/approveapplication"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixedIDs struct {
+	gameID        common.GameID
+	applicationID common.ApplicationID
+	membershipID  common.MembershipID
+}
+
+func (f fixedIDs) NewGameID() (common.GameID, error)               { return f.gameID, nil }
+func (f fixedIDs) NewApplicationID() (common.ApplicationID, error) { return f.applicationID, nil }
+func (f fixedIDs) NewInviteID() (common.InviteID, error)           { return "", errors.New("not used") }
+func (f fixedIDs) NewMembershipID() (common.MembershipID, error)   { return f.membershipID, nil }
+
+type fixture struct {
+	now              time.Time
+	games            *gamestub.Store
+	memberships      *membershipstub.Store
+	applications     *applicationstub.Store
+	directory        *racenamestub.Directory
+	gapStore         *gapactivationstub.Store
+	intents          *intentpubstub.Publisher
+	ids              fixedIDs
+	openPublicGameID common.GameID
+}
+
+func newFixture(t *testing.T, maxPlayers, gapPlayers int) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	dir, err := racenamestub.NewDirectory(racenamestub.WithClock(fixedClock(now)))
+	require.NoError(t, err)
+	games := gamestub.NewStore()
+	memberships := membershipstub.NewStore()
+	applications := applicationstub.NewStore()
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              "game-public",
+		GameName:            "Galactic Open",
+		GameType:            game.GameTypePublic,
+		MinPlayers:          2,
+		MaxPlayers:          maxPlayers,
+		StartGapHours:       2,
+		StartGapPlayers:     gapPlayers,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusEnrollmentOpen
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	return &fixture{
+		now:              now,
+		games:            games,
+		memberships:      memberships,
+		applications:     applications,
+		directory:        dir,
+		gapStore:         gapactivationstub.NewStore(),
+		intents:          intentpubstub.NewPublisher(),
+		ids:              fixedIDs{membershipID: "membership-fixed"},
+		openPublicGameID: gameRecord.GameID,
+	}
+}
+
+func newService(t *testing.T, f *fixture) *approveapplication.Service {
+	t.Helper()
+	svc, err := approveapplication.NewService(approveapplication.Dependencies{
+		Games:        f.games,
+		Memberships:  f.memberships,
+		Applications: f.applications,
+		Directory:    f.directory,
+		GapStore:     f.gapStore,
+		Intents:      f.intents,
+		IDs:          f.ids,
+		Clock:        fixedClock(f.now),
+		Logger:       silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func seedSubmittedApplication(t *testing.T, f *fixture, applicationID common.ApplicationID, userID, raceName string) application.Application {
+	t.Helper()
+	app, err := application.New(application.NewApplicationInput{
+		ApplicationID:   applicationID,
+		GameID:          f.openPublicGameID,
+		ApplicantUserID: userID,
+		RaceName:        raceName,
+		Now:             f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.applications.Save(context.Background(), app))
+	return app
+}
+
+func TestApproveHappyPath(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, common.MembershipID("membership-fixed"), got.MembershipID)
+	assert.Equal(t, "SolarPilot", got.RaceName)
+	assert.Equal(t, "solarpilot", got.CanonicalKey)
+	assert.Equal(t, membership.StatusActive, got.Status)
+	assert.Equal(t, f.now, got.JoinedAt)
+
+	updated, err := f.applications.Get(context.Background(), app.ApplicationID)
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusApproved, updated.Status)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-2")
+	require.NoError(t, err)
+	assert.True(t, availability.Taken)
+	assert.Equal(t, "user-1", availability.HolderUserID)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	assert.Equal(t, notificationintent.NotificationTypeLobbyMembershipApproved, intents[0].NotificationType)
+	assert.Equal(t, []string{"user-1"}, intents[0].RecipientUserIDs)
+
+	assert.False(t, f.gapStore.WasActivated(f.openPublicGameID))
+}
+
+func TestApproveActivatesGapAtMaxPlayers(t *testing.T) {
+	t.Parallel()
+	// max=2, gap=1; pre-seed 1 active member. Approval pushes count to 2 (== max).
+	f := newFixture(t, 2, 1)
+	preexisting, err := membership.New(membership.NewMembershipInput{
+		MembershipID: "membership-pre",
+		GameID:       f.openPublicGameID,
+		UserID:       "user-pre",
+		RaceName:     "VoidRunner",
+		CanonicalKey: "voidrunner",
+		Now:          f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), preexisting))
+
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	_, err = svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.NoError(t, err)
+	assert.True(t, f.gapStore.WasActivated(f.openPublicGameID))
+	assert.Equal(t, f.now, f.gapStore.ActivatedAt(f.openPublicGameID))
+}
+
+func TestApproveDoesNotActivateGapBelowMax(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.NoError(t, err)
+	assert.False(t, f.gapStore.WasActivated(f.openPublicGameID))
+}
+
+func TestApproveUserActorForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewUserActor("user-1"),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestApproveApplicationNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: "application-missing",
+	})
+	require.ErrorIs(t, err, application.ErrNotFound)
+}
+
+func TestApproveCrossGameApplicationNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        "game-other",
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, application.ErrNotFound)
+}
+
+func TestApproveAlreadyDecidedConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	require.NoError(t, f.applications.UpdateStatus(context.Background(), ports.UpdateApplicationStatusInput{
+		ApplicationID: app.ApplicationID,
+		ExpectedFrom:  application.StatusSubmitted,
+		To:            application.StatusRejected,
+		At:            f.now,
+	}))
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, application.ErrConflict)
+}
+
+func TestApproveGameNotEnrollmentOpenConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+
+	rec, err := f.games.Get(context.Background(), f.openPublicGameID)
+	require.NoError(t, err)
+	rec.Status = game.StatusReadyToStart
+	require.NoError(t, f.games.Save(context.Background(), rec))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestApproveRosterFullConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 2, 1)
+	for i := range 3 {
+		member, err := membership.New(membership.NewMembershipInput{
+			MembershipID: common.MembershipID("membership-seed-" + string(rune('a'+i))),
+			GameID:       f.openPublicGameID,
+			UserID:       "seed-user-" + string(rune('a'+i)),
+			RaceName:     "Seed " + string(rune('A'+i)),
+			CanonicalKey: "seed" + string(rune('a'+i)),
+			Now:          f.now,
+		})
+		require.NoError(t, err)
+		require.NoError(t, f.memberships.Save(context.Background(), member))
+	}
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestApproveNameTakenByAnotherUser(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	require.NoError(t, f.directory.Reserve(context.Background(), "game-other", "user-other", "SolarPilot"))
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, ports.ErrNameTaken)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-1")
+	require.NoError(t, err)
+	assert.True(t, availability.Taken)
+	assert.Equal(t, "user-other", availability.HolderUserID)
+}
+
+// approveCASStub wraps applicationstub.Store but injects ErrConflict on
+// the next UpdateStatus call so we can observe the rollback path.
+type approveCASStub struct {
+	*applicationstub.Store
+	failNext bool
+}
+
+func (s *approveCASStub) UpdateStatus(ctx context.Context, input ports.UpdateApplicationStatusInput) error {
+	if s.failNext {
+		s.failNext = false
+		return application.ErrConflict
+	}
+	return s.Store.UpdateStatus(ctx, input)
+}
+
+func TestApproveCASConflictReleasesReservation(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+
+	cas := &approveCASStub{Store: f.applications, failNext: true}
+	svc, err := approveapplication.NewService(approveapplication.Dependencies{
+		Games:        f.games,
+		Memberships:  f.memberships,
+		Applications: cas,
+		Directory:    f.directory,
+		GapStore:     f.gapStore,
+		Intents:      f.intents,
+		IDs:          f.ids,
+		Clock:        fixedClock(f.now),
+		Logger:       silentLogger(),
+	})
+	require.NoError(t, err)
+
+	_, err = svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, application.ErrConflict)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-2")
+	require.NoError(t, err)
+	assert.False(t, availability.Taken, "reservation must have been released after CAS failure")
+	assert.Empty(t, availability.HolderUserID)
+}
+
+func TestApprovePublishFailureDoesNotRollback(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	f.intents.SetError(errors.New("publish failed"))
+
+	svc := newService(t, f)
+	got, err := svc.Handle(context.Background(), approveapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, common.MembershipID("membership-fixed"), got.MembershipID)
+
+	updated, err := f.applications.Get(context.Background(), app.ApplicationID)
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusApproved, updated.Status)
+}

lobby/internal/service/blockmember/service.go

@@ -0,0 +1,204 @@
+// Package blockmember implements the `lobby.membership.block` message
+// type. It transitions an active membership to `blocked` while the
+// game is still on a non-terminal status. Race name reservations are
+// preserved; the capability evaluator at game finish
+// resolves them alongside `removed` memberships.
+package blockmember
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// blockableGameStatuses enumerates the game statuses in which an
+// active membership may be blocked. Block is allowed in both pre- and
+// post-start statuses (README §Membership Model status table records
+// `active → blocked` without a post-start qualifier). Terminal game
+// statuses are rejected because no further roster mutation makes
+// sense after `finished`/`cancelled` and `draft` carries no
+// memberships at all.
+var blockableGameStatuses = map[game.Status]struct{}{
+	game.StatusEnrollmentOpen: {},
+	game.StatusReadyToStart:   {},
+	game.StatusStarting:       {},
+	game.StatusStartFailed:    {},
+	game.StatusRunning:        {},
+	game.StatusPaused:         {},
+}
+
+// Service executes the block-member use case.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	clock       func() time.Time
+	logger      *slog.Logger
+	telemetry   *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the game record so the service can authorize the
+	// actor against the owner and gate the operation by game status.
+	Games ports.GameStore
+
+	// Memberships persists the active → blocked transition.
+	Memberships ports.MembershipStore
+
+	// Clock supplies the wall-clock used for the RemovedAt stamp.
+	// Defaults to time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.membership.changes` counter on each
+	// successful block. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new block member service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new block member service: nil membership store")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		clock:       clock,
+		logger:      logger.With("service", "lobby.blockmember"),
+		telemetry:   deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to block one membership.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the game referenced by the request path; it
+	// must match the loaded membership's GameID.
+	GameID common.GameID
+
+	// MembershipID identifies the target membership.
+	MembershipID common.MembershipID
+}
+
+// Handle authorizes the actor, asserts the membership belongs to the
+// game and is currently active, transitions the membership to
+// `blocked`, and returns the post-transition record. The race name
+// reservation is intentionally preserved.
+func (service *Service) Handle(ctx context.Context, input Input) (membership.Membership, error) {
+	if service == nil {
+		return membership.Membership{}, errors.New("block member: nil service")
+	}
+	if ctx == nil {
+		return membership.Membership{}, errors.New("block member: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("block member: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("block member: %w", err)
+	}
+	if err := input.MembershipID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("block member: %w", err)
+	}
+
+	member, err := service.memberships.Get(ctx, input.MembershipID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("block member: %w", err)
+	}
+	if member.GameID != input.GameID {
+		return membership.Membership{}, fmt.Errorf(
+			"block member: membership %q does not belong to game %q: %w",
+			member.MembershipID, input.GameID, membership.ErrNotFound,
+		)
+	}
+
+	gameRecord, err := service.games.Get(ctx, member.GameID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("block member: %w", err)
+	}
+	if err := authorize(input.Actor, gameRecord); err != nil {
+		return membership.Membership{}, err
+	}
+
+	if _, ok := blockableGameStatuses[gameRecord.Status]; !ok {
+		return membership.Membership{}, fmt.Errorf(
+			"block member: game status %q does not allow block: %w",
+			gameRecord.Status, game.ErrConflict,
+		)
+	}
+
+	if member.Status != membership.StatusActive {
+		return membership.Membership{}, fmt.Errorf(
+			"block member: status %q is not %q: %w",
+			member.Status, membership.StatusActive, membership.ErrConflict,
+		)
+	}
+
+	now := service.clock().UTC()
+	if err := service.memberships.UpdateStatus(ctx, ports.UpdateMembershipStatusInput{
+		MembershipID: member.MembershipID,
+		ExpectedFrom: membership.StatusActive,
+		To:           membership.StatusBlocked,
+		At:           now,
+	}); err != nil {
+		return membership.Membership{}, fmt.Errorf("block member: %w", err)
+	}
+
+	updated, err := service.memberships.Get(ctx, member.MembershipID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("block member: %w", err)
+	}
+
+	service.telemetry.RecordMembershipChange(ctx, "blocked")
+
+	logArgs := []any{
+		"game_id", gameRecord.GameID.String(),
+		"game_status", string(gameRecord.Status),
+		"membership_id", member.MembershipID.String(),
+		"user_id", member.UserID,
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "member blocked", logArgs...)
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to block members of game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/blockmember/service_test.go

@@ -0,0 +1,368 @@
+package blockmember_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/blockmember"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+type fixtures struct {
+	games       *gamestub.Store
+	memberships *membershipstub.Store
+	directory   *racenamestub.Directory
+}
+
+func newFixtures(t *testing.T) *fixtures {
+	t.Helper()
+
+	directory, err := racenamestub.NewDirectory()
+	require.NoError(t, err)
+
+	return &fixtures{
+		games:       gamestub.NewStore(),
+		memberships: membershipstub.NewStore(),
+		directory:   directory,
+	}
+}
+
+func (f *fixtures) newService(t *testing.T, clock func() time.Time) *blockmember.Service {
+	t.Helper()
+
+	svc, err := blockmember.NewService(blockmember.Dependencies{
+		Games:       f.games,
+		Memberships: f.memberships,
+		Clock:       clock,
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func (f *fixtures) seedGame(
+	t *testing.T,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	status game.Status,
+	now time.Time,
+) game.Game {
+	t.Helper()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "test block",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = now.Add(time.Minute)
+		switch status {
+		case game.StatusRunning, game.StatusPaused, game.StatusFinished:
+			startedAt := now.Add(time.Minute)
+			record.StartedAt = &startedAt
+		}
+		if status == game.StatusFinished {
+			finishedAt := now.Add(2 * time.Minute)
+			record.FinishedAt = &finishedAt
+		}
+	}
+	require.NoError(t, f.games.Save(context.Background(), record))
+	return record
+}
+
+func (f *fixtures) seedMembership(
+	t *testing.T,
+	gameID common.GameID,
+	membershipID common.MembershipID,
+	userID, raceName string,
+	now time.Time,
+) membership.Membership {
+	t.Helper()
+
+	record, err := membership.New(membership.NewMembershipInput{
+		MembershipID: membershipID,
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     raceName,
+		CanonicalKey: strings.ToLower(strings.ReplaceAll(raceName, " ", "")),
+		Now:          now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), record))
+	require.NoError(t, f.directory.Reserve(context.Background(), gameID.String(), userID, raceName))
+	return record
+}
+
+func (f *fixtures) markMembership(
+	t *testing.T,
+	membershipID common.MembershipID,
+	to membership.Status,
+	at time.Time,
+) {
+	t.Helper()
+
+	require.NoError(t, f.memberships.UpdateStatus(context.Background(), ports.UpdateMembershipStatusInput{
+		MembershipID: membershipID,
+		ExpectedFrom: membership.StatusActive,
+		To:           to,
+		At:           at,
+	}))
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+
+	_, err := blockmember.NewService(blockmember.Dependencies{})
+	require.Error(t, err)
+}
+
+func TestBlockMemberAdminPreStartKeepsReservation(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	at := now.Add(time.Hour)
+	svc := f.newService(t, fixedClock(at))
+
+	result, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusBlocked, result.Status)
+	require.NotNil(t, result.RemovedAt)
+	assert.True(t, result.RemovedAt.Equal(at))
+
+	persisted, err := f.memberships.Get(context.Background(), member.MembershipID)
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusBlocked, persisted.Status)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-other")
+	require.NoError(t, err)
+	assert.True(t, availability.Taken)
+	assert.Equal(t, "user-1", availability.HolderUserID)
+}
+
+func TestBlockMemberAdminPostStartKeepsReservation(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusRunning, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+
+	result, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusBlocked, result.Status)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-other")
+	require.NoError(t, err)
+	assert.True(t, availability.Taken)
+	assert.Equal(t, "user-1", availability.HolderUserID)
+}
+
+func TestBlockMemberPrivateOwner(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-priv", game.GameTypePrivate, "user-owner", game.StatusPaused, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-priv", "user-2", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	result, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.NewUserActor("user-owner"),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusBlocked, result.Status)
+}
+
+func TestBlockMemberRejectsPublicGameUserActor(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestBlockMemberRejectsNonOwnerUser(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-priv", game.GameTypePrivate, "user-owner", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-priv", "user-2", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.NewUserActor("user-other"),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestBlockMemberRejectsMismatchedGameID(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       common.GameID("game-other"),
+		MembershipID: member.MembershipID,
+	})
+	require.ErrorIs(t, err, membership.ErrNotFound)
+}
+
+func TestBlockMemberRejectsMissingMembership(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       "game-public",
+		MembershipID: common.MembershipID("membership-missing"),
+	})
+	require.ErrorIs(t, err, membership.ErrNotFound)
+}
+
+func TestBlockMemberRejectsAlreadyTerminalMembership(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		to   membership.Status
+	}{
+		{"removed", membership.StatusRemoved},
+		{"blocked", membership.StatusBlocked},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+			f := newFixtures(t)
+			gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusRunning, now)
+			member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+			f.markMembership(t, member.MembershipID, tc.to, now.Add(time.Minute))
+
+			svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+			_, err := svc.Handle(context.Background(), blockmember.Input{
+				Actor:        shared.NewAdminActor(),
+				GameID:       gameRecord.GameID,
+				MembershipID: member.MembershipID,
+			})
+			require.ErrorIs(t, err, membership.ErrConflict)
+		})
+	}
+}
+
+func TestBlockMemberRejectsTerminalGameStatuses(t *testing.T) {
+	t.Parallel()
+
+	statuses := []game.Status{
+		game.StatusDraft,
+		game.StatusFinished,
+		game.StatusCancelled,
+	}
+
+	for _, status := range statuses {
+		t.Run(string(status), func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+			f := newFixtures(t)
+			gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", status, now)
+			member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+			svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+			_, err := svc.Handle(context.Background(), blockmember.Input{
+				Actor:        shared.NewAdminActor(),
+				GameID:       gameRecord.GameID,
+				MembershipID: member.MembershipID,
+			})
+			require.ErrorIs(t, err, game.ErrConflict)
+		})
+	}
+}
+
+func TestBlockMemberInvalidActor(t *testing.T) {
+	t.Parallel()
+
+	f := newFixtures(t)
+	svc := f.newService(t, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := svc.Handle(context.Background(), blockmember.Input{
+		Actor:        shared.Actor{Kind: shared.ActorKindUser},
+		GameID:       "game-x",
+		MembershipID: "membership-x",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}

lobby/internal/service/cancelgame/service.go

@@ -0,0 +1,170 @@
+// Package cancelgame implements the `lobby.game.cancel` message type. It
+// transitions a game record to `cancelled` from one of the allowed source
+// statuses (`draft`, `enrollment_open`, `ready_to_start`, `start_failed`)
+// after enforcing admin-or-owner authorization. Any other source status is
+// rejected with game.ErrConflict.
+package cancelgame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// cancellableStatuses enumerates the source statuses from which a game may
+// transition directly to `cancelled`. The set mirrors the allowed
+// transitions defined in `internal/domain/game/status.go` and the
+// PLAN.md exit criteria.
+var cancellableStatuses = map[game.Status]struct{}{
+	game.StatusDraft:          {},
+	game.StatusEnrollmentOpen: {},
+	game.StatusReadyToStart:   {},
+	game.StatusStartFailed:    {},
+}
+
+// Service executes the cancel-game use case.
+type Service struct {
+	games     ports.GameStore
+	clock     func() time.Time
+	logger    *slog.Logger
+	telemetry *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games mediates the CAS status transition and the result read.
+	Games ports.GameStore
+
+	// Clock supplies the wall-clock used for UpdatedAt. Defaults to
+	// time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.game.transitions` counter on each
+	// successful cancellation. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Games == nil {
+		return nil, errors.New("new cancel game service: nil game store")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:     deps.Games,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.cancelgame"),
+		telemetry: deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to cancel one game.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, checks the source status, transitions the
+// record to `cancelled`, and returns the post-transition snapshot.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("cancel game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("cancel game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("cancel game: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("cancel game: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("cancel game: %w", err)
+	}
+
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+
+	if _, ok := cancellableStatuses[record.Status]; !ok {
+		return game.Game{}, fmt.Errorf(
+			"cancel game: status %q cannot be cancelled: %w",
+			record.Status, game.ErrConflict,
+		)
+	}
+
+	at := service.clock().UTC()
+	err = service.games.UpdateStatus(ctx, ports.UpdateStatusInput{
+		GameID:       input.GameID,
+		ExpectedFrom: record.Status,
+		To:           game.StatusCancelled,
+		Trigger:      game.TriggerCommand,
+		At:           at,
+	})
+	if err != nil {
+		return game.Game{}, fmt.Errorf("cancel game: %w", err)
+	}
+
+	service.telemetry.RecordGameTransition(ctx,
+		string(record.Status),
+		string(game.StatusCancelled),
+		string(game.TriggerCommand),
+	)
+
+	updated, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("cancel game: %w", err)
+	}
+
+	logArgs := []any{
+		"game_id", updated.GameID.String(),
+		"from_status", string(record.Status),
+		"to_status", string(updated.Status),
+		"trigger", string(game.TriggerCommand),
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "game cancelled", logArgs...)
+
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to cancel game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/cancelgame/service_test.go

@@ -0,0 +1,267 @@
+package cancelgame_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/cancelgame"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+// seedGameWithStatus persists a fresh game and, when wanted differs from
+// `draft`, overwrites the Status field directly via Save. This bypasses
+// the transition gate so individual tests can exercise cancel against any
+// status the surface must reject or accept.
+func seedGameWithStatus(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	status game.Status,
+	now time.Time,
+) game.Game {
+	t.Helper()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = now.Add(time.Minute)
+		if status == game.StatusRunning || status == game.StatusPaused ||
+			status == game.StatusFinished {
+			startedAt := now.Add(time.Minute)
+			record.StartedAt = &startedAt
+		}
+		if status == game.StatusFinished {
+			finishedAt := now.Add(2 * time.Minute)
+			record.FinishedAt = &finishedAt
+		}
+	}
+	require.NoError(t, store.Save(context.Background(), record))
+
+	return record
+}
+
+func newService(t *testing.T, store ports.GameStore, clock func() time.Time) *cancelgame.Service {
+	t.Helper()
+
+	svc, err := cancelgame.NewService(cancelgame.Dependencies{
+		Games:  store,
+		Clock:  clock,
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func TestHandleFromCancellableStatuses(t *testing.T) {
+	t.Parallel()
+
+	statuses := []game.Status{
+		game.StatusDraft,
+		game.StatusEnrollmentOpen,
+		game.StatusReadyToStart,
+		game.StatusStartFailed,
+	}
+
+	for _, status := range statuses {
+		t.Run(string(status), func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+			store := gamestub.NewStore()
+			record := seedGameWithStatus(t, store, "game-a", game.GameTypePublic, "", status, now)
+
+			service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+			updated, err := service.Handle(context.Background(), cancelgame.Input{
+				Actor:  shared.NewAdminActor(),
+				GameID: record.GameID,
+			})
+			require.NoError(t, err)
+			require.Equal(t, game.StatusCancelled, updated.Status)
+			require.Equal(t, now.Add(time.Hour).UTC(), updated.UpdatedAt)
+		})
+	}
+}
+
+func TestHandleFromRejectedStatuses(t *testing.T) {
+	t.Parallel()
+
+	statuses := []game.Status{
+		game.StatusStarting,
+		game.StatusRunning,
+		game.StatusPaused,
+	}
+
+	for _, status := range statuses {
+		t.Run(string(status), func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+			store := gamestub.NewStore()
+			record := seedGameWithStatus(t, store, "game-b", game.GameTypePublic, "", status, now)
+
+			service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+			_, err := service.Handle(context.Background(), cancelgame.Input{
+				Actor:  shared.NewAdminActor(),
+				GameID: record.GameID,
+			})
+			require.ErrorIs(t, err, game.ErrConflict)
+		})
+	}
+}
+
+func TestHandleAlreadyCancelledIsConflict(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-c", game.GameTypePublic, "", game.StatusCancelled, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleFinishedIsConflict(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-f", game.GameTypePublic, "", game.StatusFinished, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleOwnerCancelsPrivate(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-priv", game.GameTypePrivate, "user-1", game.StatusEnrollmentOpen, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.NewUserActor("user-1"),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	require.Equal(t, game.StatusCancelled, updated.Status)
+}
+
+func TestHandleNonOwnerForbidden(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-priv", game.GameTypePrivate, "user-1", game.StatusEnrollmentOpen, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.NewUserActor("user-2"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleUserCannotCancelPublic(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-pub", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.NewUserActor("user-1"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleNotFound(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: "game-missing",
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestHandleInvalidActor(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.Actor{Kind: shared.ActorKindUser},
+		GameID: "game-x",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestHandleInvalidGameID(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), cancelgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: "bad",
+	})
+	require.Error(t, err)
+}

lobby/internal/service/capabilityevaluation/service.go

@@ -0,0 +1,410 @@
+// Package capabilityevaluation implements the per-membership
+// capability evaluation at game finish. The evaluator is invoked by the
+// gmevents consumer after the platform game record reaches the
+// `finished` status; it walks every membership of the game, decides
+// capable/incapable for active members based on the per-game stats
+// aggregate, and resolves outstanding race-name reservations through the
+// Race Name Directory.
+//
+// Capability rule (frozen in lobby/README.md §Game Finish Flow):
+//
+//	capable = max_planets > initial_planets AND max_population > initial_population
+//
+// Capable members get their reservation promoted to `pending_registration`
+// with eligible_until = finished_at + 30 days, plus a
+// `lobby.race_name.registration_eligible` intent. Incapable members get
+// their reservation released immediately, plus an optional
+// `lobby.race_name.registration_denied` intent. `removed` and `blocked`
+// memberships have their outstanding reservations released without an
+// intent.
+//
+// Idempotency is guarded by ports.EvaluationGuardStore: the first pass for
+// a game records a marker and proceeds with side effects; later passes
+// observe the marker and return without mutating the directory or
+// publishing intents. The guard is recorded only after the directory and
+// stats mutations succeed so a transient failure replays from scratch on
+// the next consumer tick.
+package capabilityevaluation
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// PendingRegistrationWindow is the post-game window during which a capable
+// member may convert their reservation into a registered race name. The
+// 30-day value is frozen in lobby/README.md §Reservation lifecycle and
+// capability.
+const PendingRegistrationWindow = 30 * 24 * time.Hour
+
+// EligibleEvent carries the inputs required to publish one
+// lobby.race_name.registration_eligible intent. The struct exists so that
+// the publisher receives a stable shape even though the real
+// constructors live in pkg/notificationintent.
+type EligibleEvent struct {
+	// GameID identifies the finished game whose capable finish produced
+	// the pending registration.
+	GameID common.GameID
+
+	// GameName is the human-readable game name copied from the game
+	// record at finish time.
+	GameName string
+
+	// UserID identifies the capable member.
+	UserID string
+
+	// RaceName is the original-casing race name reserved by the user.
+	RaceName string
+
+	// EligibleUntil is the deadline by which the user must call
+	// lobby.race_name.register to keep the name.
+	EligibleUntil time.Time
+
+	// FinishedAt is the wall-clock at which the game finished.
+	FinishedAt time.Time
+}
+
+// DeniedEvent carries the inputs required to publish one
+// lobby.race_name.registration_denied intent. may decide to
+// suppress the intent for a quieter post-game experience; the event is
+// emitted by the evaluator regardless and the publisher is free to drop
+// it.
+type DeniedEvent struct {
+	// GameID identifies the finished game.
+	GameID common.GameID
+
+	// GameName is the human-readable game name copied from the game
+	// record at finish time.
+	GameName string
+
+	// UserID identifies the incapable member.
+	UserID string
+
+	// RaceName is the original-casing race name held by the user during
+	// the game.
+	RaceName string
+
+	// FinishedAt is the wall-clock at which the game finished.
+	FinishedAt time.Time
+
+	// Reason describes why the member did not satisfy the capability
+	// rule. The evaluator currently emits "capability_not_met" or
+	// "missing_stats".
+	Reason string
+}
+
+// Reasons emitted on DeniedEvent.
+const (
+	// ReasonCapabilityNotMet reports that the member did not satisfy
+	// max_planets > initial_planets AND max_population >
+	// initial_population.
+	ReasonCapabilityNotMet = "capability_not_met"
+
+	// ReasonMissingStats reports that no stats observation was ever
+	// recorded for the member, so capability cannot be evaluated. The
+	// evaluator treats this as incapable.
+	ReasonMissingStats = "missing_stats"
+)
+
+// RaceNameIntents publishes the two race-name capability outcomes. Stage
+// 15A wires a noop implementation by default; replaces the
+// adapter with the real pkg/notificationintent publisher without touching
+// the evaluator.
+type RaceNameIntents interface {
+	// PublishEligible emits one lobby.race_name.registration_eligible
+	// intent for ev. Implementations must be idempotent on retry —
+	// the evaluator may invoke PublishEligible at most once per (game,
+	// user) tuple, but retry policy may cause downstream
+	// re-emission.
+	PublishEligible(ctx context.Context, ev EligibleEvent) error
+
+	// PublishDenied emits one lobby.race_name.registration_denied
+	// intent for ev. The intent is informational; implementations may
+	// drop it without surfacing an error.
+	PublishDenied(ctx context.Context, ev DeniedEvent) error
+}
+
+// NoopRaceNameIntents is the production-default RaceNameIntents adapter
+// while is unimplemented. Both methods accept their input and
+// return nil. The exported zero value is safe to share.
+type NoopRaceNameIntents struct{}
+
+// PublishEligible discards ev and returns nil.
+func (NoopRaceNameIntents) PublishEligible(ctx context.Context, ev EligibleEvent) error {
+	return nil
+}
+
+// PublishDenied discards ev and returns nil.
+func (NoopRaceNameIntents) PublishDenied(ctx context.Context, ev DeniedEvent) error {
+	return nil
+}
+
+// Compile-time interface assertion.
+var _ RaceNameIntents = NoopRaceNameIntents{}
+
+// Service evaluates capability at game finish.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	stats       ports.GameTurnStatsStore
+	directory   ports.RaceNameDirectory
+	intents     RaceNameIntents
+	guard       ports.EvaluationGuardStore
+	clock       func() time.Time
+	logger      *slog.Logger
+	telemetry   *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the finished game record. The evaluator reads the
+	// FinishedAt and GameName fields from the loaded record.
+	Games ports.GameStore
+
+	// Memberships supplies the per-game roster the evaluator iterates.
+	Memberships ports.MembershipStore
+
+	// Stats supplies the aggregate the evaluator reads, and is asked to
+	// delete the aggregate at the end of a successful pass.
+	Stats ports.GameTurnStatsStore
+
+	// Directory mutates reservations: MarkPendingRegistration on
+	// capable members, ReleaseReservation on incapable / removed /
+	// blocked members.
+	Directory ports.RaceNameDirectory
+
+	// Intents publishes the per-member capability intents. Wire
+	// NoopRaceNameIntents{} until lands the real publisher.
+	Intents RaceNameIntents
+
+	// Guard supplies the per-game «already evaluated» marker that
+	// keeps replayed `game_finished` events safe.
+	Guard ports.EvaluationGuardStore
+
+	// Clock supplies the wall-clock used for log timestamps; the
+	// evaluator otherwise reads its FinishedAt anchor from the game
+	// record.
+	Clock func() time.Time
+
+	// Logger records structured service-level events.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.capability_evaluations` counter
+	// per evaluated active membership. Optional; nil disables metric
+	// emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new capability evaluation service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new capability evaluation service: nil membership store")
+	case deps.Stats == nil:
+		return nil, errors.New("new capability evaluation service: nil game turn stats store")
+	case deps.Directory == nil:
+		return nil, errors.New("new capability evaluation service: nil race name directory")
+	case deps.Intents == nil:
+		return nil, errors.New("new capability evaluation service: nil race name intents")
+	case deps.Guard == nil:
+		return nil, errors.New("new capability evaluation service: nil evaluation guard store")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		stats:       deps.Stats,
+		directory:   deps.Directory,
+		intents:     deps.Intents,
+		guard:       deps.Guard,
+		clock:       clock,
+		logger:      logger.With("service", "lobby.capabilityevaluation"),
+		telemetry:   deps.Telemetry,
+	}, nil
+}
+
+// Evaluate runs the capability evaluator for gameID. The caller — the
+// gmevents consumer — must have already transitioned the game record to
+// `finished` (or established that the game was already in `finished` from
+// a prior pass) before invoking Evaluate. The method is idempotent: a
+// second call after a successful first pass returns nil without further
+// side effects.
+//
+// finishedAt is intentionally sourced from the game record by the caller
+// rather than from the GM event timestamp so that retries of the same
+// `game_finished` event always compute the same eligible_until anchor.
+func (service *Service) Evaluate(ctx context.Context, gameID common.GameID, finishedAt time.Time) error {
+	if service == nil {
+		return errors.New("evaluate capability: nil service")
+	}
+	if ctx == nil {
+		return errors.New("evaluate capability: nil context")
+	}
+	if err := gameID.Validate(); err != nil {
+		return fmt.Errorf("evaluate capability: %w", err)
+	}
+	if finishedAt.IsZero() {
+		return errors.New("evaluate capability: finished at must not be zero")
+	}
+
+	record, err := service.games.Get(ctx, gameID)
+	if err != nil {
+		return fmt.Errorf("evaluate capability: load game: %w", err)
+	}
+	if record.Status != game.StatusFinished {
+		return fmt.Errorf("evaluate capability: game %s status is %q, expected %q",
+			record.GameID.String(), record.Status, game.StatusFinished)
+	}
+
+	evaluated, err := service.guard.IsEvaluated(ctx, gameID)
+	if err != nil {
+		return fmt.Errorf("evaluate capability: read guard: %w", err)
+	}
+	if evaluated {
+		service.telemetry.RecordCapabilityEvaluation(ctx, "noop")
+		logArgs := []any{"game_id", gameID.String()}
+		logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+		service.logger.InfoContext(ctx, "capability evaluation replay absorbed by guard", logArgs...)
+		return nil
+	}
+
+	memberships, err := service.memberships.GetByGame(ctx, gameID)
+	if err != nil {
+		return fmt.Errorf("evaluate capability: load memberships: %w", err)
+	}
+
+	aggregate, err := service.stats.Load(ctx, gameID)
+	if err != nil {
+		return fmt.Errorf("evaluate capability: load stats: %w", err)
+	}
+	statsByUser := make(map[string]ports.PlayerStatsAggregate, len(aggregate.Players))
+	for _, line := range aggregate.Players {
+		statsByUser[line.UserID] = line
+	}
+
+	eligibleUntil := finishedAt.Add(PendingRegistrationWindow)
+
+	pending := make([]EligibleEvent, 0, len(memberships))
+	denied := make([]DeniedEvent, 0, len(memberships))
+
+	for _, member := range memberships {
+		switch member.Status {
+		case membership.StatusActive:
+			stat, ok := statsByUser[member.UserID]
+			capable := ok && capabilityMet(stat)
+			switch {
+			case capable:
+				if err := service.directory.MarkPendingRegistration(
+					ctx, member.GameID.String(), member.UserID, member.RaceName, eligibleUntil,
+				); err != nil {
+					return fmt.Errorf(
+						"evaluate capability: mark pending registration for game %s user %s: %w",
+						member.GameID.String(), member.UserID, err,
+					)
+				}
+				service.telemetry.RecordCapabilityEvaluation(ctx, "capable")
+				pending = append(pending, EligibleEvent{
+					GameID:        member.GameID,
+					GameName:      record.GameName,
+					UserID:        member.UserID,
+					RaceName:      member.RaceName,
+					EligibleUntil: eligibleUntil,
+					FinishedAt:    finishedAt,
+				})
+			default:
+				if err := service.directory.ReleaseReservation(
+					ctx, member.GameID.String(), member.UserID, member.RaceName,
+				); err != nil {
+					return fmt.Errorf(
+						"evaluate capability: release reservation for game %s user %s: %w",
+						member.GameID.String(), member.UserID, err,
+					)
+				}
+				service.telemetry.RecordCapabilityEvaluation(ctx, "incapable")
+				reason := ReasonCapabilityNotMet
+				if !ok {
+					reason = ReasonMissingStats
+				}
+				denied = append(denied, DeniedEvent{
+					GameID:     member.GameID,
+					GameName:   record.GameName,
+					UserID:     member.UserID,
+					RaceName:   member.RaceName,
+					FinishedAt: finishedAt,
+					Reason:     reason,
+				})
+			}
+		case membership.StatusRemoved, membership.StatusBlocked:
+			if err := service.directory.ReleaseReservation(
+				ctx, member.GameID.String(), member.UserID, member.RaceName,
+			); err != nil {
+				return fmt.Errorf(
+					"evaluate capability: release post-start reservation for game %s user %s: %w",
+					member.GameID.String(), member.UserID, err,
+				)
+			}
+		}
+	}
+
+	if err := service.stats.Delete(ctx, gameID); err != nil {
+		return fmt.Errorf("evaluate capability: delete stats: %w", err)
+	}
+
+	if err := service.guard.MarkEvaluated(ctx, gameID); err != nil {
+		return fmt.Errorf("evaluate capability: mark evaluated: %w", err)
+	}
+
+	for _, ev := range pending {
+		if err := service.intents.PublishEligible(ctx, ev); err != nil {
+			service.logger.WarnContext(ctx, "publish race name eligible intent",
+				"game_id", ev.GameID.String(),
+				"user_id", ev.UserID,
+				"err", err.Error(),
+			)
+		}
+	}
+	for _, ev := range denied {
+		if err := service.intents.PublishDenied(ctx, ev); err != nil {
+			service.logger.WarnContext(ctx, "publish race name denied intent",
+				"game_id", ev.GameID.String(),
+				"user_id", ev.UserID,
+				"err", err.Error(),
+			)
+		}
+	}
+
+	logArgs := []any{
+		"game_id", gameID.String(),
+		"pending_count", len(pending),
+		"denied_count", len(denied),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "capability evaluation complete", logArgs...)
+	return nil
+}
+
+// capabilityMet implements the capability rule frozen in
+// lobby/README.md §Game Finish Flow.
+func capabilityMet(stat ports.PlayerStatsAggregate) bool {
+	return stat.MaxPlanets > stat.InitialPlanets &&
+		stat.MaxPopulation > stat.InitialPopulation
+}

lobby/internal/service/capabilityevaluation/service_test.go

@@ -0,0 +1,308 @@
+package capabilityevaluation_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"sync"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/evaluationguardstub"
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/gameturnstatsstub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/capabilityevaluation"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type spyIntents struct {
+	mu      sync.Mutex
+	pending []capabilityevaluation.EligibleEvent
+	denied  []capabilityevaluation.DeniedEvent
+}
+
+func (spy *spyIntents) PublishEligible(_ context.Context, ev capabilityevaluation.EligibleEvent) error {
+	spy.mu.Lock()
+	defer spy.mu.Unlock()
+	spy.pending = append(spy.pending, ev)
+	return nil
+}
+
+func (spy *spyIntents) PublishDenied(_ context.Context, ev capabilityevaluation.DeniedEvent) error {
+	spy.mu.Lock()
+	defer spy.mu.Unlock()
+	spy.denied = append(spy.denied, ev)
+	return nil
+}
+
+type fixture struct {
+	finishedAt  time.Time
+	gameID      common.GameID
+	gameName    string
+	games       *gamestub.Store
+	memberships *membershipstub.Store
+	stats       *gameturnstatsstub.Store
+	directory   *racenamestub.Directory
+	intents     *spyIntents
+	guard       *evaluationguardstub.Store
+	service     *capabilityevaluation.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	finishedAt := now
+
+	games := gamestub.NewStore()
+	memberships := membershipstub.NewStore()
+	stats := gameturnstatsstub.NewStore()
+	directory, err := racenamestub.NewDirectory(racenamestub.WithClock(fixedClock(now.Add(-time.Hour))))
+	require.NoError(t, err)
+	intents := &spyIntents{}
+	guard := evaluationguardstub.NewStore()
+
+	gameID := common.GameID("game-finished")
+	gameName := "Final Showdown"
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              gameID,
+		GameName:            gameName,
+		GameType:            game.GameTypePublic,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(-12 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now.Add(-24 * time.Hour),
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusFinished
+	startedAt := now.Add(-12 * time.Hour)
+	gameRecord.StartedAt = &startedAt
+	gameRecord.FinishedAt = &finishedAt
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	service, err := capabilityevaluation.NewService(capabilityevaluation.Dependencies{
+		Games:       games,
+		Memberships: memberships,
+		Stats:       stats,
+		Directory:   directory,
+		Intents:     intents,
+		Guard:       guard,
+		Clock:       fixedClock(now),
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+
+	return &fixture{
+		finishedAt:  finishedAt,
+		gameID:      gameID,
+		gameName:    gameName,
+		games:       games,
+		memberships: memberships,
+		stats:       stats,
+		directory:   directory,
+		intents:     intents,
+		guard:       guard,
+		service:     service,
+	}
+}
+
+func (f *fixture) addMember(t *testing.T, userID, raceName string, status membership.Status) {
+	t.Helper()
+	member, err := membership.New(membership.NewMembershipInput{
+		MembershipID: common.MembershipID("membership-" + userID),
+		GameID:       f.gameID,
+		UserID:       userID,
+		RaceName:     raceName,
+		CanonicalKey: raceName,
+		Now:          f.finishedAt.Add(-3 * time.Hour),
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), member))
+	if status != membership.StatusActive {
+		require.NoError(t, f.memberships.UpdateStatus(context.Background(), ports.UpdateMembershipStatusInput{
+			MembershipID: member.MembershipID,
+			ExpectedFrom: membership.StatusActive,
+			To:           status,
+			At:           f.finishedAt.Add(-time.Hour),
+		}))
+	}
+}
+
+func (f *fixture) reserveRaceName(t *testing.T, userID, raceName string) {
+	t.Helper()
+	require.NoError(t, f.directory.Reserve(context.Background(), f.gameID.String(), userID, raceName))
+}
+
+func (f *fixture) seedStats(t *testing.T, userID string, initialPlanets, initialPopulation, maxPlanets, maxPopulation int64) {
+	t.Helper()
+	require.NoError(t, f.stats.SaveInitial(context.Background(), f.gameID, []ports.PlayerInitialStats{
+		{UserID: userID, Planets: initialPlanets, Population: initialPopulation, ShipsBuilt: 0},
+	}))
+	require.NoError(t, f.stats.UpdateMax(context.Background(), f.gameID, []ports.PlayerObservedStats{
+		{UserID: userID, Planets: maxPlanets, Population: maxPopulation, ShipsBuilt: 0},
+	}))
+}
+
+func TestEvaluateRequiresFinishedStatus(t *testing.T) {
+	f := newFixture(t)
+
+	record, err := f.games.Get(context.Background(), f.gameID)
+	require.NoError(t, err)
+	record.Status = game.StatusRunning
+	record.FinishedAt = nil
+	require.NoError(t, f.games.Save(context.Background(), record))
+
+	err = f.service.Evaluate(context.Background(), f.gameID, f.finishedAt)
+	require.Error(t, err)
+}
+
+func TestEvaluateCapableMemberMarksPending(t *testing.T) {
+	f := newFixture(t)
+	f.reserveRaceName(t, "user-capable", "Stellaris")
+	f.addMember(t, "user-capable", "Stellaris", membership.StatusActive)
+	f.seedStats(t, "user-capable", 3, 100, 5, 200)
+
+	require.NoError(t, f.service.Evaluate(context.Background(), f.gameID, f.finishedAt))
+
+	pending, err := f.directory.ListPendingRegistrations(context.Background(), "user-capable")
+	require.NoError(t, err)
+	require.Len(t, pending, 1)
+	assert.Equal(t, "Stellaris", pending[0].RaceName)
+	expectedEligible := f.finishedAt.Add(capabilityevaluation.PendingRegistrationWindow).UnixMilli()
+	assert.Equal(t, expectedEligible, pending[0].EligibleUntilMs)
+
+	require.Len(t, f.intents.pending, 1)
+	assert.Equal(t, "user-capable", f.intents.pending[0].UserID)
+	assert.Equal(t, f.gameName, f.intents.pending[0].GameName)
+	assert.Empty(t, f.intents.denied)
+}
+
+func TestEvaluateIncapableMemberReleasesReservation(t *testing.T) {
+	f := newFixture(t)
+	f.reserveRaceName(t, "user-incap", "Loseman")
+	f.addMember(t, "user-incap", "Loseman", membership.StatusActive)
+	f.seedStats(t, "user-incap", 3, 100, 3, 100)
+
+	require.NoError(t, f.service.Evaluate(context.Background(), f.gameID, f.finishedAt))
+
+	reservations, err := f.directory.ListReservations(context.Background(), "user-incap")
+	require.NoError(t, err)
+	assert.Empty(t, reservations)
+
+	pending, err := f.directory.ListPendingRegistrations(context.Background(), "user-incap")
+	require.NoError(t, err)
+	assert.Empty(t, pending)
+
+	require.Len(t, f.intents.denied, 1)
+	assert.Equal(t, capabilityevaluation.ReasonCapabilityNotMet, f.intents.denied[0].Reason)
+}
+
+func TestEvaluateMissingStatsReleasesAndReportsReason(t *testing.T) {
+	f := newFixture(t)
+	f.reserveRaceName(t, "user-no-stats", "Phantom")
+	f.addMember(t, "user-no-stats", "Phantom", membership.StatusActive)
+
+	require.NoError(t, f.service.Evaluate(context.Background(), f.gameID, f.finishedAt))
+
+	require.Len(t, f.intents.denied, 1)
+	assert.Equal(t, capabilityevaluation.ReasonMissingStats, f.intents.denied[0].Reason)
+
+	reservations, err := f.directory.ListReservations(context.Background(), "user-no-stats")
+	require.NoError(t, err)
+	assert.Empty(t, reservations)
+}
+
+func TestEvaluateMixedRoster(t *testing.T) {
+	f := newFixture(t)
+
+	f.reserveRaceName(t, "user-A", "Alpha")
+	f.addMember(t, "user-A", "Alpha", membership.StatusActive)
+	f.seedStats(t, "user-A", 1, 10, 9, 100)
+
+	f.reserveRaceName(t, "user-B", "Beta")
+	f.addMember(t, "user-B", "Beta", membership.StatusActive)
+	f.seedStats(t, "user-B", 4, 50, 4, 50)
+
+	f.reserveRaceName(t, "user-C", "Gamma")
+	f.addMember(t, "user-C", "Gamma", membership.StatusRemoved)
+
+	f.reserveRaceName(t, "user-D", "Delta")
+	f.addMember(t, "user-D", "Delta", membership.StatusBlocked)
+
+	require.NoError(t, f.service.Evaluate(context.Background(), f.gameID, f.finishedAt))
+
+	pending, err := f.directory.ListPendingRegistrations(context.Background(), "user-A")
+	require.NoError(t, err)
+	assert.Len(t, pending, 1)
+
+	for _, userID := range []string{"user-B", "user-C", "user-D"} {
+		reservations, err := f.directory.ListReservations(context.Background(), userID)
+		require.NoError(t, err)
+		assert.Empty(t, reservations, "user %s reservation not released", userID)
+	}
+
+	require.Len(t, f.intents.pending, 1)
+	require.Len(t, f.intents.denied, 1, "removed/blocked must not produce denied intents")
+	assert.Equal(t, "user-A", f.intents.pending[0].UserID)
+	assert.Equal(t, "user-B", f.intents.denied[0].UserID)
+}
+
+func TestEvaluateReplayDoesNotDoubleEmit(t *testing.T) {
+	f := newFixture(t)
+	f.reserveRaceName(t, "user-A", "Alpha")
+	f.addMember(t, "user-A", "Alpha", membership.StatusActive)
+	f.seedStats(t, "user-A", 1, 10, 9, 100)
+
+	require.NoError(t, f.service.Evaluate(context.Background(), f.gameID, f.finishedAt))
+	require.NoError(t, f.service.Evaluate(context.Background(), f.gameID, f.finishedAt))
+
+	pending, err := f.directory.ListPendingRegistrations(context.Background(), "user-A")
+	require.NoError(t, err)
+	assert.Len(t, pending, 1)
+
+	assert.Len(t, f.intents.pending, 1)
+	assert.Empty(t, f.intents.denied)
+}
+
+func TestEvaluateDeletesStatsAggregate(t *testing.T) {
+	f := newFixture(t)
+	f.reserveRaceName(t, "user-A", "Alpha")
+	f.addMember(t, "user-A", "Alpha", membership.StatusActive)
+	f.seedStats(t, "user-A", 1, 10, 2, 11)
+
+	require.NoError(t, f.service.Evaluate(context.Background(), f.gameID, f.finishedAt))
+
+	aggregate, err := f.stats.Load(context.Background(), f.gameID)
+	require.NoError(t, err)
+	assert.Empty(t, aggregate.Players)
+}
+
+func TestEvaluateRequiresFinishedAt(t *testing.T) {
+	f := newFixture(t)
+
+	err := f.service.Evaluate(context.Background(), f.gameID, time.Time{})
+	require.Error(t, err)
+}
+
+func TestEvaluateRejectsInvalidGameID(t *testing.T) {
+	f := newFixture(t)
+
+	err := f.service.Evaluate(context.Background(), common.GameID(""), f.finishedAt)
+	require.Error(t, err)
+}

lobby/internal/service/creategame/service.go

@@ -0,0 +1,200 @@
+// Package creategame implements the `lobby.game.create` message type. It
+// validates the request, enforces the actor-to-game-type pairing rule
+// (admin creates public games; user creates private games), generates a new
+// game identifier, and persists the record in `draft` status via the
+// GameStore port.
+package creategame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// Service executes the create-game use case on the frozen surface.
+type Service struct {
+	games  ports.GameStore
+	ids    ports.IDGenerator
+	clock  func() time.Time
+	logger *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service. Logger is optional;
+// nil falls back to slog.Default. Clock is optional; nil falls back to
+// time.Now.
+type Dependencies struct {
+	// Games persists the created record.
+	Games ports.GameStore
+
+	// IDs generates the opaque game identifier.
+	IDs ports.IDGenerator
+
+	// Clock supplies the wall-clock used for CreatedAt and UpdatedAt. It
+	// defaults to time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. It defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps. It returns an error when
+// mandatory collaborators are missing.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Games == nil {
+		return nil, errors.New("new create game service: nil game store")
+	}
+	if deps.IDs == nil {
+		return nil, errors.New("new create game service: nil id generator")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:  deps.Games,
+		ids:    deps.IDs,
+		clock:  clock,
+		logger: logger.With("service", "lobby.creategame"),
+	}, nil
+}
+
+// Input stores the arguments required to create one draft game record.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameName stores the human-readable game name. Must be non-empty after
+	// trim.
+	GameName string
+
+	// Description stores the optional human-readable game description.
+	Description string
+
+	// GameType stores the admission model. Must pair with Actor.Kind:
+	// admin ⇒ public, user ⇒ private.
+	GameType game.GameType
+
+	// MinPlayers stores the minimum approved participants required before
+	// the game may start.
+	MinPlayers int
+
+	// MaxPlayers stores the target roster size that activates the gap
+	// window.
+	MaxPlayers int
+
+	// StartGapHours stores the gap window length in hours.
+	StartGapHours int
+
+	// StartGapPlayers stores the number of additional participants
+	// admitted during the gap window.
+	StartGapPlayers int
+
+	// EnrollmentEndsAt stores the enrollment deadline.
+	EnrollmentEndsAt time.Time
+
+	// TurnSchedule stores the five-field cron expression.
+	TurnSchedule string
+
+	// TargetEngineVersion stores the semver of the engine to launch.
+	TargetEngineVersion string
+}
+
+// Handle validates input, authorizes the actor, and persists the new draft
+// record. On success it returns the persisted game. The following error
+// classes are surfaced and relied on by transport mapping:
+//
+//   - shared.ErrForbidden — actor-to-game-type pairing mismatch.
+//   - game input validation errors from game.New — translated to
+//     invalid_request at the transport layer.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("create game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("create game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("create game: actor: %w", err)
+	}
+
+	ownerUserID, err := authorize(input.Actor, input.GameType)
+	if err != nil {
+		return game.Game{}, err
+	}
+
+	gameID, err := service.ids.NewGameID()
+	if err != nil {
+		return game.Game{}, fmt.Errorf("create game: %w", err)
+	}
+
+	now := service.clock().UTC()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              gameID,
+		GameName:            input.GameName,
+		Description:         input.Description,
+		GameType:            input.GameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          input.MinPlayers,
+		MaxPlayers:          input.MaxPlayers,
+		StartGapHours:       input.StartGapHours,
+		StartGapPlayers:     input.StartGapPlayers,
+		EnrollmentEndsAt:    input.EnrollmentEndsAt,
+		TurnSchedule:        input.TurnSchedule,
+		TargetEngineVersion: input.TargetEngineVersion,
+		Now:                 now,
+	})
+	if err != nil {
+		return game.Game{}, fmt.Errorf("create game: %w", err)
+	}
+
+	if err := service.games.Save(ctx, record); err != nil {
+		return game.Game{}, fmt.Errorf("create game: %w", err)
+	}
+
+	service.logger.InfoContext(ctx, "game created",
+		"game_id", record.GameID.String(),
+		"game_type", string(record.GameType),
+		"actor_kind", string(input.Actor.Kind),
+	)
+
+	return record, nil
+}
+
+// authorize enforces the actor-to-game-type pairing rule and returns the
+// owner_user_id value appropriate for the requested game type.
+func authorize(actor shared.Actor, gameType game.GameType) (string, error) {
+	switch actor.Kind {
+	case shared.ActorKindAdmin:
+		if gameType != game.GameTypePublic {
+			return "", fmt.Errorf(
+				"%w: admin caller may only create public games, got %q",
+				shared.ErrForbidden, gameType,
+			)
+		}
+		return "", nil
+	case shared.ActorKindUser:
+		if gameType != game.GameTypePrivate {
+			return "", fmt.Errorf(
+				"%w: user caller may only create private games, got %q",
+				shared.ErrForbidden, gameType,
+			)
+		}
+		return actor.UserID, nil
+	default:
+		return "", fmt.Errorf("%w: actor kind %q is unsupported", shared.ErrForbidden, actor.Kind)
+	}
+}

lobby/internal/service/creategame/service_test.go

@@ -0,0 +1,324 @@
+package creategame_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/idgen"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/creategame"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+type stubIDGenerator struct {
+	next common.GameID
+	err  error
+}
+
+func (g *stubIDGenerator) NewGameID() (common.GameID, error) {
+	if g.err != nil {
+		return "", g.err
+	}
+	return g.next, nil
+}
+
+func (g *stubIDGenerator) NewApplicationID() (common.ApplicationID, error) {
+	return "application-stub", nil
+}
+
+func (g *stubIDGenerator) NewInviteID() (common.InviteID, error) {
+	return "invite-stub", nil
+}
+
+func (g *stubIDGenerator) NewMembershipID() (common.MembershipID, error) {
+	return "membership-stub", nil
+}
+
+func newFixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func validPublicInput(now time.Time) creategame.Input {
+	return creategame.Input{
+		Actor:               shared.NewAdminActor(),
+		GameName:            "Spring Classic",
+		Description:         "",
+		GameType:            game.GameTypePublic,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+	}
+}
+
+func validPrivateInput(now time.Time, userID string) creategame.Input {
+	return creategame.Input{
+		Actor:               shared.NewUserActor(userID),
+		GameName:            "Friends only",
+		GameType:            game.GameTypePrivate,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(12 * time.Hour),
+		TurnSchedule:        "0 0 * * *",
+		TargetEngineVersion: "1.0.0",
+	}
+}
+
+func TestNewServiceRequiresStoreAndIDs(t *testing.T) {
+	t.Parallel()
+
+	_, err := creategame.NewService(creategame.Dependencies{})
+	require.Error(t, err)
+
+	_, err = creategame.NewService(creategame.Dependencies{Games: gamestub.NewStore()})
+	require.Error(t, err)
+
+	_, err = creategame.NewService(creategame.Dependencies{
+		Games: gamestub.NewStore(),
+		IDs:   &stubIDGenerator{next: "game-ok"},
+	})
+	require.NoError(t, err)
+}
+
+func TestHandleAdminCreatesPublicGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  store,
+		IDs:    &stubIDGenerator{next: "game-alpha"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	record, err := service.Handle(context.Background(), validPublicInput(now))
+	require.NoError(t, err)
+	require.Equal(t, common.GameID("game-alpha"), record.GameID)
+	require.Equal(t, game.GameTypePublic, record.GameType)
+	require.Equal(t, game.StatusDraft, record.Status)
+	require.Equal(t, "", record.OwnerUserID)
+	require.Equal(t, now.UTC(), record.CreatedAt)
+	require.Equal(t, now.UTC(), record.UpdatedAt)
+
+	stored, err := store.Get(context.Background(), record.GameID)
+	require.NoError(t, err)
+	require.Equal(t, record, stored)
+}
+
+func TestHandleUserCreatesPrivateGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 11, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  store,
+		IDs:    &stubIDGenerator{next: "game-beta"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	record, err := service.Handle(context.Background(), validPrivateInput(now, "user-42"))
+	require.NoError(t, err)
+	require.Equal(t, common.GameID("game-beta"), record.GameID)
+	require.Equal(t, game.GameTypePrivate, record.GameType)
+	require.Equal(t, "user-42", record.OwnerUserID)
+}
+
+func TestHandleAdminForbiddenForPrivateGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  gamestub.NewStore(),
+		IDs:    &stubIDGenerator{next: "game-x"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	input := validPrivateInput(now, "user-1")
+	input.Actor = shared.NewAdminActor()
+
+	_, err = service.Handle(context.Background(), input)
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleUserForbiddenForPublicGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  gamestub.NewStore(),
+		IDs:    &stubIDGenerator{next: "game-x"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	input := validPublicInput(now)
+	input.Actor = shared.NewUserActor("user-1")
+
+	_, err = service.Handle(context.Background(), input)
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleInvalidActorReturnsError(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  gamestub.NewStore(),
+		IDs:    &stubIDGenerator{next: "game-x"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	input := validPublicInput(now)
+	input.Actor = shared.Actor{Kind: shared.ActorKindUser} // missing user id
+
+	_, err = service.Handle(context.Background(), input)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestHandleDomainValidationFailurePropagates(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  gamestub.NewStore(),
+		IDs:    &stubIDGenerator{next: "game-bad-cron"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	input := validPublicInput(now)
+	input.TurnSchedule = "not a cron"
+
+	_, err = service.Handle(context.Background(), input)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "turn schedule")
+}
+
+func TestHandleEnrollmentDeadlineInPastFails(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  gamestub.NewStore(),
+		IDs:    &stubIDGenerator{next: "game-past"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	input := validPublicInput(now)
+	input.EnrollmentEndsAt = now.Add(-time.Hour)
+
+	_, err = service.Handle(context.Background(), input)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "enrollment ends at")
+}
+
+func TestHandleIDGeneratorErrorPropagates(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	boom := errors.New("entropy exhausted")
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  gamestub.NewStore(),
+		IDs:    &stubIDGenerator{err: boom},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	_, err = service.Handle(context.Background(), validPublicInput(now))
+	require.ErrorIs(t, err, boom)
+}
+
+func TestHandleStoreErrorPropagates(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	boom := errors.New("redis down")
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  failingStore{err: boom},
+		IDs:    &stubIDGenerator{next: "game-fail"},
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	_, err = service.Handle(context.Background(), validPublicInput(now))
+	require.ErrorIs(t, err, boom)
+}
+
+// failingStore is a ports.GameStore whose mutating methods always fail.
+type failingStore struct {
+	err error
+}
+
+func (s failingStore) Save(context.Context, game.Game) error { return s.err }
+func (s failingStore) Get(context.Context, common.GameID) (game.Game, error) {
+	return game.Game{}, s.err
+}
+func (s failingStore) GetByStatus(context.Context, game.Status) ([]game.Game, error) {
+	return nil, s.err
+}
+func (s failingStore) GetByOwner(context.Context, string) ([]game.Game, error) {
+	return nil, s.err
+}
+func (s failingStore) UpdateStatus(context.Context, ports.UpdateStatusInput) error {
+	return s.err
+}
+func (s failingStore) UpdateRuntimeSnapshot(context.Context, ports.UpdateRuntimeSnapshotInput) error {
+	return s.err
+}
+func (s failingStore) UpdateRuntimeBinding(context.Context, ports.UpdateRuntimeBindingInput) error {
+	return s.err
+}
+func (s failingStore) CountByStatus(context.Context) (map[game.Status]int, error) {
+	return nil, s.err
+}
+
+func TestHandleUsesRealIDGeneratorShape(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	service, err := creategame.NewService(creategame.Dependencies{
+		Games:  store,
+		IDs:    idgen.NewGenerator(),
+		Clock:  newFixedClock(now),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+
+	record, err := service.Handle(context.Background(), validPublicInput(now))
+	require.NoError(t, err)
+	require.NoError(t, record.GameID.Validate())
+}

lobby/internal/service/createinvite/service.go

@@ -0,0 +1,310 @@
+// Package createinvite implements the `lobby.invite.create` message type. It
+// validates the request against the private-game enrollment rules, persists
+// the new created invite via InviteStore, and publishes the
+// `lobby.invite.created` notification intent to the invitee.
+package createinvite
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+	"galaxy/notificationintent"
+)
+
+// Service executes the private-game invite creation use case.
+type Service struct {
+	games       ports.GameStore
+	invites     ports.InviteStore
+	memberships ports.MembershipStore
+	intents     ports.IntentPublisher
+	ids         ports.IDGenerator
+	clock       func() time.Time
+	logger      *slog.Logger
+	telemetry   *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the target game record for enrollment validation.
+	Games ports.GameStore
+
+	// Invites persists the new created invite record and is scanned for
+	// existing active invites that block re-invite.
+	Invites ports.InviteStore
+
+	// Memberships supplies the active-roster count for the capacity guard
+	// and is scanned for an existing active membership of the invitee.
+	Memberships ports.MembershipStore
+
+	// Intents publishes the lobby.invite.created intent.
+	Intents ports.IntentPublisher
+
+	// IDs mints the new opaque invite identifier.
+	IDs ports.IDGenerator
+
+	// Clock supplies the wall-clock used for CreatedAt and the
+	// notification's OccurredAt. Defaults to time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.invite.outcomes` counter on each
+	// successful create. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new create invite service: nil game store")
+	case deps.Invites == nil:
+		return nil, errors.New("new create invite service: nil invite store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new create invite service: nil membership store")
+	case deps.Intents == nil:
+		return nil, errors.New("new create invite service: nil intent publisher")
+	case deps.IDs == nil:
+		return nil, errors.New("new create invite service: nil id generator")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		invites:     deps.Invites,
+		memberships: deps.Memberships,
+		intents:     deps.Intents,
+		ids:         deps.IDs,
+		clock:       clock,
+		logger:      logger.With("service", "lobby.createinvite"),
+		telemetry:   deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to create one invite.
+type Input struct {
+	// Actor identifies the caller. Must be the private-game owner.
+	Actor shared.Actor
+
+	// GameID identifies the target private game.
+	GameID common.GameID
+
+	// InviteeUserID stores the platform user id of the invited user.
+	InviteeUserID string
+}
+
+// Handle authorizes the actor, validates the game state, refuses duplicate
+// active invites and active memberships, persists the new created invite,
+// and publishes the lobby.invite.created intent on success.
+func (service *Service) Handle(ctx context.Context, input Input) (invite.Invite, error) {
+	if service == nil {
+		return invite.Invite{}, errors.New("create invite: nil service")
+	}
+	if ctx == nil {
+		return invite.Invite{}, errors.New("create invite: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("create invite: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return invite.Invite{}, fmt.Errorf(
+			"%w: only private-game owners may create invites",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("create invite: %w", err)
+	}
+	inviteeUserID := strings.TrimSpace(input.InviteeUserID)
+
+	gameRecord, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("create invite: %w", err)
+	}
+	if gameRecord.GameType != game.GameTypePrivate {
+		return invite.Invite{}, fmt.Errorf(
+			"create invite: game %q is not private: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+	if gameRecord.Status != game.StatusEnrollmentOpen {
+		return invite.Invite{}, fmt.Errorf(
+			"create invite: game %q is not in enrollment_open: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+	if gameRecord.OwnerUserID != input.Actor.UserID {
+		return invite.Invite{}, fmt.Errorf(
+			"%w: actor is not the owner of game %q",
+			shared.ErrForbidden, gameRecord.GameID,
+		)
+	}
+
+	if err := service.checkRosterCapacity(ctx, gameRecord); err != nil {
+		return invite.Invite{}, err
+	}
+
+	if err := service.checkNoActiveInvite(ctx, gameRecord.GameID, inviteeUserID); err != nil {
+		return invite.Invite{}, err
+	}
+	if err := service.checkNoActiveMembership(ctx, gameRecord.GameID, inviteeUserID); err != nil {
+		return invite.Invite{}, err
+	}
+
+	inviteID, err := service.ids.NewInviteID()
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("create invite: %w", err)
+	}
+
+	now := service.clock().UTC()
+	record, err := invite.New(invite.NewInviteInput{
+		InviteID:      inviteID,
+		GameID:        gameRecord.GameID,
+		InviterUserID: input.Actor.UserID,
+		InviteeUserID: inviteeUserID,
+		Now:           now,
+		ExpiresAt:     gameRecord.EnrollmentEndsAt,
+	})
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("create invite: %w", err)
+	}
+
+	if err := service.invites.Save(ctx, record); err != nil {
+		return invite.Invite{}, fmt.Errorf("create invite: %w", err)
+	}
+
+	inviterName := service.resolveInviterName(ctx, gameRecord.GameID, input.Actor.UserID)
+
+	intent, err := notificationintent.NewLobbyInviteCreatedIntent(
+		notificationintent.Metadata{
+			IdempotencyKey: "lobby.invite.created:" + record.InviteID.String(),
+			OccurredAt:     now,
+		},
+		record.InviteeUserID,
+		notificationintent.LobbyInviteCreatedPayload{
+			GameID:        gameRecord.GameID.String(),
+			GameName:      gameRecord.GameName,
+			InviterUserID: record.InviterUserID,
+			InviterName:   inviterName,
+		},
+	)
+	if err != nil {
+		service.logger.ErrorContext(ctx, "build invite created intent",
+			"invite_id", record.InviteID.String(),
+			"err", err.Error(),
+		)
+	} else if _, publishErr := service.intents.Publish(ctx, intent); publishErr != nil {
+		service.logger.WarnContext(ctx, "publish invite created intent",
+			"invite_id", record.InviteID.String(),
+			"err", publishErr.Error(),
+		)
+	}
+
+	service.telemetry.RecordInviteOutcome(ctx, "created")
+
+	logArgs := []any{
+		"game_id", record.GameID.String(),
+		"game_status", string(gameRecord.Status),
+		"invite_id", record.InviteID.String(),
+		"inviter_user_id", record.InviterUserID,
+		"invitee_user_id", record.InviteeUserID,
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "invite created", logArgs...)
+	return record, nil
+}
+
+// checkRosterCapacity counts active memberships for gameRecord and returns
+// game.ErrConflict when the roster has reached the gap-window upper bound.
+func (service *Service) checkRosterCapacity(ctx context.Context, gameRecord game.Game) error {
+	cap := gameRecord.MaxPlayers + gameRecord.StartGapPlayers
+	count, err := shared.CountActiveMemberships(ctx, service.memberships, gameRecord.GameID)
+	if err != nil {
+		return fmt.Errorf("create invite: %w", err)
+	}
+	if count >= cap {
+		return fmt.Errorf(
+			"create invite: roster full (%d active >= %d cap): %w",
+			count, cap, game.ErrConflict,
+		)
+	}
+	return nil
+}
+
+// checkNoActiveInvite enforces the README invariant that the invitee has no
+// existing active invite for the same game. The Redis InviteStore does not
+// maintain a (game, invitee) uniqueness index, so the service performs the
+// scan; see the design notes.
+func (service *Service) checkNoActiveInvite(ctx context.Context, gameID common.GameID, inviteeUserID string) error {
+	existing, err := service.invites.GetByGame(ctx, gameID)
+	if err != nil {
+		return fmt.Errorf("create invite: %w", err)
+	}
+	for _, record := range existing {
+		if record.Status == invite.StatusCreated && record.InviteeUserID == inviteeUserID {
+			return fmt.Errorf(
+				"create invite: invitee %q already has an active invite to game %q: %w",
+				inviteeUserID, gameID, invite.ErrConflict,
+			)
+		}
+	}
+	return nil
+}
+
+// checkNoActiveMembership enforces the README invariant that the invitee is
+// not already an active member of the game.
+func (service *Service) checkNoActiveMembership(ctx context.Context, gameID common.GameID, inviteeUserID string) error {
+	existing, err := service.memberships.GetByGame(ctx, gameID)
+	if err != nil {
+		return fmt.Errorf("create invite: %w", err)
+	}
+	for _, record := range existing {
+		if record.Status == membership.StatusActive && record.UserID == inviteeUserID {
+			return fmt.Errorf(
+				"create invite: invitee %q already has an active membership in game %q: %w",
+				inviteeUserID, gameID, membership.ErrConflict,
+			)
+		}
+	}
+	return nil
+}
+
+// resolveInviterName returns the owner's confirmed in-game race name when the
+// owner already has an active membership in the game. Otherwise it falls
+// back to the owner's user id, matching README §Invite Lifecycle.
+func (service *Service) resolveInviterName(ctx context.Context, gameID common.GameID, ownerUserID string) string {
+	records, err := service.memberships.GetByGame(ctx, gameID)
+	if err != nil {
+		service.logger.WarnContext(ctx, "resolve inviter name: load memberships",
+			"game_id", gameID.String(),
+			"err", err.Error(),
+		)
+		return ownerUserID
+	}
+	for _, record := range records {
+		if record.UserID == ownerUserID && record.Status == membership.StatusActive {
+			return record.RaceName
+		}
+	}
+	return ownerUserID
+}

lobby/internal/service/createinvite/service_test.go

@@ -0,0 +1,362 @@
+package createinvite_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/createinvite"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	ownerUserID   = "user-owner"
+	inviteeUserID = "user-invitee"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixedIDs struct {
+	inviteID common.InviteID
+}
+
+func (f fixedIDs) NewGameID() (common.GameID, error)               { return "", errors.New("not used") }
+func (f fixedIDs) NewApplicationID() (common.ApplicationID, error) { return "", errors.New("not used") }
+func (f fixedIDs) NewInviteID() (common.InviteID, error)           { return f.inviteID, nil }
+func (f fixedIDs) NewMembershipID() (common.MembershipID, error)   { return "", errors.New("not used") }
+
+type fixture struct {
+	now         time.Time
+	games       *gamestub.Store
+	invites     *invitestub.Store
+	memberships *membershipstub.Store
+	intents     *intentpubstub.Publisher
+	ids         fixedIDs
+	game        game.Game
+}
+
+func newFixture(t *testing.T, maxPlayers, gapPlayers int) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	games := gamestub.NewStore()
+	invites := invitestub.NewStore()
+	memberships := membershipstub.NewStore()
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              "game-private",
+		GameName:            "Friends Only",
+		GameType:            game.GameTypePrivate,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          maxPlayers,
+		StartGapHours:       2,
+		StartGapPlayers:     gapPlayers,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusEnrollmentOpen
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	return &fixture{
+		now:         now,
+		games:       games,
+		invites:     invites,
+		memberships: memberships,
+		intents:     intentpubstub.NewPublisher(),
+		ids:         fixedIDs{inviteID: "invite-fixed"},
+		game:        gameRecord,
+	}
+}
+
+func newService(t *testing.T, f *fixture) *createinvite.Service {
+	t.Helper()
+	svc, err := createinvite.NewService(createinvite.Dependencies{
+		Games:       f.games,
+		Invites:     f.invites,
+		Memberships: f.memberships,
+		Intents:     f.intents,
+		IDs:         f.ids,
+		Clock:       fixedClock(f.now),
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func defaultInput(f *fixture) createinvite.Input {
+	return createinvite.Input{
+		Actor:         shared.NewUserActor(ownerUserID),
+		GameID:        f.game.GameID,
+		InviteeUserID: inviteeUserID,
+	}
+}
+
+func TestHandleHappyPath(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), defaultInput(f))
+	require.NoError(t, err)
+	assert.Equal(t, common.InviteID("invite-fixed"), got.InviteID)
+	assert.Equal(t, ownerUserID, got.InviterUserID)
+	assert.Equal(t, inviteeUserID, got.InviteeUserID)
+	assert.Equal(t, invite.StatusCreated, got.Status)
+	assert.Equal(t, f.now, got.CreatedAt)
+	assert.Equal(t, f.game.EnrollmentEndsAt, got.ExpiresAt)
+	assert.Empty(t, got.RaceName)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	assert.Equal(t, notificationintent.NotificationTypeLobbyInviteCreated, intents[0].NotificationType)
+	assert.Equal(t, []string{inviteeUserID}, intents[0].RecipientUserIDs)
+}
+
+func TestHandleAdminActorForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	input := defaultInput(f)
+	input.Actor = shared.NewAdminActor()
+
+	_, err := svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleNonOwnerForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	input := defaultInput(f)
+	input.Actor = shared.NewUserActor("user-impostor")
+
+	_, err := svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandlePublicGameConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+
+	publicGame, err := game.New(game.NewGameInput{
+		GameID:              "game-public",
+		GameName:            "Open",
+		GameType:            game.GameTypePublic,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    f.now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 f.now,
+	})
+	require.NoError(t, err)
+	publicGame.Status = game.StatusEnrollmentOpen
+	require.NoError(t, f.games.Save(context.Background(), publicGame))
+
+	svc := newService(t, f)
+	input := defaultInput(f)
+	input.GameID = publicGame.GameID
+
+	_, err = svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleWrongStatusConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	rec, err := f.games.Get(context.Background(), f.game.GameID)
+	require.NoError(t, err)
+	rec.Status = game.StatusDraft
+	require.NoError(t, f.games.Save(context.Background(), rec))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleRosterFullConflict(t *testing.T) {
+	t.Parallel()
+	// Capacity = max(2) + gap(1) = 3; seed 3 active members.
+	f := newFixture(t, 2, 1)
+	for i := range 3 {
+		member, err := membership.New(membership.NewMembershipInput{
+			MembershipID: common.MembershipID("membership-seed-" + string(rune('a'+i))),
+			GameID:       f.game.GameID,
+			UserID:       "seed-user-" + string(rune('a'+i)),
+			RaceName:     "Seed " + string(rune('A'+i)),
+			CanonicalKey: "seed" + string(rune('a'+i)),
+			Now:          f.now,
+		})
+		require.NoError(t, err)
+		require.NoError(t, f.memberships.Save(context.Background(), member))
+	}
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleDuplicateActiveInviteConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	existing, err := invite.New(invite.NewInviteInput{
+		InviteID:      "invite-existing",
+		GameID:        f.game.GameID,
+		InviterUserID: ownerUserID,
+		InviteeUserID: inviteeUserID,
+		Now:           f.now,
+		ExpiresAt:     f.game.EnrollmentEndsAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.invites.Save(context.Background(), existing))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, invite.ErrConflict)
+}
+
+func TestHandleDeclinedInviteAllowsReinvite(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	declined, err := invite.New(invite.NewInviteInput{
+		InviteID:      "invite-declined",
+		GameID:        f.game.GameID,
+		InviterUserID: ownerUserID,
+		InviteeUserID: inviteeUserID,
+		Now:           f.now.Add(-time.Hour),
+		ExpiresAt:     f.game.EnrollmentEndsAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.invites.Save(context.Background(), declined))
+	require.NoError(t, f.invites.UpdateStatus(context.Background(), ports.UpdateInviteStatusInput{
+		InviteID:     declined.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusDeclined,
+		At:           f.now,
+	}))
+
+	svc := newService(t, f)
+	got, err := svc.Handle(context.Background(), defaultInput(f))
+	require.NoError(t, err)
+	assert.Equal(t, common.InviteID("invite-fixed"), got.InviteID)
+}
+
+func TestHandleActiveMembershipBlocksInvite(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	member, err := membership.New(membership.NewMembershipInput{
+		MembershipID: "membership-existing",
+		GameID:       f.game.GameID,
+		UserID:       inviteeUserID,
+		RaceName:     "AlreadyMember",
+		CanonicalKey: "alreadymember",
+		Now:          f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), member))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, membership.ErrConflict)
+}
+
+func TestHandleSelfInviteRejected(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	input := defaultInput(f)
+	input.InviteeUserID = ownerUserID
+
+	_, err := svc.Handle(context.Background(), input)
+	// invite.New refuses inviter == invitee with a validation error.
+	require.Error(t, err)
+}
+
+func TestHandleInviterNameUsesActiveMembershipRaceName(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	ownerMember, err := membership.New(membership.NewMembershipInput{
+		MembershipID: "membership-owner",
+		GameID:       f.game.GameID,
+		UserID:       ownerUserID,
+		RaceName:     "OwnerRace",
+		CanonicalKey: "ownerrace",
+		Now:          f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), ownerMember))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), defaultInput(f))
+	require.NoError(t, err)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	assert.Contains(t, intents[0].PayloadJSON, `"inviter_name":"OwnerRace"`)
+}
+
+func TestHandleInviterNameFallsBackToUserID(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f))
+	require.NoError(t, err)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	assert.Contains(t, intents[0].PayloadJSON, `"inviter_name":"`+ownerUserID+`"`)
+}
+
+func TestHandlePublishFailureDoesNotRollback(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	f.intents.SetError(errors.New("publish failed"))
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), defaultInput(f))
+	require.NoError(t, err)
+	assert.Equal(t, common.InviteID("invite-fixed"), got.InviteID)
+
+	stored, err := f.invites.Get(context.Background(), got.InviteID)
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusCreated, stored.Status)
+}
+
+func TestHandleGameNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	input := defaultInput(f)
+	input.GameID = "game-missing"
+	_, err := svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+

lobby/internal/service/declineinvite/service.go

@@ -0,0 +1,154 @@
+// Package declineinvite implements the `lobby.invite.decline` message type.
+// It transitions the invite from created to declined when the actor is the
+// invitee. Per `lobby/README.md` §Invite Lifecycle, no notification is
+// published in v1.
+package declineinvite
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the private-game invite decline use case.
+type Service struct {
+	invites   ports.InviteStore
+	clock     func() time.Time
+	logger    *slog.Logger
+	telemetry *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Invites loads the target invite and applies the
+	// created → declined transition.
+	Invites ports.InviteStore
+
+	// Clock supplies the wall-clock used for DecidedAt.
+	Clock func() time.Time
+
+	// Logger records structured service-level events.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.invite.outcomes` counter on each
+	// successful decline. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Invites == nil {
+		return nil, errors.New("new decline invite service: nil invite store")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		invites:   deps.Invites,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.declineinvite"),
+		telemetry: deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to decline one invite.
+type Input struct {
+	// Actor identifies the caller. Must be the invitee.
+	Actor shared.Actor
+
+	// GameID identifies the game referenced by the request path; it must
+	// match the loaded invite's GameID.
+	GameID common.GameID
+
+	// InviteID identifies the target invite.
+	InviteID common.InviteID
+}
+
+// Handle authorizes the invitee, validates the invite state, transitions the
+// invite to declined, and returns the updated record.
+func (service *Service) Handle(ctx context.Context, input Input) (invite.Invite, error) {
+	if service == nil {
+		return invite.Invite{}, errors.New("decline invite: nil service")
+	}
+	if ctx == nil {
+		return invite.Invite{}, errors.New("decline invite: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("decline invite: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return invite.Invite{}, fmt.Errorf(
+			"%w: only the invited user may decline an invite",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("decline invite: %w", err)
+	}
+	if err := input.InviteID.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("decline invite: %w", err)
+	}
+
+	inv, err := service.invites.Get(ctx, input.InviteID)
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("decline invite: %w", err)
+	}
+	if inv.GameID != input.GameID {
+		return invite.Invite{}, fmt.Errorf(
+			"decline invite: invite %q does not belong to game %q: %w",
+			inv.InviteID, input.GameID, invite.ErrNotFound,
+		)
+	}
+	if inv.InviteeUserID != input.Actor.UserID {
+		return invite.Invite{}, fmt.Errorf(
+			"%w: invite is addressed to a different user",
+			shared.ErrForbidden,
+		)
+	}
+	if inv.Status != invite.StatusCreated {
+		return invite.Invite{}, fmt.Errorf(
+			"decline invite: status %q is not %q: %w",
+			inv.Status, invite.StatusCreated, invite.ErrConflict,
+		)
+	}
+
+	now := service.clock().UTC()
+	if err := service.invites.UpdateStatus(ctx, ports.UpdateInviteStatusInput{
+		InviteID:     inv.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusDeclined,
+		At:           now,
+	}); err != nil {
+		return invite.Invite{}, fmt.Errorf("decline invite: %w", err)
+	}
+
+	declined, err := service.invites.Get(ctx, inv.InviteID)
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("decline invite: %w", err)
+	}
+
+	service.telemetry.RecordInviteOutcome(ctx, "declined")
+
+	logArgs := []any{
+		"game_id", declined.GameID.String(),
+		"invite_id", declined.InviteID.String(),
+		"user_id", declined.InviteeUserID,
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "invite declined", logArgs...)
+	return declined, nil
+}

lobby/internal/service/declineinvite/service_test.go

@@ -0,0 +1,160 @@
+package declineinvite_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/declineinvite"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	gameID        = common.GameID("game-private")
+	ownerUserID   = "user-owner"
+	inviteeUserID = "user-invitee"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixture struct {
+	now     time.Time
+	invites *invitestub.Store
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	return &fixture{
+		now:     time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC),
+		invites: invitestub.NewStore(),
+	}
+}
+
+func newService(t *testing.T, f *fixture) *declineinvite.Service {
+	t.Helper()
+	svc, err := declineinvite.NewService(declineinvite.Dependencies{
+		Invites: f.invites,
+		Clock:   fixedClock(f.now),
+		Logger:  silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func seedCreatedInvite(t *testing.T, f *fixture, inviteID common.InviteID, invitee string) invite.Invite {
+	t.Helper()
+	inv, err := invite.New(invite.NewInviteInput{
+		InviteID:      inviteID,
+		GameID:        gameID,
+		InviterUserID: ownerUserID,
+		InviteeUserID: invitee,
+		Now:           f.now,
+		ExpiresAt:     f.now.Add(24 * time.Hour),
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.invites.Save(context.Background(), inv))
+	return inv
+}
+
+func TestDeclineHappyPath(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), declineinvite.Input{
+		Actor:    shared.NewUserActor(inviteeUserID),
+		GameID:   gameID,
+		InviteID: inv.InviteID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusDeclined, got.Status)
+	require.NotNil(t, got.DecidedAt)
+	assert.Equal(t, f.now, *got.DecidedAt)
+}
+
+func TestDeclineAdminActorForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), declineinvite.Input{
+		Actor:    shared.NewAdminActor(),
+		GameID:   gameID,
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestDeclineNonInviteeForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), declineinvite.Input{
+		Actor:    shared.NewUserActor("user-impostor"),
+		GameID:   gameID,
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestDeclineNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), declineinvite.Input{
+		Actor:    shared.NewUserActor(inviteeUserID),
+		GameID:   gameID,
+		InviteID: "invite-missing",
+	})
+	require.ErrorIs(t, err, invite.ErrNotFound)
+}
+
+func TestDeclineCrossGameNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), declineinvite.Input{
+		Actor:    shared.NewUserActor(inviteeUserID),
+		GameID:   "game-other",
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, invite.ErrNotFound)
+}
+
+func TestDeclineWrongStatusConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	require.NoError(t, f.invites.UpdateStatus(context.Background(), ports.UpdateInviteStatusInput{
+		InviteID:     inv.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusRevoked,
+		At:           f.now,
+	}))
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), declineinvite.Input{
+		Actor:    shared.NewUserActor(inviteeUserID),
+		GameID:   gameID,
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, invite.ErrConflict)
+}

lobby/internal/service/getgame/service.go

@@ -0,0 +1,196 @@
+// Package getgame implements the `lobby.game.get` message type. It loads
+// one game record and enforces the visibility rules frozen in
+// `lobby/README.md` §«User-Facing Lists»:
+//
+//   - admin actors see every record without filtering;
+//   - public non-draft games are visible to any authenticated user;
+//   - public draft games are visible to admin only;
+//   - private draft games are visible to the owner only;
+//   - private non-draft games are visible to the owner, to users with an
+//     active membership in the game, or to users with a non-expired
+//     invite (`invite.StatusCreated`).
+//
+// The service returns the full domain record so the transport layer can
+// serialize the denormalized runtime snapshot already attached to it
+// (`game.Game.RuntimeSnapshot` / `RuntimeBinding`); no extra fan-out
+// to Game Master is required.
+package getgame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// Service executes the get-game use case.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	invites     ports.InviteStore
+	logger      *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games returns the game record and provides the source of truth for
+	// game type, owner, and status used by the visibility filter.
+	Games ports.GameStore
+
+	// Memberships is consulted only for user actors against private
+	// non-draft games to confirm the actor holds an active membership in
+	// the requested game.
+	Memberships ports.MembershipStore
+
+	// Invites is consulted only for user actors against private non-draft
+	// games to confirm the actor holds an invite in `created` status.
+	Invites ports.InviteStore
+
+	// Logger records structured diagnostics. Defaults to slog.Default
+	// when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new get game service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new get game service: nil membership store")
+	case deps.Invites == nil:
+		return nil, errors.New("new get game service: nil invite store")
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		invites:     deps.Invites,
+		logger:      logger.With("service", "lobby.getgame"),
+	}, nil
+}
+
+// Input stores the arguments required to load one game record.
+type Input struct {
+	// Actor identifies the caller. Admin actors bypass the visibility
+	// filter; user actors are subject to the README §«User-Facing Lists»
+	// rules.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, loads the record, and applies the
+// visibility filter. It returns game.ErrNotFound when no record exists
+// for input.GameID, and shared.ErrForbidden when the actor is not
+// allowed to see the record.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("get game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("get game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("get game: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("get game: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("get game: %w", err)
+	}
+
+	if input.Actor.IsAdmin() {
+		return record, nil
+	}
+
+	allowed, err := service.userCanSee(ctx, input.Actor.UserID, record)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("get game: %w", err)
+	}
+	if !allowed {
+		return game.Game{}, fmt.Errorf(
+			"%w: actor is not authorized to view game %q",
+			shared.ErrForbidden, record.GameID.String(),
+		)
+	}
+	return record, nil
+}
+
+// userCanSee returns true when the user-actor identified by userID is
+// permitted to see the supplied record per README §«User-Facing Lists».
+func (service *Service) userCanSee(
+	ctx context.Context,
+	userID string,
+	record game.Game,
+) (bool, error) {
+	switch record.GameType {
+	case game.GameTypePublic:
+		return record.Status != game.StatusDraft, nil
+	case game.GameTypePrivate:
+		if record.OwnerUserID == userID {
+			return true, nil
+		}
+		if record.Status == game.StatusDraft {
+			return false, nil
+		}
+		hasMembership, err := service.userHasActiveMembership(ctx, userID, record.GameID)
+		if err != nil {
+			return false, err
+		}
+		if hasMembership {
+			return true, nil
+		}
+		return service.userHasOpenInvite(ctx, userID, record.GameID)
+	default:
+		return false, nil
+	}
+}
+
+func (service *Service) userHasActiveMembership(
+	ctx context.Context,
+	userID string,
+	gameID common.GameID,
+) (bool, error) {
+	records, err := service.memberships.GetByUser(ctx, userID)
+	if err != nil {
+		return false, err
+	}
+	for _, record := range records {
+		if record.GameID == gameID && record.Status == membership.StatusActive {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (service *Service) userHasOpenInvite(
+	ctx context.Context,
+	userID string,
+	gameID common.GameID,
+) (bool, error) {
+	records, err := service.invites.GetByUser(ctx, userID)
+	if err != nil {
+		return false, err
+	}
+	for _, record := range records {
+		if record.GameID == gameID && record.Status == invite.StatusCreated {
+			return true, nil
+		}
+	}
+	return false, nil
+}

lobby/internal/service/getgame/service_test.go

@@ -0,0 +1,410 @@
+package getgame_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/getgame"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+type fixture struct {
+	games       *gamestub.Store
+	memberships *membershipstub.Store
+	invites     *invitestub.Store
+	svc         *getgame.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	games := gamestub.NewStore()
+	memberships := membershipstub.NewStore()
+	invites := invitestub.NewStore()
+	svc, err := getgame.NewService(getgame.Dependencies{
+		Games:       games,
+		Memberships: memberships,
+		Invites:     invites,
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{
+		games:       games,
+		memberships: memberships,
+		invites:     invites,
+		svc:         svc,
+	}
+}
+
+func seedGame(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	status game.Status,
+	now time.Time,
+) game.Game {
+	t.Helper()
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = now.Add(time.Minute)
+	}
+	require.NoError(t, store.Save(context.Background(), record))
+	return record
+}
+
+func seedMembership(
+	t *testing.T,
+	store *membershipstub.Store,
+	gameID common.GameID,
+	userID string,
+	status membership.Status,
+	now time.Time,
+) membership.Membership {
+	t.Helper()
+	record, err := membership.New(membership.NewMembershipInput{
+		MembershipID: common.MembershipID("membership-" + userID + "-" + gameID.String()),
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     "Race-" + userID,
+		CanonicalKey: "race-" + userID,
+		Now:          now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+	if status != membership.StatusActive {
+		require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateMembershipStatusInput{
+			MembershipID: record.MembershipID,
+			ExpectedFrom: membership.StatusActive,
+			To:           status,
+			At:           now.Add(time.Minute),
+		}))
+		updated, err := store.Get(context.Background(), record.MembershipID)
+		require.NoError(t, err)
+		return updated
+	}
+	return record
+}
+
+func seedInvite(
+	t *testing.T,
+	store *invitestub.Store,
+	gameID common.GameID,
+	inviterID, inviteeID string,
+	status invite.Status,
+	now time.Time,
+) invite.Invite {
+	t.Helper()
+	record, err := invite.New(invite.NewInviteInput{
+		InviteID:      common.InviteID("invite-" + inviteeID + "-" + gameID.String()),
+		GameID:        gameID,
+		InviterUserID: inviterID,
+		InviteeUserID: inviteeID,
+		Now:           now,
+		ExpiresAt:     now.Add(48 * time.Hour),
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+	if status != invite.StatusCreated {
+		input := ports.UpdateInviteStatusInput{
+			InviteID:     record.InviteID,
+			ExpectedFrom: invite.StatusCreated,
+			To:           status,
+			At:           now.Add(time.Minute),
+		}
+		if status == invite.StatusRedeemed {
+			input.RaceName = "Race-" + inviteeID
+		}
+		require.NoError(t, store.UpdateStatus(context.Background(), input))
+		updated, err := store.Get(context.Background(), record.InviteID)
+		require.NoError(t, err)
+		return updated
+	}
+	return record
+}
+
+func TestHandleAdminSeesEveryRecord(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	statuses := []game.Status{
+		game.StatusDraft, game.StatusEnrollmentOpen, game.StatusReadyToStart,
+		game.StatusStarting, game.StatusStartFailed, game.StatusRunning,
+		game.StatusPaused, game.StatusFinished, game.StatusCancelled,
+	}
+	cases := []struct {
+		name        string
+		gameType    game.GameType
+		ownerUserID string
+	}{
+		{"public", game.GameTypePublic, ""},
+		{"private", game.GameTypePrivate, "user-owner"},
+	}
+	for _, tc := range cases {
+		for _, status := range statuses {
+			id := common.GameID("game-admin-" + tc.name + "-" + string(status))
+			seedGame(t, fix.games, id, tc.gameType, tc.ownerUserID, status, now)
+			out, err := fix.svc.Handle(context.Background(), getgame.Input{
+				Actor:  shared.NewAdminActor(),
+				GameID: id,
+			})
+			require.NoError(t, err, "%s/%s", tc.name, status)
+			require.Equal(t, id, out.GameID)
+		}
+	}
+}
+
+func TestHandlePublicNonDraftVisibleToUser(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	statuses := []game.Status{
+		game.StatusEnrollmentOpen, game.StatusReadyToStart, game.StatusRunning,
+		game.StatusPaused, game.StatusFinished, game.StatusStartFailed,
+		game.StatusStarting, game.StatusCancelled,
+	}
+	for _, status := range statuses {
+		id := common.GameID("game-public-" + string(status))
+		seedGame(t, fix.games, id, game.GameTypePublic, "", status, now)
+		out, err := fix.svc.Handle(context.Background(), getgame.Input{
+			Actor:  shared.NewUserActor("user-1"),
+			GameID: id,
+		})
+		require.NoError(t, err, "status=%s", status)
+		require.Equal(t, id, out.GameID)
+	}
+}
+
+func TestHandlePublicDraftHiddenFromUser(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-public-draft")
+	seedGame(t, fix.games, id, game.GameTypePublic, "", game.StatusDraft, now)
+
+	_, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-1"),
+		GameID: id,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandlePrivateDraftVisibleOnlyToOwner(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-draft")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusDraft, now)
+
+	out, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-owner"),
+		GameID: id,
+	})
+	require.NoError(t, err)
+	require.Equal(t, id, out.GameID)
+
+	_, err = fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-stranger"),
+		GameID: id,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandlePrivateNonDraftOwnerSees(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-owner")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusEnrollmentOpen, now)
+
+	out, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-owner"),
+		GameID: id,
+	})
+	require.NoError(t, err)
+	require.Equal(t, id, out.GameID)
+}
+
+func TestHandlePrivateNonDraftActiveMemberSees(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-member")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusRunning, now)
+	seedMembership(t, fix.memberships, id, "user-member", membership.StatusActive, now)
+
+	out, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-member"),
+		GameID: id,
+	})
+	require.NoError(t, err)
+	require.Equal(t, id, out.GameID)
+}
+
+func TestHandlePrivateNonDraftRemovedMemberHidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-removed")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusRunning, now)
+	seedMembership(t, fix.memberships, id, "user-member", membership.StatusRemoved, now)
+
+	_, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-member"),
+		GameID: id,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandlePrivateNonDraftCreatedInviteSees(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-invitee")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusEnrollmentOpen, now)
+	seedInvite(t, fix.invites, id, "user-owner", "user-invitee", invite.StatusCreated, now)
+
+	out, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-invitee"),
+		GameID: id,
+	})
+	require.NoError(t, err)
+	require.Equal(t, id, out.GameID)
+}
+
+func TestHandlePrivateNonDraftDeclinedInviteHidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-declined")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusEnrollmentOpen, now)
+	seedInvite(t, fix.invites, id, "user-owner", "user-invitee", invite.StatusDeclined, now)
+
+	_, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-invitee"),
+		GameID: id,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleStrangerForbidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-stranger")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusRunning, now)
+
+	_, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-stranger"),
+		GameID: id,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleNotFound(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+
+	_, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-1"),
+		GameID: common.GameID("game-missing"),
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestHandleValidatesActor(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+
+	_, err := fix.svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.Actor{Kind: "bogus"},
+		GameID: common.GameID("game-1"),
+	})
+	require.Error(t, err)
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		deps getgame.Dependencies
+	}{
+		{"nil games", getgame.Dependencies{Memberships: membershipstub.NewStore(), Invites: invitestub.NewStore()}},
+		{"nil memberships", getgame.Dependencies{Games: gamestub.NewStore(), Invites: invitestub.NewStore()}},
+		{"nil invites", getgame.Dependencies{Games: gamestub.NewStore(), Memberships: membershipstub.NewStore()}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := getgame.NewService(tc.deps)
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestHandleSurfacesStoreError(t *testing.T) {
+	// Sanity check that errors from the membership store bubble up wrapped.
+	t.Parallel()
+	games := gamestub.NewStore()
+	memberships := &erroringMemberships{err: errors.New("stub failure")}
+	svc, err := getgame.NewService(getgame.Dependencies{
+		Games:       games,
+		Memberships: memberships,
+		Invites:     invitestub.NewStore(),
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-err")
+	seedGame(t, games, id, game.GameTypePrivate, "user-owner", game.StatusRunning, now)
+
+	_, err = svc.Handle(context.Background(), getgame.Input{
+		Actor:  shared.NewUserActor("user-other"),
+		GameID: id,
+	})
+	require.Error(t, err)
+}
+
+type erroringMemberships struct {
+	membershipstub.Store
+	err error
+}
+
+func (s *erroringMemberships) GetByUser(_ context.Context, _ string) ([]membership.Membership, error) {
+	return nil, s.err
+}

lobby/internal/service/listgames/service.go

@@ -0,0 +1,270 @@
+// Package listgames implements the `lobby.games.list` message type. It
+// returns the public game list per `lobby/README.md` §«User-Facing Lists»
+// — public records in `enrollment_open`, `ready_to_start`, `running`,
+// or `finished` — and additionally surfaces every private game the
+// caller currently belongs to (membership in any status, except games
+// in `draft` or `cancelled`). Admin actors bypass the visibility filter
+// and see every record regardless of game type or status, which is the
+// surface used by the internal-port `adminListGames` route.
+package listgames
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sort"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// publicVisibleStatuses lists the user-visible public-game statuses
+// allowed in the public list per README §«Public game list».
+var publicVisibleStatuses = []game.Status{
+	game.StatusEnrollmentOpen,
+	game.StatusReadyToStart,
+	game.StatusRunning,
+	game.StatusFinished,
+}
+
+// adminAllStatuses enumerates every status used by the admin variant to
+// produce an unrestricted list (see `lobby/api/internal-openapi.yaml`
+// `adminListGames`).
+var adminAllStatuses = []game.Status{
+	game.StatusDraft,
+	game.StatusEnrollmentOpen,
+	game.StatusReadyToStart,
+	game.StatusStarting,
+	game.StatusStartFailed,
+	game.StatusRunning,
+	game.StatusPaused,
+	game.StatusFinished,
+	game.StatusCancelled,
+}
+
+// privateMembershipExcludedStatuses lists the statuses removed from the
+// user-visible private list. Draft games are owner-only (handled by
+// `getgame`); cancelled games drop off the user-facing list entirely.
+var privateMembershipExcludedStatuses = map[game.Status]struct{}{
+	game.StatusDraft:     {},
+	game.StatusCancelled: {},
+}
+
+// Service executes the list-games use case.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	logger      *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games supplies the per-status indexes that drive both the public
+	// list and the unrestricted admin list.
+	Games ports.GameStore
+
+	// Memberships is consulted only for user actors to enumerate the
+	// private games the caller belongs to.
+	Memberships ports.MembershipStore
+
+	// Logger records structured diagnostics. Defaults to slog.Default
+	// when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new list games service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new list games service: nil membership store")
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		logger:      logger.With("service", "lobby.listgames"),
+	}, nil
+}
+
+// Input stores the arguments required to list games for one caller.
+type Input struct {
+	// Actor identifies the caller. Admin actors receive the
+	// unrestricted list; user actors receive the public list plus
+	// their own private games.
+	Actor shared.Actor
+
+	// Page stores the pagination request derived from page_size and
+	// page_token by the transport layer.
+	Page shared.Page
+}
+
+// Output stores the page returned by Handle.
+type Output struct {
+	// Items stores the records included in the current page.
+	Items []game.Game
+
+	// NextPageToken stores the opaque continuation token. It is empty
+	// when the current page is the last one.
+	NextPageToken string
+}
+
+// Handle assembles the candidate set, sorts it deterministically, and
+// returns the requested page together with the next-page token.
+func (service *Service) Handle(ctx context.Context, input Input) (Output, error) {
+	if service == nil {
+		return Output{}, errors.New("list games: nil service")
+	}
+	if ctx == nil {
+		return Output{}, errors.New("list games: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return Output{}, fmt.Errorf("list games: actor: %w", err)
+	}
+
+	candidates, err := service.collect(ctx, input.Actor)
+	if err != nil {
+		return Output{}, fmt.Errorf("list games: %w", err)
+	}
+
+	sortRecords(candidates)
+
+	start, end, nextOffset, hasMore := shared.Window(len(candidates), input.Page)
+	out := Output{Items: append([]game.Game(nil), candidates[start:end]...)}
+	if hasMore {
+		out.NextPageToken = shared.EncodeToken(nextOffset)
+	}
+	return out, nil
+}
+
+// collect builds the deduplicated candidate set per actor class.
+func (service *Service) collect(ctx context.Context, actor shared.Actor) ([]game.Game, error) {
+	if actor.IsAdmin() {
+		return service.collectAdmin(ctx)
+	}
+	return service.collectUser(ctx, actor.UserID)
+}
+
+func (service *Service) collectAdmin(ctx context.Context) ([]game.Game, error) {
+	seen := make(map[common.GameID]struct{})
+	candidates := make([]game.Game, 0)
+	for _, status := range adminAllStatuses {
+		records, err := service.games.GetByStatus(ctx, status)
+		if err != nil {
+			return nil, err
+		}
+		for _, record := range records {
+			if _, dup := seen[record.GameID]; dup {
+				continue
+			}
+			seen[record.GameID] = struct{}{}
+			candidates = append(candidates, record)
+		}
+	}
+	return candidates, nil
+}
+
+func (service *Service) collectUser(ctx context.Context, userID string) ([]game.Game, error) {
+	seen := make(map[common.GameID]struct{})
+	candidates := make([]game.Game, 0)
+
+	for _, status := range publicVisibleStatuses {
+		records, err := service.games.GetByStatus(ctx, status)
+		if err != nil {
+			return nil, err
+		}
+		for _, record := range records {
+			if record.GameType != game.GameTypePublic {
+				continue
+			}
+			if _, dup := seen[record.GameID]; dup {
+				continue
+			}
+			seen[record.GameID] = struct{}{}
+			candidates = append(candidates, record)
+		}
+	}
+
+	memberships, err := service.memberships.GetByUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	for _, mb := range memberships {
+		if _, dup := seen[mb.GameID]; dup {
+			continue
+		}
+		record, err := service.games.Get(ctx, mb.GameID)
+		if err != nil {
+			if errors.Is(err, game.ErrNotFound) {
+				service.logger.WarnContext(ctx, "membership references missing game",
+					"user_id", userID,
+					"game_id", mb.GameID.String(),
+				)
+				continue
+			}
+			return nil, err
+		}
+		if record.GameType != game.GameTypePrivate {
+			continue
+		}
+		if _, excluded := privateMembershipExcludedStatuses[record.Status]; excluded {
+			continue
+		}
+		seen[record.GameID] = struct{}{}
+		candidates = append(candidates, record)
+	}
+
+	return candidates, nil
+}
+
+// statusGroup returns the bucket index used to order records per
+// README §«Public game list»: enrollment_open and ready_to_start come
+// first, then running, then finished. Other statuses surface only on
+// the admin or user-private paths and are appended afterwards in a
+// stable order so `next_page_token` is deterministic.
+func statusGroup(status game.Status) int {
+	switch status {
+	case game.StatusEnrollmentOpen, game.StatusReadyToStart:
+		return 0
+	case game.StatusRunning:
+		return 1
+	case game.StatusFinished:
+		return 2
+	case game.StatusPaused:
+		return 3
+	case game.StatusStarting:
+		return 4
+	case game.StatusStartFailed:
+		return 5
+	case game.StatusDraft:
+		return 6
+	case game.StatusCancelled:
+		return 7
+	default:
+		return 8
+	}
+}
+
+// sortRecords sorts the candidate set per the documented ordering. The
+// secondary key is CreatedAt descending («most recent first within each
+// group»), and the tertiary key is GameID ascending for stable output
+// when two records share the same group and CreatedAt.
+func sortRecords(items []game.Game) {
+	sort.Slice(items, func(i, j int) bool {
+		gi, gj := statusGroup(items[i].Status), statusGroup(items[j].Status)
+		if gi != gj {
+			return gi < gj
+		}
+		if !items[i].CreatedAt.Equal(items[j].CreatedAt) {
+			return items[i].CreatedAt.After(items[j].CreatedAt)
+		}
+		return items[i].GameID < items[j].GameID
+	})
+}

lobby/internal/service/listgames/service_test.go

@@ -0,0 +1,302 @@
+package listgames_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/service/listgames"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+type fixture struct {
+	games       *gamestub.Store
+	memberships *membershipstub.Store
+	svc         *listgames.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	games := gamestub.NewStore()
+	memberships := membershipstub.NewStore()
+	svc, err := listgames.NewService(listgames.Dependencies{
+		Games:       games,
+		Memberships: memberships,
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{games: games, memberships: memberships, svc: svc}
+}
+
+func seedGameAt(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	status game.Status,
+	createdAt time.Time,
+) game.Game {
+	t.Helper()
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    createdAt.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 createdAt,
+	})
+	require.NoError(t, err)
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = createdAt.Add(time.Minute)
+	}
+	require.NoError(t, store.Save(context.Background(), record))
+	return record
+}
+
+func seedActiveMembership(
+	t *testing.T,
+	store *membershipstub.Store,
+	gameID common.GameID,
+	userID string,
+	now time.Time,
+) {
+	t.Helper()
+	record, err := membership.New(membership.NewMembershipInput{
+		MembershipID: common.MembershipID("membership-" + userID + "-" + gameID.String()),
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     "Race-" + userID,
+		CanonicalKey: "race-" + userID,
+		Now:          now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+}
+
+func TestHandlePublicListExcludesDraftAndCancelled(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	included := []game.Status{
+		game.StatusEnrollmentOpen, game.StatusReadyToStart,
+		game.StatusRunning, game.StatusFinished,
+	}
+	excluded := []game.Status{
+		game.StatusDraft, game.StatusCancelled, game.StatusPaused,
+		game.StatusStarting, game.StatusStartFailed,
+	}
+	for i, status := range included {
+		id := common.GameID("game-public-incl-" + string(status))
+		seedGameAt(t, fix.games, id, game.GameTypePublic, "", status, now.Add(time.Duration(i)*time.Minute))
+	}
+	for i, status := range excluded {
+		id := common.GameID("game-public-excl-" + string(status))
+		seedGameAt(t, fix.games, id, game.GameTypePublic, "", status, now.Add(time.Duration(i)*time.Minute))
+	}
+
+	out, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-stranger"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, len(included))
+	for _, item := range out.Items {
+		require.Equal(t, game.GameTypePublic, item.GameType)
+		require.Contains(t, included, item.Status)
+	}
+	require.Empty(t, out.NextPageToken)
+}
+
+func TestHandlePublicListExcludesPrivateForStranger(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	seedGameAt(t, fix.games, "game-private-1", game.GameTypePrivate, "user-owner",
+		game.StatusEnrollmentOpen, now)
+
+	out, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-stranger"),
+	})
+	require.NoError(t, err)
+	require.Empty(t, out.Items)
+}
+
+func TestHandleUserSeesOwnPrivateGames(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	publicID := common.GameID("game-public-1")
+	seedGameAt(t, fix.games, publicID, game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+	privateID := common.GameID("game-private-mine")
+	seedGameAt(t, fix.games, privateID, game.GameTypePrivate, "user-owner", game.StatusRunning, now.Add(time.Minute))
+	seedActiveMembership(t, fix.memberships, privateID, "user-member", now)
+
+	out, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-member"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 2)
+
+	gotIDs := []common.GameID{out.Items[0].GameID, out.Items[1].GameID}
+	require.Contains(t, gotIDs, publicID)
+	require.Contains(t, gotIDs, privateID)
+}
+
+func TestHandleDedupesPrivateAlreadyVisible(t *testing.T) {
+	// A public game where the user also has a membership must appear
+	// only once in the response.
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-public-dedup")
+	seedGameAt(t, fix.games, id, game.GameTypePublic, "", game.StatusRunning, now)
+	seedActiveMembership(t, fix.memberships, id, "user-1", now)
+
+	out, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-1"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 1)
+}
+
+func TestHandlePrivateGameDraftHidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private-draft")
+	seedGameAt(t, fix.games, id, game.GameTypePrivate, "user-owner", game.StatusDraft, now)
+	seedActiveMembership(t, fix.memberships, id, "user-member", now)
+
+	out, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-member"),
+	})
+	require.NoError(t, err)
+	require.Empty(t, out.Items)
+}
+
+func TestHandleAdminSeesAllStatuses(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	statuses := []game.Status{
+		game.StatusDraft, game.StatusEnrollmentOpen, game.StatusReadyToStart,
+		game.StatusStarting, game.StatusStartFailed, game.StatusRunning,
+		game.StatusPaused, game.StatusFinished, game.StatusCancelled,
+	}
+	for i, status := range statuses {
+		id := common.GameID("game-admin-" + string(status))
+		seedGameAt(t, fix.games, id, game.GameTypePublic, "", status, now.Add(time.Duration(i)*time.Minute))
+	}
+
+	out, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewAdminActor(),
+		Page:  shared.Page{Size: 50},
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, len(statuses))
+}
+
+func TestHandleSortGroupAndCreatedAt(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	base := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	seedGameAt(t, fix.games, "game-running-old", game.GameTypePublic, "", game.StatusRunning, base)
+	seedGameAt(t, fix.games, "game-running-new", game.GameTypePublic, "", game.StatusRunning, base.Add(2*time.Hour))
+	seedGameAt(t, fix.games, "game-finished", game.GameTypePublic, "", game.StatusFinished, base.Add(time.Hour))
+	seedGameAt(t, fix.games, "game-enroll", game.GameTypePublic, "", game.StatusEnrollmentOpen, base.Add(30*time.Minute))
+	seedGameAt(t, fix.games, "game-ready", game.GameTypePublic, "", game.StatusReadyToStart, base.Add(45*time.Minute))
+
+	out, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-1"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 5)
+
+	// Group 0: ready-to-start (created later) before enroll (created earlier).
+	require.Equal(t, common.GameID("game-ready"), out.Items[0].GameID)
+	require.Equal(t, common.GameID("game-enroll"), out.Items[1].GameID)
+	// Group 1: running, descending CreatedAt.
+	require.Equal(t, common.GameID("game-running-new"), out.Items[2].GameID)
+	require.Equal(t, common.GameID("game-running-old"), out.Items[3].GameID)
+	// Group 2: finished.
+	require.Equal(t, common.GameID("game-finished"), out.Items[4].GameID)
+}
+
+func TestHandlePagination(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	base := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	for i := range 5 {
+		id := common.GameID("game-page-" + string(rune('a'+i)))
+		seedGameAt(t, fix.games, id, game.GameTypePublic, "", game.StatusRunning,
+			base.Add(time.Duration(i)*time.Minute))
+	}
+
+	first, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-1"),
+		Page:  shared.Page{Size: 2},
+	})
+	require.NoError(t, err)
+	require.Len(t, first.Items, 2)
+	require.NotEmpty(t, first.NextPageToken)
+
+	page2, err := shared.ParsePage("2", first.NextPageToken)
+	require.NoError(t, err)
+	second, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-1"),
+		Page:  page2,
+	})
+	require.NoError(t, err)
+	require.Len(t, second.Items, 2)
+	require.NotEmpty(t, second.NextPageToken)
+
+	page3, err := shared.ParsePage("2", second.NextPageToken)
+	require.NoError(t, err)
+	third, err := fix.svc.Handle(context.Background(), listgames.Input{
+		Actor: shared.NewUserActor("user-1"),
+		Page:  page3,
+	})
+	require.NoError(t, err)
+	require.Len(t, third.Items, 1)
+	require.Empty(t, third.NextPageToken)
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		deps listgames.Dependencies
+	}{
+		{"nil games", listgames.Dependencies{Memberships: membershipstub.NewStore()}},
+		{"nil memberships", listgames.Dependencies{Games: gamestub.NewStore()}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := listgames.NewService(tc.deps)
+			require.Error(t, err)
+		})
+	}
+}

lobby/internal/service/listmemberships/service.go

@@ -0,0 +1,167 @@
+// Package listmemberships implements the `lobby.memberships.list` and
+// the internal-port admin/GM mirror endpoints. It returns every
+// membership of one game, paginated, after enforcing the access rule
+// frozen in `lobby/README.md` §«Trusted Surfaces»: admin, owner, or
+// active member of the game. Admin actors bypass the access check, so
+// the same service serves the internal-port `internalListMemberships`
+// and `adminListMemberships` routes by passing `shared.NewAdminActor()`.
+package listmemberships
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sort"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// Service executes the list-memberships use case.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	logger      *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games is loaded to authorize private-game owners and to surface
+	// game.ErrNotFound when the requested game does not exist.
+	Games ports.GameStore
+
+	// Memberships supplies the GetByGame index for the response and the
+	// GetByUser index used to confirm the active-member access path.
+	Memberships ports.MembershipStore
+
+	// Logger records structured diagnostics. Defaults to slog.Default
+	// when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new list memberships service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new list memberships service: nil membership store")
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		logger:      logger.With("service", "lobby.listmemberships"),
+	}, nil
+}
+
+// Input stores the arguments required to list memberships of one game.
+type Input struct {
+	// Actor identifies the caller. Admin callers bypass the access
+	// check; user callers must be the private-game owner or an active
+	// member of the game.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+
+	// Page stores the pagination request.
+	Page shared.Page
+}
+
+// Output stores the page returned by Handle.
+type Output struct {
+	// Items stores the membership records included in the current page.
+	Items []membership.Membership
+
+	// NextPageToken stores the opaque continuation token; empty when
+	// the current page is the last one.
+	NextPageToken string
+}
+
+// Handle authorizes the actor, loads the membership list, and returns
+// the requested page. It returns game.ErrNotFound when the game does
+// not exist, and shared.ErrForbidden when a user actor is not the
+// owner and holds no active membership in the game.
+func (service *Service) Handle(ctx context.Context, input Input) (Output, error) {
+	if service == nil {
+		return Output{}, errors.New("list memberships: nil service")
+	}
+	if ctx == nil {
+		return Output{}, errors.New("list memberships: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return Output{}, fmt.Errorf("list memberships: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return Output{}, fmt.Errorf("list memberships: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list memberships: %w", err)
+	}
+
+	if !input.Actor.IsAdmin() {
+		if err := service.authorizeUser(ctx, input.Actor.UserID, record); err != nil {
+			return Output{}, err
+		}
+	}
+
+	items, err := service.memberships.GetByGame(ctx, input.GameID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list memberships: %w", err)
+	}
+
+	sortMemberships(items)
+
+	start, end, nextOffset, hasMore := shared.Window(len(items), input.Page)
+	out := Output{Items: append([]membership.Membership(nil), items[start:end]...)}
+	if hasMore {
+		out.NextPageToken = shared.EncodeToken(nextOffset)
+	}
+	return out, nil
+}
+
+// authorizeUser permits the caller when they own the game or hold an
+// active membership in it. Otherwise it returns shared.ErrForbidden.
+func (service *Service) authorizeUser(
+	ctx context.Context,
+	userID string,
+	record game.Game,
+) error {
+	if record.GameType == game.GameTypePrivate && record.OwnerUserID == userID {
+		return nil
+	}
+	memberships, err := service.memberships.GetByUser(ctx, userID)
+	if err != nil {
+		return err
+	}
+	for _, mb := range memberships {
+		if mb.GameID == record.GameID && mb.Status == membership.StatusActive {
+			return nil
+		}
+	}
+	return fmt.Errorf(
+		"%w: actor is not authorized to list memberships of game %q",
+		shared.ErrForbidden, record.GameID.String(),
+	)
+}
+
+// sortMemberships sorts items by JoinedAt ascending with MembershipID
+// as the tiebreaker so the wire output is stable for tests and clients.
+func sortMemberships(items []membership.Membership) {
+	sort.Slice(items, func(i, j int) bool {
+		if !items[i].JoinedAt.Equal(items[j].JoinedAt) {
+			return items[i].JoinedAt.Before(items[j].JoinedAt)
+		}
+		return items[i].MembershipID < items[j].MembershipID
+	})
+}

lobby/internal/service/listmemberships/service_test.go

@@ -0,0 +1,243 @@
+package listmemberships_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/listmemberships"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+type fixture struct {
+	games       *gamestub.Store
+	memberships *membershipstub.Store
+	svc         *listmemberships.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	games := gamestub.NewStore()
+	memberships := membershipstub.NewStore()
+	svc, err := listmemberships.NewService(listmemberships.Dependencies{
+		Games:       games,
+		Memberships: memberships,
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{games: games, memberships: memberships, svc: svc}
+}
+
+func seedGame(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	now time.Time,
+) {
+	t.Helper()
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+}
+
+func seedMembership(
+	t *testing.T,
+	store *membershipstub.Store,
+	gameID common.GameID,
+	userID string,
+	status membership.Status,
+	joinedAt time.Time,
+) {
+	t.Helper()
+	record, err := membership.New(membership.NewMembershipInput{
+		MembershipID: common.MembershipID("membership-" + userID + "-" + gameID.String()),
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     "Race-" + userID,
+		CanonicalKey: "race-" + userID,
+		Now:          joinedAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+	if status != membership.StatusActive {
+		require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateMembershipStatusInput{
+			MembershipID: record.MembershipID,
+			ExpectedFrom: membership.StatusActive,
+			To:           status,
+			At:           joinedAt.Add(time.Minute),
+		}))
+	}
+}
+
+func TestHandleAdminReturnsAllMemberships(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-1")
+	seedGame(t, fix.games, id, game.GameTypePublic, "", now)
+	seedMembership(t, fix.memberships, id, "user-a", membership.StatusActive, now)
+	seedMembership(t, fix.memberships, id, "user-b", membership.StatusRemoved, now.Add(time.Minute))
+	seedMembership(t, fix.memberships, id, "user-c", membership.StatusBlocked, now.Add(2*time.Minute))
+
+	out, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: id,
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 3)
+}
+
+func TestHandleOwnerOfPrivateGameSeesAll(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-private")
+	seedGame(t, fix.games, id, game.GameTypePrivate, "user-owner", now)
+	seedMembership(t, fix.memberships, id, "user-a", membership.StatusActive, now)
+	seedMembership(t, fix.memberships, id, "user-b", membership.StatusRemoved, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewUserActor("user-owner"),
+		GameID: id,
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 2)
+}
+
+func TestHandleActiveMemberSeesAll(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-public")
+	seedGame(t, fix.games, id, game.GameTypePublic, "", now)
+	seedMembership(t, fix.memberships, id, "user-a", membership.StatusActive, now)
+	seedMembership(t, fix.memberships, id, "user-b", membership.StatusBlocked, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewUserActor("user-a"),
+		GameID: id,
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 2)
+}
+
+func TestHandleBlockedMemberForbidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-public-blocked")
+	seedGame(t, fix.games, id, game.GameTypePublic, "", now)
+	seedMembership(t, fix.memberships, id, "user-a", membership.StatusBlocked, now)
+
+	_, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewUserActor("user-a"),
+		GameID: id,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleStrangerForbidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-public-stranger")
+	seedGame(t, fix.games, id, game.GameTypePublic, "", now)
+	seedMembership(t, fix.memberships, id, "user-a", membership.StatusActive, now)
+
+	_, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewUserActor("user-stranger"),
+		GameID: id,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleGameNotFound(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+
+	_, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: common.GameID("game-missing"),
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestHandlePagination(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	id := common.GameID("game-page")
+	seedGame(t, fix.games, id, game.GameTypePublic, "", now)
+	for i := range 4 {
+		seedMembership(t, fix.memberships, id,
+			"user-"+string(rune('a'+i)), membership.StatusActive,
+			now.Add(time.Duration(i)*time.Minute))
+	}
+
+	first, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: id,
+		Page:   shared.Page{Size: 2},
+	})
+	require.NoError(t, err)
+	require.Len(t, first.Items, 2)
+	require.NotEmpty(t, first.NextPageToken)
+
+	page2, err := shared.ParsePage("2", first.NextPageToken)
+	require.NoError(t, err)
+	second, err := fix.svc.Handle(context.Background(), listmemberships.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: id,
+		Page:   page2,
+	})
+	require.NoError(t, err)
+	require.Len(t, second.Items, 2)
+	require.Empty(t, second.NextPageToken)
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		deps listmemberships.Dependencies
+	}{
+		{"nil games", listmemberships.Dependencies{Memberships: membershipstub.NewStore()}},
+		{"nil memberships", listmemberships.Dependencies{Games: gamestub.NewStore()}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := listmemberships.NewService(tc.deps)
+			require.Error(t, err)
+		})
+	}
+}

lobby/internal/service/listmyapplications/service.go

@@ -0,0 +1,183 @@
+// Package listmyapplications implements the `lobby.my_applications.list`
+// message type. It returns the acting user's submitted applications
+// joined with the corresponding game's `game_name` and `game_type`,
+// matching `lobby/README.md` §«My pending applications».
+//
+// The service is exclusively self-service: admin actors are rejected
+// with `shared.ErrForbidden`. Cross-user reads are not exposed by this
+// route in v1.
+package listmyapplications
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sort"
+
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// Service executes the list-my-applications use case.
+type Service struct {
+	games        ports.GameStore
+	applications ports.ApplicationStore
+	logger       *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games is loaded per submitted application to enrich the response
+	// with game name and type for client display.
+	Games ports.GameStore
+
+	// Applications supplies the per-applicant index.
+	Applications ports.ApplicationStore
+
+	// Logger records structured diagnostics. Defaults to slog.Default
+	// when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new list my applications service: nil game store")
+	case deps.Applications == nil:
+		return nil, errors.New("new list my applications service: nil application store")
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:        deps.Games,
+		applications: deps.Applications,
+		logger:       logger.With("service", "lobby.listmyapplications"),
+	}, nil
+}
+
+// Input stores the arguments required to compute the acting user's
+// submitted-applications view.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindUser.
+	Actor shared.Actor
+
+	// Page stores the pagination request.
+	Page shared.Page
+}
+
+// Item enriches one submitted application with the host game's name
+// and type, mirroring the OpenAPI `MyApplicationItem` schema.
+type Item struct {
+	Application application.Application
+	GameName    string
+	GameType    game.GameType
+}
+
+// Output stores the page returned by Handle.
+type Output struct {
+	// Items stores the enriched application records included in the
+	// current page.
+	Items []Item
+
+	// NextPageToken stores the opaque continuation token; empty when
+	// the current page is the last one.
+	NextPageToken string
+}
+
+// Handle authorizes the actor as a user, fetches their applications,
+// filters to `submitted`, joins with the game store, sorts, and
+// returns the requested page.
+func (service *Service) Handle(ctx context.Context, input Input) (Output, error) {
+	if service == nil {
+		return Output{}, errors.New("list my applications: nil service")
+	}
+	if ctx == nil {
+		return Output{}, errors.New("list my applications: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return Output{}, fmt.Errorf("list my applications: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return Output{}, fmt.Errorf(
+			"%w: only authenticated user actors may list their applications",
+			shared.ErrForbidden,
+		)
+	}
+
+	records, err := service.applications.GetByUser(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list my applications: %w", err)
+	}
+
+	candidates := make([]Item, 0, len(records))
+	for _, record := range records {
+		if record.Status != application.StatusSubmitted {
+			continue
+		}
+		gameName, gameType, ok := service.lookupGame(ctx, record.GameID, record.ApplicationID)
+		if !ok {
+			continue
+		}
+		candidates = append(candidates, Item{
+			Application: record,
+			GameName:    gameName,
+			GameType:    gameType,
+		})
+	}
+
+	sortItems(candidates)
+
+	start, end, nextOffset, hasMore := shared.Window(len(candidates), input.Page)
+	out := Output{Items: append([]Item(nil), candidates[start:end]...)}
+	if hasMore {
+		out.NextPageToken = shared.EncodeToken(nextOffset)
+	}
+	return out, nil
+}
+
+// lookupGame returns the host game's name and type. A missing game
+// record is logged at warn and the application is silently dropped from
+// the list — surfacing a 500 to the user for a dangling reference would
+// be a worse experience and the operator alert is more useful.
+func (service *Service) lookupGame(
+	ctx context.Context,
+	gameID common.GameID,
+	applicationID common.ApplicationID,
+) (name string, gameType game.GameType, ok bool) {
+	record, err := service.games.Get(ctx, gameID)
+	if err == nil {
+		return record.GameName, record.GameType, true
+	}
+	if errors.Is(err, game.ErrNotFound) {
+		service.logger.WarnContext(ctx, "application references missing game",
+			"application_id", applicationID.String(),
+			"game_id", gameID.String(),
+		)
+		return "", "", false
+	}
+	service.logger.ErrorContext(ctx, "load application game",
+		"application_id", applicationID.String(),
+		"game_id", gameID.String(),
+		"err", err.Error(),
+	)
+	return "", "", false
+}
+
+// sortItems orders applications by CreatedAt descending so the most
+// recent appears first; ApplicationID breaks ties for stable output.
+func sortItems(items []Item) {
+	sort.Slice(items, func(i, j int) bool {
+		ci, cj := items[i].Application.CreatedAt, items[j].Application.CreatedAt
+		if !ci.Equal(cj) {
+			return ci.After(cj)
+		}
+		return items[i].Application.ApplicationID < items[j].Application.ApplicationID
+	})
+}

lobby/internal/service/listmyapplications/service_test.go

@@ -0,0 +1,193 @@
+package listmyapplications_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/applicationstub"
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/listmyapplications"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+type fixture struct {
+	games        *gamestub.Store
+	applications *applicationstub.Store
+	svc          *listmyapplications.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	games := gamestub.NewStore()
+	apps := applicationstub.NewStore()
+	svc, err := listmyapplications.NewService(listmyapplications.Dependencies{
+		Games:        games,
+		Applications: apps,
+		Logger:       silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{games: games, applications: apps, svc: svc}
+}
+
+func seedGame(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	name string,
+	now time.Time,
+) {
+	t.Helper()
+	owner := ""
+	if gameType == game.GameTypePrivate {
+		owner = "user-owner"
+	}
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            name,
+		GameType:            gameType,
+		OwnerUserID:         owner,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+}
+
+func seedApplication(
+	t *testing.T,
+	store *applicationstub.Store,
+	id common.ApplicationID,
+	gameID common.GameID,
+	userID string,
+	status application.Status,
+	createdAt time.Time,
+) {
+	t.Helper()
+	record, err := application.New(application.NewApplicationInput{
+		ApplicationID:   id,
+		GameID:          gameID,
+		ApplicantUserID: userID,
+		RaceName:        "Race-" + userID,
+		Now:             createdAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+	if status != application.StatusSubmitted {
+		require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateApplicationStatusInput{
+			ApplicationID: id,
+			ExpectedFrom:  application.StatusSubmitted,
+			To:            status,
+			At:            createdAt.Add(time.Minute),
+		}))
+	}
+}
+
+func TestHandleReturnsSubmittedOnly(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	seedGame(t, fix.games, "game-1", game.GameTypePublic, "Hyperion", now)
+	seedGame(t, fix.games, "game-2", game.GameTypePublic, "Endymion", now)
+	seedApplication(t, fix.applications, "application-submitted", "game-1", "user-1", application.StatusSubmitted, now)
+	seedApplication(t, fix.applications, "application-rejected", "game-2", "user-1", application.StatusRejected, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmyapplications.Input{
+		Actor: shared.NewUserActor("user-1"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 1)
+	require.Equal(t, common.ApplicationID("application-submitted"), out.Items[0].Application.ApplicationID)
+	require.Equal(t, "Hyperion", out.Items[0].GameName)
+	require.Equal(t, game.GameTypePublic, out.Items[0].GameType)
+}
+
+func TestHandleAdminForbidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	_, err := fix.svc.Handle(context.Background(), listmyapplications.Input{
+		Actor: shared.NewAdminActor(),
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleSkipsApplicationsWithMissingGame(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	// Note: seed only application-1's game; application-2 will reference a missing game.
+	seedGame(t, fix.games, "game-1", game.GameTypePublic, "G1", now)
+	seedApplication(t, fix.applications, "application-1", "game-1", "user-1", application.StatusSubmitted, now)
+	seedApplication(t, fix.applications, "application-2", "game-missing", "user-1", application.StatusSubmitted, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmyapplications.Input{
+		Actor: shared.NewUserActor("user-1"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 1)
+	require.Equal(t, common.ApplicationID("application-1"), out.Items[0].Application.ApplicationID)
+}
+
+func TestHandlePagination(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+	for i := range 4 {
+		gid := common.GameID("game-page-" + string(rune('a'+i)))
+		seedGame(t, fix.games, gid, game.GameTypePublic, "G", now)
+		seedApplication(t, fix.applications,
+			common.ApplicationID("application-page-"+string(rune('a'+i))),
+			gid, "user-1", application.StatusSubmitted,
+			now.Add(time.Duration(i)*time.Minute),
+		)
+	}
+
+	first, err := fix.svc.Handle(context.Background(), listmyapplications.Input{
+		Actor: shared.NewUserActor("user-1"),
+		Page:  shared.Page{Size: 2},
+	})
+	require.NoError(t, err)
+	require.Len(t, first.Items, 2)
+	require.NotEmpty(t, first.NextPageToken)
+	// Most recent first.
+	require.Equal(t, common.ApplicationID("application-page-d"), first.Items[0].Application.ApplicationID)
+	require.Equal(t, common.ApplicationID("application-page-c"), first.Items[1].Application.ApplicationID)
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		deps listmyapplications.Dependencies
+	}{
+		{"nil games", listmyapplications.Dependencies{Applications: applicationstub.NewStore()}},
+		{"nil applications", listmyapplications.Dependencies{Games: gamestub.NewStore()}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := listmyapplications.NewService(tc.deps)
+			require.Error(t, err)
+		})
+	}
+}

lobby/internal/service/listmygames/service.go

@@ -0,0 +1,175 @@
+// Package listmygames implements the `lobby.my_games.list` message
+// type. It returns the games where the acting user holds an active
+// membership and the game status is `running` or `paused`, matching
+// `lobby/README.md` §«My active games». The denormalized runtime
+// snapshot already lives on the game record, so the response is
+// produced from `gameStore.Get` alone — no fan-out to Game Master.
+//
+// The service is exclusively self-service: admin actors are rejected
+// with `shared.ErrForbidden`, mirroring `listmyracenames`.
+package listmygames
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sort"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// activeGameStatuses lists the game statuses included in the user's
+// «active games» view per README §«My active games».
+var activeGameStatuses = map[game.Status]struct{}{
+	game.StatusRunning: {},
+	game.StatusPaused:  {},
+}
+
+// Service executes the list-my-games use case.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	logger      *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games is loaded per active membership to read game name, owner,
+	// status, and the denormalized runtime snapshot.
+	Games ports.GameStore
+
+	// Memberships supplies the per-user membership index.
+	Memberships ports.MembershipStore
+
+	// Logger records structured diagnostics. Defaults to slog.Default
+	// when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new list my games service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new list my games service: nil membership store")
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		logger:      logger.With("service", "lobby.listmygames"),
+	}, nil
+}
+
+// Input stores the arguments required to compute the acting user's
+// active-games view.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindUser.
+	Actor shared.Actor
+
+	// Page stores the pagination request.
+	Page shared.Page
+}
+
+// Output stores the page returned by Handle.
+type Output struct {
+	// Items stores the active game records included in the current page.
+	Items []game.Game
+
+	// NextPageToken stores the opaque continuation token; empty when
+	// the current page is the last one.
+	NextPageToken string
+}
+
+// Handle authorizes the actor as a user, fetches their active
+// memberships, joins them with the game records, filters by status,
+// sorts deterministically, and returns the requested page.
+func (service *Service) Handle(ctx context.Context, input Input) (Output, error) {
+	if service == nil {
+		return Output{}, errors.New("list my games: nil service")
+	}
+	if ctx == nil {
+		return Output{}, errors.New("list my games: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return Output{}, fmt.Errorf("list my games: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return Output{}, fmt.Errorf(
+			"%w: only authenticated user actors may list their games",
+			shared.ErrForbidden,
+		)
+	}
+
+	memberships, err := service.memberships.GetByUser(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list my games: %w", err)
+	}
+
+	seen := make(map[common.GameID]struct{})
+	candidates := make([]game.Game, 0, len(memberships))
+	for _, mb := range memberships {
+		if mb.Status != membership.StatusActive {
+			continue
+		}
+		if _, dup := seen[mb.GameID]; dup {
+			continue
+		}
+		record, err := service.games.Get(ctx, mb.GameID)
+		if err != nil {
+			if errors.Is(err, game.ErrNotFound) {
+				service.logger.WarnContext(ctx, "membership references missing game",
+					"user_id", input.Actor.UserID,
+					"game_id", mb.GameID.String(),
+				)
+				continue
+			}
+			return Output{}, fmt.Errorf("list my games: %w", err)
+		}
+		if _, ok := activeGameStatuses[record.Status]; !ok {
+			continue
+		}
+		seen[record.GameID] = struct{}{}
+		candidates = append(candidates, record)
+	}
+
+	sortRecords(candidates)
+
+	start, end, nextOffset, hasMore := shared.Window(len(candidates), input.Page)
+	out := Output{Items: append([]game.Game(nil), candidates[start:end]...)}
+	if hasMore {
+		out.NextPageToken = shared.EncodeToken(nextOffset)
+	}
+	return out, nil
+}
+
+// sortRecords orders items by StartedAt descending so the most recently
+// started games surface first. Records without StartedAt fall back to
+// CreatedAt; GameID breaks ties for stable output.
+func sortRecords(items []game.Game) {
+	sort.Slice(items, func(i, j int) bool {
+		ti := startedOrCreated(items[i])
+		tj := startedOrCreated(items[j])
+		if !ti.Equal(tj) {
+			return ti.After(tj)
+		}
+		return items[i].GameID < items[j].GameID
+	})
+}
+
+func startedOrCreated(record game.Game) time.Time {
+	if record.StartedAt != nil {
+		return *record.StartedAt
+	}
+	return record.CreatedAt
+}

lobby/internal/service/listmygames/service_test.go

@@ -0,0 +1,201 @@
+package listmygames_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/listmygames"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+type fixture struct {
+	games       *gamestub.Store
+	memberships *membershipstub.Store
+	svc         *listmygames.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	games := gamestub.NewStore()
+	memberships := membershipstub.NewStore()
+	svc, err := listmygames.NewService(listmygames.Dependencies{
+		Games:       games,
+		Memberships: memberships,
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{games: games, memberships: memberships, svc: svc}
+}
+
+func seedGameWithStatus(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	status game.Status,
+	now time.Time,
+) {
+	t.Helper()
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed",
+		GameType:            game.GameTypePublic,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = now.Add(time.Minute)
+		if status == game.StatusRunning || status == game.StatusPaused ||
+			status == game.StatusFinished {
+			started := now.Add(time.Minute)
+			record.StartedAt = &started
+		}
+	}
+	require.NoError(t, store.Save(context.Background(), record))
+}
+
+func seedMembership(
+	t *testing.T,
+	store *membershipstub.Store,
+	gameID common.GameID,
+	userID string,
+	status membership.Status,
+	joinedAt time.Time,
+) {
+	t.Helper()
+	record, err := membership.New(membership.NewMembershipInput{
+		MembershipID: common.MembershipID("membership-" + userID + "-" + gameID.String()),
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     "Race-" + userID,
+		CanonicalKey: "race-" + userID,
+		Now:          joinedAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+	if status != membership.StatusActive {
+		require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateMembershipStatusInput{
+			MembershipID: record.MembershipID,
+			ExpectedFrom: membership.StatusActive,
+			To:           status,
+			At:           joinedAt.Add(time.Minute),
+		}))
+	}
+}
+
+func TestHandleReturnsRunningAndPaused(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	seedGameWithStatus(t, fix.games, "game-running", game.StatusRunning, now)
+	seedGameWithStatus(t, fix.games, "game-paused", game.StatusPaused, now)
+	seedGameWithStatus(t, fix.games, "game-finished", game.StatusFinished, now)
+	seedGameWithStatus(t, fix.games, "game-enroll", game.StatusEnrollmentOpen, now)
+	for _, id := range []common.GameID{"game-running", "game-paused", "game-finished", "game-enroll"} {
+		seedMembership(t, fix.memberships, id, "user-1", membership.StatusActive, now)
+	}
+
+	out, err := fix.svc.Handle(context.Background(), listmygames.Input{
+		Actor: shared.NewUserActor("user-1"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 2)
+	gotIDs := []common.GameID{out.Items[0].GameID, out.Items[1].GameID}
+	require.Contains(t, gotIDs, common.GameID("game-running"))
+	require.Contains(t, gotIDs, common.GameID("game-paused"))
+}
+
+func TestHandleIgnoresRemovedAndBlockedMemberships(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	seedGameWithStatus(t, fix.games, "game-removed", game.StatusRunning, now)
+	seedGameWithStatus(t, fix.games, "game-blocked", game.StatusRunning, now)
+	seedGameWithStatus(t, fix.games, "game-active", game.StatusRunning, now)
+	seedMembership(t, fix.memberships, "game-removed", "user-1", membership.StatusRemoved, now)
+	seedMembership(t, fix.memberships, "game-blocked", "user-1", membership.StatusBlocked, now)
+	seedMembership(t, fix.memberships, "game-active", "user-1", membership.StatusActive, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmygames.Input{
+		Actor: shared.NewUserActor("user-1"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 1)
+	require.Equal(t, common.GameID("game-active"), out.Items[0].GameID)
+}
+
+func TestHandleAdminForbidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+
+	_, err := fix.svc.Handle(context.Background(), listmygames.Input{
+		Actor: shared.NewAdminActor(),
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandlePaginationAndOrder(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	for i := range 4 {
+		id := common.GameID("game-page-" + string(rune('a'+i)))
+		seedGameWithStatus(t, fix.games, id, game.StatusRunning, now.Add(time.Duration(i)*time.Minute))
+		seedMembership(t, fix.memberships, id, "user-1", membership.StatusActive, now)
+	}
+
+	out, err := fix.svc.Handle(context.Background(), listmygames.Input{
+		Actor: shared.NewUserActor("user-1"),
+		Page:  shared.Page{Size: 2},
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 2)
+	require.NotEmpty(t, out.NextPageToken)
+
+	// Most recently started first.
+	require.Equal(t, common.GameID("game-page-d"), out.Items[0].GameID)
+	require.Equal(t, common.GameID("game-page-c"), out.Items[1].GameID)
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		deps listmygames.Dependencies
+	}{
+		{"nil games", listmygames.Dependencies{Memberships: membershipstub.NewStore()}},
+		{"nil memberships", listmygames.Dependencies{Games: gamestub.NewStore()}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := listmygames.NewService(tc.deps)
+			require.Error(t, err)
+		})
+	}
+}

lobby/internal/service/listmyinvites/service.go

@@ -0,0 +1,214 @@
+// Package listmyinvites implements the `lobby.my_invites.list` message
+// type. It returns invites addressed to the acting user with status
+// `created`, joined with the host game's `game_name` and the inviter's
+// display name as defined in `lobby/README.md` §«My open invitations»:
+// the inviter's race name when the inviter holds an active membership
+// in the host game, and the inviter's `user_id` otherwise.
+//
+// The service is exclusively self-service: admin actors are rejected
+// with `shared.ErrForbidden`.
+package listmyinvites
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sort"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// Service executes the list-my-invites use case.
+type Service struct {
+	games       ports.GameStore
+	invites     ports.InviteStore
+	memberships ports.MembershipStore
+	logger      *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games is loaded per invite to enrich the response with the host
+	// game's name and to access its OwnerUserID.
+	Games ports.GameStore
+
+	// Invites supplies the per-invitee index.
+	Invites ports.InviteStore
+
+	// Memberships is consulted per invite's host game to derive the
+	// inviter's race name. It may be replaced with a denormalized field
+	// later without changing this contract.
+	Memberships ports.MembershipStore
+
+	// Logger records structured diagnostics. Defaults to slog.Default
+	// when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new list my invites service: nil game store")
+	case deps.Invites == nil:
+		return nil, errors.New("new list my invites service: nil invite store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new list my invites service: nil membership store")
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		invites:     deps.Invites,
+		memberships: deps.Memberships,
+		logger:      logger.With("service", "lobby.listmyinvites"),
+	}, nil
+}
+
+// Input stores the arguments required to compute the acting user's
+// open-invites view.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindUser.
+	Actor shared.Actor
+
+	// Page stores the pagination request.
+	Page shared.Page
+}
+
+// Item enriches one open invite with the host game's name and the
+// derived inviter display name, mirroring the OpenAPI `MyInviteItem`
+// schema.
+type Item struct {
+	Invite      invite.Invite
+	GameName    string
+	InviterName string
+}
+
+// Output stores the page returned by Handle.
+type Output struct {
+	// Items stores the enriched invite records included in the current
+	// page.
+	Items []Item
+
+	// NextPageToken stores the opaque continuation token; empty when
+	// the current page is the last one.
+	NextPageToken string
+}
+
+// Handle authorizes the actor as a user, fetches their invites,
+// filters to `created`, joins with the game store and the inviter's
+// active membership, sorts, and returns the requested page.
+func (service *Service) Handle(ctx context.Context, input Input) (Output, error) {
+	if service == nil {
+		return Output{}, errors.New("list my invites: nil service")
+	}
+	if ctx == nil {
+		return Output{}, errors.New("list my invites: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return Output{}, fmt.Errorf("list my invites: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return Output{}, fmt.Errorf(
+			"%w: only authenticated user actors may list their invites",
+			shared.ErrForbidden,
+		)
+	}
+
+	records, err := service.invites.GetByUser(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list my invites: %w", err)
+	}
+
+	candidates := make([]Item, 0, len(records))
+	for _, record := range records {
+		if record.Status != invite.StatusCreated {
+			continue
+		}
+		gameName, ok := service.lookupGameName(ctx, record.GameID, record.InviteID)
+		if !ok {
+			continue
+		}
+		inviterName, err := service.deriveInviterName(ctx, record)
+		if err != nil {
+			return Output{}, fmt.Errorf("list my invites: %w", err)
+		}
+		candidates = append(candidates, Item{
+			Invite:      record,
+			GameName:    gameName,
+			InviterName: inviterName,
+		})
+	}
+
+	sortItems(candidates)
+
+	start, end, nextOffset, hasMore := shared.Window(len(candidates), input.Page)
+	out := Output{Items: append([]Item(nil), candidates[start:end]...)}
+	if hasMore {
+		out.NextPageToken = shared.EncodeToken(nextOffset)
+	}
+	return out, nil
+}
+
+// lookupGameName returns the host game's name. A missing game record
+// is logged at warn and the invite is dropped from the response — the
+// invite cannot meaningfully render without the parent game.
+func (service *Service) lookupGameName(
+	ctx context.Context,
+	gameID common.GameID,
+	inviteID common.InviteID,
+) (string, bool) {
+	record, err := service.games.Get(ctx, gameID)
+	if err == nil {
+		return record.GameName, true
+	}
+	if errors.Is(err, game.ErrNotFound) {
+		service.logger.WarnContext(ctx, "invite references missing game",
+			"invite_id", inviteID.String(),
+			"game_id", gameID.String(),
+		)
+		return "", false
+	}
+	service.logger.ErrorContext(ctx, "load invite game",
+		"invite_id", inviteID.String(),
+		"game_id", gameID.String(),
+		"err", err.Error(),
+	)
+	return "", false
+}
+
+// deriveInviterName returns the inviter's race name when an active
+// membership exists in the host game; otherwise it returns the
+// inviter's user_id verbatim, matching README §«Invite Lifecycle».
+func (service *Service) deriveInviterName(ctx context.Context, record invite.Invite) (string, error) {
+	memberships, err := service.memberships.GetByGame(ctx, record.GameID)
+	if err != nil {
+		return "", err
+	}
+	for _, mb := range memberships {
+		if mb.UserID == record.InviterUserID && mb.Status == membership.StatusActive {
+			return mb.RaceName, nil
+		}
+	}
+	return record.InviterUserID, nil
+}
+
+// sortItems orders invites by CreatedAt descending; InviteID breaks
+// ties for stable output across adapters.
+func sortItems(items []Item) {
+	sort.Slice(items, func(i, j int) bool {
+		ci, cj := items[i].Invite.CreatedAt, items[j].Invite.CreatedAt
+		if !ci.Equal(cj) {
+			return ci.After(cj)
+		}
+		return items[i].Invite.InviteID < items[j].Invite.InviteID
+	})
+}

lobby/internal/service/listmyinvites/service_test.go

@@ -0,0 +1,236 @@
+package listmyinvites_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/listmyinvites"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+type fixture struct {
+	games       *gamestub.Store
+	invites     *invitestub.Store
+	memberships *membershipstub.Store
+	svc         *listmyinvites.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	games := gamestub.NewStore()
+	invites := invitestub.NewStore()
+	memberships := membershipstub.NewStore()
+	svc, err := listmyinvites.NewService(listmyinvites.Dependencies{
+		Games:       games,
+		Invites:     invites,
+		Memberships: memberships,
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{games: games, invites: invites, memberships: memberships, svc: svc}
+}
+
+func seedPrivateGame(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	owner string,
+	name string,
+	now time.Time,
+) {
+	t.Helper()
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            name,
+		GameType:            game.GameTypePrivate,
+		OwnerUserID:         owner,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+}
+
+func seedInvite(
+	t *testing.T,
+	store *invitestub.Store,
+	id common.InviteID,
+	gameID common.GameID,
+	inviter, invitee string,
+	status invite.Status,
+	createdAt time.Time,
+) {
+	t.Helper()
+	record, err := invite.New(invite.NewInviteInput{
+		InviteID:      id,
+		GameID:        gameID,
+		InviterUserID: inviter,
+		InviteeUserID: invitee,
+		Now:           createdAt,
+		ExpiresAt:     createdAt.Add(48 * time.Hour),
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+	if status != invite.StatusCreated {
+		input := ports.UpdateInviteStatusInput{
+			InviteID:     id,
+			ExpectedFrom: invite.StatusCreated,
+			To:           status,
+			At:           createdAt.Add(time.Minute),
+		}
+		if status == invite.StatusRedeemed {
+			input.RaceName = "Race-" + invitee
+		}
+		require.NoError(t, store.UpdateStatus(context.Background(), input))
+	}
+}
+
+func seedActiveMembership(
+	t *testing.T,
+	store *membershipstub.Store,
+	gameID common.GameID,
+	userID, raceName string,
+	now time.Time,
+) {
+	t.Helper()
+	record, err := membership.New(membership.NewMembershipInput{
+		MembershipID: common.MembershipID("membership-" + userID + "-" + gameID.String()),
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     raceName,
+		CanonicalKey: raceName,
+		Now:          now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+}
+
+func TestHandleReturnsCreatedOnly(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	seedPrivateGame(t, fix.games, "game-1", "user-owner", "Hyperion", now)
+	seedInvite(t, fix.invites, "invite-created", "game-1", "user-owner", "user-invitee", invite.StatusCreated, now)
+	seedInvite(t, fix.invites, "invite-declined", "game-1", "user-owner", "user-invitee", invite.StatusDeclined, now)
+	seedInvite(t, fix.invites, "invite-revoked", "game-1", "user-owner", "user-invitee", invite.StatusRevoked, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmyinvites.Input{
+		Actor: shared.NewUserActor("user-invitee"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 1)
+	require.Equal(t, common.InviteID("invite-created"), out.Items[0].Invite.InviteID)
+	require.Equal(t, "Hyperion", out.Items[0].GameName)
+}
+
+func TestHandleInviterNameUsesRaceWhenAvailable(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	seedPrivateGame(t, fix.games, "game-1", "user-owner", "G", now)
+	seedActiveMembership(t, fix.memberships, "game-1", "user-owner", "Centauri", now)
+	seedInvite(t, fix.invites, "invite-1", "game-1", "user-owner", "user-invitee", invite.StatusCreated, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmyinvites.Input{
+		Actor: shared.NewUserActor("user-invitee"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 1)
+	require.Equal(t, "Centauri", out.Items[0].InviterName)
+}
+
+func TestHandleInviterNameFallsBackToUserID(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	seedPrivateGame(t, fix.games, "game-1", "user-owner", "G", now)
+	// no membership for inviter
+	seedInvite(t, fix.invites, "invite-1", "game-1", "user-owner", "user-invitee", invite.StatusCreated, now)
+
+	out, err := fix.svc.Handle(context.Background(), listmyinvites.Input{
+		Actor: shared.NewUserActor("user-invitee"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Items, 1)
+	require.Equal(t, "user-owner", out.Items[0].InviterName)
+}
+
+func TestHandleAdminForbidden(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	_, err := fix.svc.Handle(context.Background(), listmyinvites.Input{
+		Actor: shared.NewAdminActor(),
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandlePagination(t *testing.T) {
+	t.Parallel()
+	fix := newFixture(t)
+	now := time.Date(2025, 6, 1, 12, 0, 0, 0, time.UTC)
+
+	for i := range 4 {
+		gid := common.GameID("game-page-" + string(rune('a'+i)))
+		seedPrivateGame(t, fix.games, gid, "user-owner", "G", now)
+		seedInvite(t, fix.invites,
+			common.InviteID("invite-page-"+string(rune('a'+i))),
+			gid, "user-owner", "user-invitee", invite.StatusCreated,
+			now.Add(time.Duration(i)*time.Minute),
+		)
+	}
+
+	first, err := fix.svc.Handle(context.Background(), listmyinvites.Input{
+		Actor: shared.NewUserActor("user-invitee"),
+		Page:  shared.Page{Size: 2},
+	})
+	require.NoError(t, err)
+	require.Len(t, first.Items, 2)
+	require.NotEmpty(t, first.NextPageToken)
+	require.Equal(t, common.InviteID("invite-page-d"), first.Items[0].Invite.InviteID)
+	require.Equal(t, common.InviteID("invite-page-c"), first.Items[1].Invite.InviteID)
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		deps listmyinvites.Dependencies
+	}{
+		{"nil games", listmyinvites.Dependencies{Invites: invitestub.NewStore(), Memberships: membershipstub.NewStore()}},
+		{"nil invites", listmyinvites.Dependencies{Games: gamestub.NewStore(), Memberships: membershipstub.NewStore()}},
+		{"nil memberships", listmyinvites.Dependencies{Games: gamestub.NewStore(), Invites: invitestub.NewStore()}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := listmyinvites.NewService(tc.deps)
+			require.Error(t, err)
+		})
+	}
+}

lobby/internal/service/listmyracenames/service.go

@@ -0,0 +1,250 @@
+// Package listmyracenames implements the `lobby.race_names.list`
+// message type. It returns the acting user's view of the Race Name
+// Directory across all three levels of binding: permanent registered
+// names, pending_registration entries waiting for their 30-day window
+// to elapse, and active per-game reservations.
+//
+// The service is intentionally thin: it consults the user-keyed RND
+// indexes through the port (no full scan of the directory) and joins
+// each active reservation with the current `game.Status` from the
+// Game Store so callers can render the reservation alongside the
+// game it belongs to. No User Service eligibility lookup is required —
+// reading one's own name set is unconditional.
+package listmyracenames
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sort"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// Service executes the race-name self-service read use case.
+type Service struct {
+	directory ports.RaceNameDirectory
+	games     ports.GameStore
+	logger    *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Directory exposes the user-keyed RND indexes (registered,
+	// pending_registration, reservation) that satisfy the no-full-scan
+	// requirement of `lobby.race_names.list`.
+	Directory ports.RaceNameDirectory
+
+	// Games supplies the current `game.Status` of each active
+	// reservation so the response can render it next to the
+	// game id (README §Race Name self-service).
+	Games ports.GameStore
+
+	// Logger records structural diagnostics. Defaults to slog.Default
+	// when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Directory == nil:
+		return nil, errors.New("new list my race names service: nil race name directory")
+	case deps.Games == nil:
+		return nil, errors.New("new list my race names service: nil game store")
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		directory: deps.Directory,
+		games:     deps.Games,
+		logger:    logger.With("service", "lobby.listmyracenames"),
+	}, nil
+}
+
+// Input stores the arguments required to compute the acting user's
+// race-name view.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindUser; the
+	// `lobby.race_names.list` route is exclusively self-service and
+	// admin actors are rejected.
+	Actor shared.Actor
+}
+
+// RegisteredName describes one permanent race name owned by the
+// acting user. Mirrors `ports.RegisteredName` field-for-field so the
+// transport can return them as-is.
+type RegisteredName struct {
+	CanonicalKey   string
+	RaceName       string
+	SourceGameID   string
+	RegisteredAtMs int64
+}
+
+// PendingRegistration describes one promoted reservation waiting for
+// the acting user to convert it into a registered name.
+type PendingRegistration struct {
+	CanonicalKey    string
+	RaceName        string
+	SourceGameID    string
+	ReservedAtMs    int64
+	EligibleUntilMs int64
+}
+
+// Reservation describes one active per-game reservation owned by the
+// acting user. GameStatus carries the current `game.Status` of the
+// hosting game (empty when the game record could not be loaded).
+type Reservation struct {
+	CanonicalKey string
+	RaceName     string
+	GameID       string
+	ReservedAtMs int64
+	GameStatus   string
+}
+
+// Output stores the three slices returned by Handle. Each slice is
+// non-nil but possibly empty. Items inside one slice are ordered by
+// the relevant timestamp ascending, then by canonical key, so output
+// is stable for tests and UI alike.
+type Output struct {
+	Registered   []RegisteredName
+	Pending      []PendingRegistration
+	Reservations []Reservation
+}
+
+// Handle authorizes the actor as a user, fetches the three RND views
+// for that user, and joins each reservation with the current game
+// status.
+func (service *Service) Handle(ctx context.Context, input Input) (Output, error) {
+	if service == nil {
+		return Output{}, errors.New("list my race names: nil service")
+	}
+	if ctx == nil {
+		return Output{}, errors.New("list my race names: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return Output{}, fmt.Errorf("list my race names: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return Output{}, fmt.Errorf(
+			"%w: only authenticated user actors may list their race names",
+			shared.ErrForbidden,
+		)
+	}
+
+	registered, err := service.directory.ListRegistered(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list my race names: %w", err)
+	}
+	pending, err := service.directory.ListPendingRegistrations(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list my race names: %w", err)
+	}
+	reservations, err := service.directory.ListReservations(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("list my race names: %w", err)
+	}
+
+	out := Output{
+		Registered:   make([]RegisteredName, 0, len(registered)),
+		Pending:      make([]PendingRegistration, 0, len(pending)),
+		Reservations: make([]Reservation, 0, len(reservations)),
+	}
+	for _, entry := range registered {
+		out.Registered = append(out.Registered, RegisteredName{
+			CanonicalKey:   entry.CanonicalKey,
+			RaceName:       entry.RaceName,
+			SourceGameID:   entry.SourceGameID,
+			RegisteredAtMs: entry.RegisteredAtMs,
+		})
+	}
+	for _, entry := range pending {
+		out.Pending = append(out.Pending, PendingRegistration{
+			CanonicalKey:    entry.CanonicalKey,
+			RaceName:        entry.RaceName,
+			SourceGameID:    entry.GameID,
+			ReservedAtMs:    entry.ReservedAtMs,
+			EligibleUntilMs: entry.EligibleUntilMs,
+		})
+	}
+	for _, entry := range reservations {
+		status := service.lookupGameStatus(ctx, common.GameID(entry.GameID), input.Actor.UserID)
+		out.Reservations = append(out.Reservations, Reservation{
+			CanonicalKey: entry.CanonicalKey,
+			RaceName:     entry.RaceName,
+			GameID:       entry.GameID,
+			ReservedAtMs: entry.ReservedAtMs,
+			GameStatus:   status,
+		})
+	}
+
+	sortRegistered(out.Registered)
+	sortPending(out.Pending)
+	sortReservations(out.Reservations)
+
+	return out, nil
+}
+
+// lookupGameStatus returns the current game status for gameID. When
+// the game record cannot be loaded — including the defensive
+// game.ErrNotFound case — the empty string is returned and the miss
+// is logged so operators can investigate dangling RND state.
+func (service *Service) lookupGameStatus(
+	ctx context.Context,
+	gameID common.GameID,
+	userID string,
+) string {
+	record, err := service.games.Get(ctx, gameID)
+	if err == nil {
+		return string(record.Status)
+	}
+	level := slog.LevelWarn
+	if errors.Is(err, game.ErrNotFound) {
+		service.logger.Log(ctx, level,
+			"reservation references missing game",
+			"user_id", userID,
+			"game_id", gameID.String(),
+		)
+		return ""
+	}
+	service.logger.Log(ctx, level,
+		"load reservation game status",
+		"user_id", userID,
+		"game_id", gameID.String(),
+		"err", err.Error(),
+	)
+	return ""
+}
+
+func sortRegistered(items []RegisteredName) {
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].RegisteredAtMs != items[j].RegisteredAtMs {
+			return items[i].RegisteredAtMs < items[j].RegisteredAtMs
+		}
+		return items[i].CanonicalKey < items[j].CanonicalKey
+	})
+}
+
+func sortPending(items []PendingRegistration) {
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].EligibleUntilMs != items[j].EligibleUntilMs {
+			return items[i].EligibleUntilMs < items[j].EligibleUntilMs
+		}
+		return items[i].CanonicalKey < items[j].CanonicalKey
+	})
+}
+
+func sortReservations(items []Reservation) {
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].ReservedAtMs != items[j].ReservedAtMs {
+			return items[i].ReservedAtMs < items[j].ReservedAtMs
+		}
+		return items[i].CanonicalKey < items[j].CanonicalKey
+	})
+}

lobby/internal/service/listmyracenames/service_test.go

@@ -0,0 +1,302 @@
+package listmyracenames_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/listmyracenames"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// silentLogger discards all log output to keep test stdout clean.
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+// fixture wires the listmyracenames service with the in-process
+// race-name directory stub and the in-process game store.
+type fixture struct {
+	now       time.Time
+	directory *racenamestub.Directory
+	games     *gamestub.Store
+	service   *listmyracenames.Service
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	directory, err := racenamestub.NewDirectory(racenamestub.WithClock(func() time.Time { return now }))
+	require.NoError(t, err)
+	games := gamestub.NewStore()
+	svc, err := listmyracenames.NewService(listmyracenames.Dependencies{
+		Directory: directory,
+		Games:     games,
+		Logger:    silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{now: now, directory: directory, games: games, service: svc}
+}
+
+// seedGame stores one game record so reservation lookups have a record
+// to read. Private games receive a synthetic owner so domain
+// validation accepts them.
+func (f *fixture) seedGame(t *testing.T, id common.GameID, gameType game.GameType, status game.Status) {
+	t.Helper()
+
+	owner := ""
+	if gameType == game.GameTypePrivate {
+		owner = "owner-" + id.String()
+	}
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed " + id.String(),
+		GameType:            gameType,
+		OwnerUserID:         owner,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    f.now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 f.now,
+	})
+	require.NoError(t, err)
+	if status != game.StatusDraft {
+		record.Status = status
+	}
+	require.NoError(t, f.games.Save(context.Background(), record))
+}
+
+func (f *fixture) reserve(t *testing.T, gameID, userID, raceName string) {
+	t.Helper()
+	require.NoError(t, f.directory.Reserve(context.Background(), gameID, userID, raceName))
+}
+
+func (f *fixture) markPending(t *testing.T, gameID, userID, raceName string, eligibleUntil time.Time) {
+	t.Helper()
+	require.NoError(t, f.directory.MarkPendingRegistration(context.Background(), gameID, userID, raceName, eligibleUntil))
+}
+
+func (f *fixture) register(t *testing.T, gameID, userID, raceName string) {
+	t.Helper()
+	require.NoError(t, f.directory.Register(context.Background(), gameID, userID, raceName))
+}
+
+func TestHandleHappyPath(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t)
+	const userID = "user-1"
+
+	// One registered name converted from a finished game.
+	f.seedGame(t, "game-finished", game.GameTypePublic, game.StatusFinished)
+	f.reserve(t, "game-finished", userID, "Andromeda")
+	f.markPending(t, "game-finished", userID, "Andromeda", f.now.Add(7*24*time.Hour))
+	f.register(t, "game-finished", userID, "Andromeda")
+
+	// One pending registration awaiting the
+	f.seedGame(t, "game-pending", game.GameTypePublic, game.StatusFinished)
+	f.reserve(t, "game-pending", userID, "Vega")
+	f.markPending(t, "game-pending", userID, "Vega", f.now.Add(24*time.Hour))
+
+	// Two active reservations across a running and an enrollment_open game.
+	f.seedGame(t, "game-running", game.GameTypePrivate, game.StatusRunning)
+	f.reserve(t, "game-running", userID, "Orion")
+	f.seedGame(t, "game-open", game.GameTypePublic, game.StatusEnrollmentOpen)
+	f.reserve(t, "game-open", userID, "Cygnus")
+
+	out, err := f.service.Handle(context.Background(), listmyracenames.Input{
+		Actor: shared.NewUserActor(userID),
+	})
+	require.NoError(t, err)
+
+	require.Len(t, out.Registered, 1)
+	assert.Equal(t, "Andromeda", out.Registered[0].RaceName)
+	assert.Equal(t, "game-finished", out.Registered[0].SourceGameID)
+	assert.Equal(t, f.now.UnixMilli(), out.Registered[0].RegisteredAtMs)
+	assert.NotEmpty(t, out.Registered[0].CanonicalKey)
+
+	require.Len(t, out.Pending, 1)
+	assert.Equal(t, "Vega", out.Pending[0].RaceName)
+	assert.Equal(t, "game-pending", out.Pending[0].SourceGameID)
+	assert.Equal(t, f.now.Add(24*time.Hour).UnixMilli(), out.Pending[0].EligibleUntilMs)
+	assert.Equal(t, f.now.UnixMilli(), out.Pending[0].ReservedAtMs)
+
+	require.Len(t, out.Reservations, 2)
+	gameStatusByID := map[string]string{}
+	for _, r := range out.Reservations {
+		gameStatusByID[r.GameID] = r.GameStatus
+	}
+	assert.Equal(t, string(game.StatusRunning), gameStatusByID["game-running"])
+	assert.Equal(t, string(game.StatusEnrollmentOpen), gameStatusByID["game-open"])
+}
+
+func TestHandleEmptyView(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t)
+	out, err := f.service.Handle(context.Background(), listmyracenames.Input{
+		Actor: shared.NewUserActor("user-empty"),
+	})
+	require.NoError(t, err)
+
+	assert.NotNil(t, out.Registered)
+	assert.NotNil(t, out.Pending)
+	assert.NotNil(t, out.Reservations)
+	assert.Empty(t, out.Registered)
+	assert.Empty(t, out.Pending)
+	assert.Empty(t, out.Reservations)
+}
+
+func TestHandleAdminActorIsForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t)
+	_, err := f.service.Handle(context.Background(), listmyracenames.Input{
+		Actor: shared.NewAdminActor(),
+	})
+	require.Error(t, err)
+	assert.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleInvalidActorIsRejected(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t)
+	_, err := f.service.Handle(context.Background(), listmyracenames.Input{Actor: shared.Actor{}})
+	require.Error(t, err)
+	assert.NotErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleVisibilityIsolation(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t)
+	f.seedGame(t, "game-shared", game.GameTypePublic, game.StatusEnrollmentOpen)
+	f.reserve(t, "game-shared", "user-owner", "Polaris")
+
+	out, err := f.service.Handle(context.Background(), listmyracenames.Input{
+		Actor: shared.NewUserActor("user-other"),
+	})
+	require.NoError(t, err)
+	assert.Empty(t, out.Reservations)
+	assert.Empty(t, out.Pending)
+	assert.Empty(t, out.Registered)
+}
+
+func TestHandleReservationOnMissingGame(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t)
+	f.reserve(t, "game-vanished", "user-1", "Hydra")
+
+	out, err := f.service.Handle(context.Background(), listmyracenames.Input{
+		Actor: shared.NewUserActor("user-1"),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Reservations, 1)
+	assert.Equal(t, "game-vanished", out.Reservations[0].GameID)
+	assert.Empty(t, out.Reservations[0].GameStatus)
+}
+
+func TestHandleSortByTimestamp(t *testing.T) {
+	t.Parallel()
+
+	const userID = "user-sort"
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	clock := now
+	directory, err := racenamestub.NewDirectory(racenamestub.WithClock(func() time.Time { return clock }))
+	require.NoError(t, err)
+	games := gamestub.NewStore()
+	svc, err := listmyracenames.NewService(listmyracenames.Dependencies{
+		Directory: directory,
+		Games:     games,
+		Logger:    silentLogger(),
+	})
+	require.NoError(t, err)
+
+	seed := func(id common.GameID) {
+		record, err := game.New(game.NewGameInput{
+			GameID:              id,
+			GameName:            "Seed " + id.String(),
+			GameType:            game.GameTypePublic,
+			MinPlayers:          2,
+			MaxPlayers:          4,
+			StartGapHours:       4,
+			StartGapPlayers:     1,
+			EnrollmentEndsAt:    now.Add(24 * time.Hour),
+			TurnSchedule:        "0 */6 * * *",
+			TargetEngineVersion: "1.0.0",
+			Now:                 now,
+		})
+		require.NoError(t, err)
+		record.Status = game.StatusEnrollmentOpen
+		require.NoError(t, games.Save(context.Background(), record))
+	}
+	seed("game-a")
+	seed("game-b")
+	seed("game-c")
+
+	// Reserve three names against an advancing clock so reserved_at_ms
+	// is strictly increasing.
+	clock = now
+	require.NoError(t, directory.Reserve(context.Background(), "game-a", userID, "Lyra"))
+	clock = now.Add(time.Minute)
+	require.NoError(t, directory.Reserve(context.Background(), "game-b", userID, "Sirius"))
+	clock = now.Add(2 * time.Minute)
+	require.NoError(t, directory.Reserve(context.Background(), "game-c", userID, "Pavo"))
+
+	out, err := svc.Handle(context.Background(), listmyracenames.Input{
+		Actor: shared.NewUserActor(userID),
+	})
+	require.NoError(t, err)
+	require.Len(t, out.Reservations, 3)
+	for index := 1; index < len(out.Reservations); index++ {
+		prev := out.Reservations[index-1]
+		curr := out.Reservations[index]
+		if prev.ReservedAtMs == curr.ReservedAtMs {
+			assert.LessOrEqual(t, prev.CanonicalKey, curr.CanonicalKey)
+			continue
+		}
+		assert.Less(t, prev.ReservedAtMs, curr.ReservedAtMs)
+	}
+	assert.Equal(t, "game-a", out.Reservations[0].GameID)
+	assert.Equal(t, "game-b", out.Reservations[1].GameID)
+	assert.Equal(t, "game-c", out.Reservations[2].GameID)
+}
+
+// TestNewServiceRejectsMissingDeps guards against constructor misuse.
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+
+	directory, err := racenamestub.NewDirectory()
+	require.NoError(t, err)
+	games := gamestub.NewStore()
+
+	_, err = listmyracenames.NewService(listmyracenames.Dependencies{
+		Games: games,
+	})
+	require.Error(t, err)
+
+	_, err = listmyracenames.NewService(listmyracenames.Dependencies{
+		Directory: directory,
+	})
+	require.Error(t, err)
+}
+
+// Sanity guard so a future port refactor that drops the user-keyed
+// indexes immediately breaks the test build instead of silently
+// regressing the no-full-scan invariant.
+var _ ports.RaceNameDirectory = (*racenamestub.Directory)(nil)

lobby/internal/service/manualreadytostart/service.go

@@ -0,0 +1,193 @@
+// Package manualreadytostart implements the `lobby.game.ready_to_start`
+// message type. It transitions a game record from `enrollment_open` to
+// `ready_to_start` after enforcing admin-or-owner authorization and the
+// `approved_count >= min_players` precondition. Side effects (expiring
+// every still-created invite and publishing `lobby.invite.expired`) are
+// delegated to shared.CloseEnrollment so the auto-close path used by the
+// enrollment automation worker stays in sync.
+package manualreadytostart
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the manual ready-to-start use case.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	invites     ports.InviteStore
+	intents     ports.IntentPublisher
+	clock       func() time.Time
+	logger      *slog.Logger
+	telemetry   *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games mediates the CAS status transition and the result read.
+	Games ports.GameStore
+
+	// Memberships is scanned for active records to evaluate the
+	// approved_count >= min_players precondition.
+	Memberships ports.MembershipStore
+
+	// Invites is forwarded to shared.CloseEnrollment for the cascading
+	// expiry of created invites on close.
+	Invites ports.InviteStore
+
+	// Intents publishes lobby.invite.expired notifications produced by
+	// the cascading expiry.
+	Intents ports.IntentPublisher
+
+	// Clock supplies the wall-clock used for UpdatedAt and downstream
+	// notification timestamps. Defaults to time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry forwards into shared.CloseEnrollment so the
+	// `lobby.game.transitions` and `lobby.invite.outcomes` counters
+	// are emitted on each manual close. Optional; nil disables metric
+	// emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Games == nil {
+		return nil, errors.New("new manual ready-to-start service: nil game store")
+	}
+	if deps.Memberships == nil {
+		return nil, errors.New("new manual ready-to-start service: nil membership store")
+	}
+	if deps.Invites == nil {
+		return nil, errors.New("new manual ready-to-start service: nil invite store")
+	}
+	if deps.Intents == nil {
+		return nil, errors.New("new manual ready-to-start service: nil intent publisher")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		invites:     deps.Invites,
+		intents:     deps.Intents,
+		clock:       clock,
+		logger:      logger.With("service", "lobby.manualreadytostart"),
+		telemetry:   deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to manually close enrollment on one
+// game.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, checks status and roster preconditions,
+// performs the enrollment close (transition + invite expiry +
+// notifications), and returns the post-transition snapshot.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("manual ready-to-start: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("manual ready-to-start: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("manual ready-to-start: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("manual ready-to-start: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("manual ready-to-start: %w", err)
+	}
+
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+
+	if record.Status != game.StatusEnrollmentOpen {
+		return game.Game{}, fmt.Errorf(
+			"manual ready-to-start: status %q is not enrollment_open: %w",
+			record.Status, game.ErrConflict,
+		)
+	}
+
+	approvedCount, err := shared.CountActiveMemberships(ctx, service.memberships, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("manual ready-to-start: %w", err)
+	}
+	if approvedCount < record.MinPlayers {
+		return game.Game{}, fmt.Errorf(
+			"manual ready-to-start: approved_count %d is below min_players %d: %w",
+			approvedCount, record.MinPlayers, game.ErrConflict,
+		)
+	}
+
+	at := service.clock().UTC()
+	updated, err := shared.CloseEnrollment(ctx, shared.CloseEnrollmentDeps{
+		Games:     service.games,
+		Invites:   service.invites,
+		Intents:   service.intents,
+		Logger:    service.logger,
+		Telemetry: service.telemetry,
+	}, input.GameID, game.TriggerManual, at)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("manual ready-to-start: %w", err)
+	}
+
+	logArgs := []any{
+		"game_id", updated.GameID.String(),
+		"from_status", string(game.StatusEnrollmentOpen),
+		"to_status", string(updated.Status),
+		"trigger", string(game.TriggerManual),
+		"approved_count", approvedCount,
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "game manually moved to ready_to_start", logArgs...)
+
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to close enrollment on game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/manualreadytostart/service_test.go

@@ -0,0 +1,250 @@
+package manualreadytostart_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/service/manualreadytostart"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	publicGameID  = common.GameID("game-public")
+	privateGameID = common.GameID("game-private")
+	ownerUserID   = "user-owner"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixture struct {
+	now         time.Time
+	games       *gamestub.Store
+	invites     *invitestub.Store
+	memberships *membershipstub.Store
+	intents     *intentpubstub.Publisher
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	return &fixture{
+		now:         now,
+		games:       gamestub.NewStore(),
+		invites:     invitestub.NewStore(),
+		memberships: membershipstub.NewStore(),
+		intents:     intentpubstub.NewPublisher(),
+	}
+}
+
+func (f *fixture) addGame(t *testing.T, gameID common.GameID, gameType game.GameType, owner string, minPlayers int) game.Game {
+	t.Helper()
+	rec, err := game.New(game.NewGameInput{
+		GameID:              gameID,
+		GameName:            "Test Game",
+		GameType:            gameType,
+		OwnerUserID:         owner,
+		MinPlayers:          minPlayers,
+		MaxPlayers:          minPlayers + 2,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    f.now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 f.now,
+	})
+	require.NoError(t, err)
+	rec.Status = game.StatusEnrollmentOpen
+	require.NoError(t, f.games.Save(context.Background(), rec))
+	return rec
+}
+
+func (f *fixture) addActiveMember(t *testing.T, membershipID common.MembershipID, gameID common.GameID, userID string) {
+	t.Helper()
+	mem, err := membership.New(membership.NewMembershipInput{
+		MembershipID: membershipID,
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     "Race " + userID,
+		CanonicalKey: "race-" + userID,
+		Now:          f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), mem))
+}
+
+func (f *fixture) addCreatedInvite(t *testing.T, inviteID common.InviteID, gameID common.GameID, owner, invitee string) {
+	t.Helper()
+	rec, err := invite.New(invite.NewInviteInput{
+		InviteID:      inviteID,
+		GameID:        gameID,
+		InviterUserID: owner,
+		InviteeUserID: invitee,
+		Now:           f.now,
+		ExpiresAt:     f.now.Add(24 * time.Hour),
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.invites.Save(context.Background(), rec))
+}
+
+func (f *fixture) newService(t *testing.T) *manualreadytostart.Service {
+	t.Helper()
+	svc, err := manualreadytostart.NewService(manualreadytostart.Dependencies{
+		Games:       f.games,
+		Memberships: f.memberships,
+		Invites:     f.invites,
+		Intents:     f.intents,
+		Clock:       fixedClock(f.now),
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func TestHandleAdminClosesPublicEnrollment(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.addGame(t, publicGameID, game.GameTypePublic, "", 2)
+	f.addActiveMember(t, "membership-1", publicGameID, "user-a")
+	f.addActiveMember(t, "membership-2", publicGameID, "user-b")
+
+	got, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: publicGameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusReadyToStart, got.Status)
+}
+
+func TestHandleOwnerClosesPrivateEnrollmentAndExpiresInvites(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.addGame(t, privateGameID, game.GameTypePrivate, ownerUserID, 2)
+	f.addActiveMember(t, "membership-1", privateGameID, "user-a")
+	f.addActiveMember(t, "membership-2", privateGameID, "user-b")
+	f.addCreatedInvite(t, "invite-1", privateGameID, ownerUserID, "user-c")
+	f.addCreatedInvite(t, "invite-2", privateGameID, ownerUserID, "user-d")
+
+	got, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewUserActor(ownerUserID),
+		GameID: privateGameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusReadyToStart, got.Status)
+
+	for _, id := range []common.InviteID{"invite-1", "invite-2"} {
+		rec, err := f.invites.Get(context.Background(), id)
+		require.NoError(t, err)
+		assert.Equal(t, invite.StatusExpired, rec.Status)
+	}
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 2)
+	for _, intent := range intents {
+		assert.Equal(t, notificationintent.NotificationTypeLobbyInviteExpired, intent.NotificationType)
+		assert.Equal(t, []string{ownerUserID}, intent.RecipientUserIDs)
+	}
+}
+
+func TestHandleNonOwnerOnPrivateForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.addGame(t, privateGameID, game.GameTypePrivate, ownerUserID, 2)
+	f.addActiveMember(t, "membership-1", privateGameID, "user-a")
+	f.addActiveMember(t, "membership-2", privateGameID, "user-b")
+
+	_, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewUserActor("user-impostor"),
+		GameID: privateGameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleUserOnPublicForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.addGame(t, publicGameID, game.GameTypePublic, "", 2)
+	f.addActiveMember(t, "membership-1", publicGameID, "user-a")
+	f.addActiveMember(t, "membership-2", publicGameID, "user-b")
+
+	_, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewUserActor("user-a"),
+		GameID: publicGameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleGameNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+
+	_, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: publicGameID,
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestHandleStatusNotEnrollmentOpenConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	rec := f.addGame(t, publicGameID, game.GameTypePublic, "", 2)
+	rec.Status = game.StatusDraft
+	require.NoError(t, f.games.Save(context.Background(), rec))
+
+	_, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: publicGameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleBelowMinPlayersConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.addGame(t, publicGameID, game.GameTypePublic, "", 3)
+	f.addActiveMember(t, "membership-1", publicGameID, "user-a")
+	f.addActiveMember(t, "membership-2", publicGameID, "user-b")
+
+	_, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: publicGameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+
+	current, err := f.games.Get(context.Background(), publicGameID)
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusEnrollmentOpen, current.Status)
+	assert.Empty(t, f.intents.Published())
+}
+
+func TestHandleEmptyInvitesProducesNoNotifications(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.addGame(t, privateGameID, game.GameTypePrivate, ownerUserID, 2)
+	f.addActiveMember(t, "membership-1", privateGameID, "user-a")
+	f.addActiveMember(t, "membership-2", privateGameID, "user-b")
+
+	_, err := f.newService(t).Handle(context.Background(), manualreadytostart.Input{
+		Actor:  shared.NewUserActor(ownerUserID),
+		GameID: privateGameID,
+	})
+	require.NoError(t, err)
+	assert.Empty(t, f.intents.Published())
+}

lobby/internal/service/openenrollment/service.go

@@ -0,0 +1,151 @@
+// Package openenrollment implements the `lobby.game.open_enrollment`
+// message type. It transitions a game record from `draft` to
+// `enrollment_open` after enforcing admin-or-owner authorization.
+package openenrollment
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the open-enrollment use case.
+type Service struct {
+	games     ports.GameStore
+	clock     func() time.Time
+	logger    *slog.Logger
+	telemetry *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games mediates the CAS status transition and the result read.
+	Games ports.GameStore
+
+	// Clock supplies the wall-clock used for UpdatedAt. Defaults to
+	// time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.game.transitions` counter on each
+	// successful enrollment open. Optional; nil disables metric
+	// emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Games == nil {
+		return nil, errors.New("new open enrollment service: nil game store")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:     deps.Games,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.openenrollment"),
+		telemetry: deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to open enrollment on one game.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, transitions the record to
+// `enrollment_open`, and returns the post-transition snapshot.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("open enrollment: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("open enrollment: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("open enrollment: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("open enrollment: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("open enrollment: %w", err)
+	}
+
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+
+	at := service.clock().UTC()
+	err = service.games.UpdateStatus(ctx, ports.UpdateStatusInput{
+		GameID:       input.GameID,
+		ExpectedFrom: game.StatusDraft,
+		To:           game.StatusEnrollmentOpen,
+		Trigger:      game.TriggerCommand,
+		At:           at,
+	})
+	if err != nil {
+		return game.Game{}, fmt.Errorf("open enrollment: %w", err)
+	}
+
+	service.telemetry.RecordGameTransition(ctx,
+		string(game.StatusDraft),
+		string(game.StatusEnrollmentOpen),
+		string(game.TriggerCommand),
+	)
+
+	updated, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("open enrollment: %w", err)
+	}
+
+	logArgs := []any{
+		"game_id", updated.GameID.String(),
+		"from_status", string(game.StatusDraft),
+		"to_status", string(updated.Status),
+		"trigger", string(game.TriggerCommand),
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "game enrollment opened", logArgs...)
+
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to open enrollment on game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/openenrollment/service_test.go

@@ -0,0 +1,229 @@
+package openenrollment_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/openenrollment"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+func seedDraftGame(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	now time.Time,
+) game.Game {
+	t.Helper()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+
+	return record
+}
+
+func newService(t *testing.T, store ports.GameStore, clock func() time.Time) *openenrollment.Service {
+	t.Helper()
+
+	svc, err := openenrollment.NewService(openenrollment.Dependencies{
+		Games:  store,
+		Clock:  clock,
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func TestHandleAdminHappyPath(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-alpha", game.GameTypePublic, "", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: "game-alpha",
+	})
+	require.NoError(t, err)
+	require.Equal(t, game.StatusEnrollmentOpen, updated.Status)
+	require.Equal(t, now.Add(time.Hour).UTC(), updated.UpdatedAt)
+}
+
+func TestHandleOwnerHappyPath(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-p", game.GameTypePrivate, "user-1", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewUserActor("user-1"),
+		GameID: "game-p",
+	})
+	require.NoError(t, err)
+	require.Equal(t, game.StatusEnrollmentOpen, updated.Status)
+}
+
+func TestHandleNonOwnerForbidden(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-p", game.GameTypePrivate, "user-1", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewUserActor("user-2"),
+		GameID: "game-p",
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleUserCannotOpenPublicGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-pub", game.GameTypePublic, "", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewUserActor("user-1"),
+		GameID: "game-pub",
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleFromEnrollmentOpenConflict(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedDraftGame(t, store, "game-x", game.GameTypePublic, "", now)
+	require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateStatusInput{
+		GameID:       record.GameID,
+		ExpectedFrom: game.StatusDraft,
+		To:           game.StatusEnrollmentOpen,
+		Trigger:      game.TriggerCommand,
+		At:           now.Add(5 * time.Minute),
+	}))
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleFromReadyToStartInvalidTransition(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedDraftGame(t, store, "game-rts", game.GameTypePublic, "", now)
+	require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateStatusInput{
+		GameID:       record.GameID,
+		ExpectedFrom: game.StatusDraft,
+		To:           game.StatusEnrollmentOpen,
+		Trigger:      game.TriggerCommand,
+		At:           now.Add(5 * time.Minute),
+	}))
+	require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateStatusInput{
+		GameID:       record.GameID,
+		ExpectedFrom: game.StatusEnrollmentOpen,
+		To:           game.StatusReadyToStart,
+		Trigger:      game.TriggerManual,
+		At:           now.Add(10 * time.Minute),
+	}))
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	// ExpectedFrom=draft but actual=ready_to_start → conflict via CAS.
+	_, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleNotFound(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: "game-missing",
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestHandleInvalidActor(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.Actor{Kind: shared.ActorKindUser},
+		GameID: "game-x",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestHandleInvalidGameID(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), openenrollment.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: "bad-id",
+	})
+	require.Error(t, err)
+}

lobby/internal/service/pausegame/service.go

@@ -0,0 +1,156 @@
+// Package pausegame implements the `lobby.game.pause` message type. It
+// transitions a `running` game to `paused` after enforcing
+// admin-or-owner authorization. The transition uses the
+// `command` trigger; no Game Master call, no notification, no
+// reservation side effects.
+package pausegame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the pause-game use case.
+type Service struct {
+	games     ports.GameStore
+	clock     func() time.Time
+	logger    *slog.Logger
+	telemetry *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games mediates the CAS status transition and the result read.
+	Games ports.GameStore
+
+	// Clock supplies the wall-clock used for UpdatedAt. Defaults to
+	// time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.game.transitions` counter on each
+	// successful pause. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Games == nil {
+		return nil, errors.New("new pause game service: nil game store")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:     deps.Games,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.pausegame"),
+		telemetry: deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to pause one game.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, asserts the source status is
+// `running`, transitions the record to `paused`, and returns the
+// post-transition snapshot.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("pause game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("pause game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("pause game: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("pause game: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("pause game: %w", err)
+	}
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+	if record.Status != game.StatusRunning {
+		return game.Game{}, fmt.Errorf(
+			"pause game: status %q is not %q: %w",
+			record.Status, game.StatusRunning, game.ErrConflict,
+		)
+	}
+
+	at := service.clock().UTC()
+	if err := service.games.UpdateStatus(ctx, ports.UpdateStatusInput{
+		GameID:       input.GameID,
+		ExpectedFrom: game.StatusRunning,
+		To:           game.StatusPaused,
+		Trigger:      game.TriggerCommand,
+		At:           at,
+	}); err != nil {
+		return game.Game{}, fmt.Errorf("pause game: %w", err)
+	}
+
+	service.telemetry.RecordGameTransition(ctx,
+		string(game.StatusRunning),
+		string(game.StatusPaused),
+		string(game.TriggerCommand),
+	)
+
+	updated, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("pause game: %w", err)
+	}
+
+	logArgs := []any{
+		"game_id", updated.GameID.String(),
+		"from_status", string(game.StatusRunning),
+		"to_status", string(updated.Status),
+		"trigger", string(game.TriggerCommand),
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "game paused", logArgs...)
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to pause game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/pausegame/service_test.go

@@ -0,0 +1,235 @@
+package pausegame_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/pausegame"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+// seedGameWithStatus persists a fresh game and, when wanted differs from
+// `draft`, overwrites the Status field directly via Save. This bypasses
+// the transition gate so individual tests can exercise pause against
+// any source status.
+func seedGameWithStatus(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	status game.Status,
+	now time.Time,
+) game.Game {
+	t.Helper()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "test pause game",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = now.Add(time.Minute)
+		if status == game.StatusRunning || status == game.StatusPaused ||
+			status == game.StatusFinished {
+			startedAt := now.Add(time.Minute)
+			record.StartedAt = &startedAt
+		}
+		if status == game.StatusFinished {
+			finishedAt := now.Add(2 * time.Minute)
+			record.FinishedAt = &finishedAt
+		}
+	}
+	require.NoError(t, store.Save(context.Background(), record))
+
+	return record
+}
+
+func newService(t *testing.T, store ports.GameStore, clock func() time.Time) *pausegame.Service {
+	t.Helper()
+
+	svc, err := pausegame.NewService(pausegame.Dependencies{
+		Games:  store,
+		Clock:  clock,
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+
+	_, err := pausegame.NewService(pausegame.Dependencies{})
+	require.Error(t, err)
+}
+
+func TestPauseGameAdminHappyPath(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-pub", game.GameTypePublic, "", game.StatusRunning, now)
+
+	at := now.Add(time.Hour)
+	service := newService(t, store, fixedClock(at))
+
+	updated, err := service.Handle(context.Background(), pausegame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusPaused, updated.Status)
+	assert.Equal(t, at.UTC(), updated.UpdatedAt)
+}
+
+func TestPauseGamePrivateOwnerHappyPath(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-priv", game.GameTypePrivate, "user-owner", game.StatusRunning, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), pausegame.Input{
+		Actor:  shared.NewUserActor("user-owner"),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusPaused, updated.Status)
+}
+
+func TestPauseGameRejectsNonOwnerUser(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-priv", game.GameTypePrivate, "user-owner", game.StatusRunning, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), pausegame.Input{
+		Actor:  shared.NewUserActor("user-other"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestPauseGameRejectsUserActorOnPublicGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-pub", game.GameTypePublic, "", game.StatusRunning, now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), pausegame.Input{
+		Actor:  shared.NewUserActor("user-x"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestPauseGameRejectsWrongStatuses(t *testing.T) {
+	t.Parallel()
+
+	statuses := []game.Status{
+		game.StatusDraft,
+		game.StatusEnrollmentOpen,
+		game.StatusReadyToStart,
+		game.StatusStarting,
+		game.StatusStartFailed,
+		game.StatusPaused,
+		game.StatusFinished,
+		game.StatusCancelled,
+	}
+
+	for _, status := range statuses {
+		t.Run(string(status), func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+			store := gamestub.NewStore()
+			record := seedGameWithStatus(t, store, "game-x", game.GameTypePublic, "", status, now)
+
+			service := newService(t, store, fixedClock(now.Add(time.Hour)))
+			_, err := service.Handle(context.Background(), pausegame.Input{
+				Actor:  shared.NewAdminActor(),
+				GameID: record.GameID,
+			})
+			require.ErrorIs(t, err, game.ErrConflict)
+		})
+	}
+}
+
+func TestPauseGameRejectsMissingRecord(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), pausegame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: common.GameID("game-missing"),
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestPauseGameInvalidActor(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), pausegame.Input{
+		Actor:  shared.Actor{Kind: shared.ActorKindUser},
+		GameID: "game-x",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestPauseGameInvalidGameID(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), pausegame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: "bad",
+	})
+	require.Error(t, err)
+}

lobby/internal/service/redeeminvite/service.go

@@ -0,0 +1,357 @@
+// Package redeeminvite implements the `lobby.invite.redeem` message type. It
+// validates the invitee against the private-game enrollment rules, reserves
+// the chosen race name, transitions the invite from created to redeemed,
+// creates the matching active membership, opens the gap window when the new
+// approved count equals max_players, and publishes the
+// `lobby.invite.redeemed` notification intent to the private-game owner.
+package redeeminvite
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+	"galaxy/notificationintent"
+)
+
+// Service executes the private-game invite redemption use case.
+type Service struct {
+	games       ports.GameStore
+	invites     ports.InviteStore
+	memberships ports.MembershipStore
+	directory   ports.RaceNameDirectory
+	users       ports.UserService
+	gapStore    ports.GapActivationStore
+	intents     ports.IntentPublisher
+	ids         ports.IDGenerator
+	clock       func() time.Time
+	logger      *slog.Logger
+	telemetry   *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the target game record for status verification and the
+	// owner notification recipient.
+	Games ports.GameStore
+
+	// Invites loads the target invite and applies the
+	// created → redeemed transition.
+	Invites ports.InviteStore
+
+	// Memberships persists the new active membership and supplies the
+	// approved-count for the gap-window decision and capacity guard.
+	Memberships ports.MembershipStore
+
+	// Directory canonicalizes the race name and reserves it for the
+	// invitee.
+	Directory ports.RaceNameDirectory
+
+	// Users resolves the synchronous eligibility snapshot for both the
+	// inviter and the invitee. uses it to short-circuit
+	// redemption when either party has been permanently blocked or
+	// soft-deleted between invite creation and the redeem attempt.
+	Users ports.UserService
+
+	// GapStore records the gap-window activation timestamp when the new
+	// approved count equals max_players.
+	GapStore ports.GapActivationStore
+
+	// Intents publishes the lobby.invite.redeemed intent to the owner.
+	Intents ports.IntentPublisher
+
+	// IDs mints the new opaque membership identifier.
+	IDs ports.IDGenerator
+
+	// Clock supplies the wall-clock used for DecidedAt, JoinedAt,
+	// gap-activation time, and the notification's OccurredAt.
+	Clock func() time.Time
+
+	// Logger records structured service-level events.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.invite.outcomes` and
+	// `lobby.membership.changes` counters. Optional; nil disables
+	// metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new redeem invite service: nil game store")
+	case deps.Invites == nil:
+		return nil, errors.New("new redeem invite service: nil invite store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new redeem invite service: nil membership store")
+	case deps.Directory == nil:
+		return nil, errors.New("new redeem invite service: nil race name directory")
+	case deps.Users == nil:
+		return nil, errors.New("new redeem invite service: nil user service")
+	case deps.GapStore == nil:
+		return nil, errors.New("new redeem invite service: nil gap activation store")
+	case deps.Intents == nil:
+		return nil, errors.New("new redeem invite service: nil intent publisher")
+	case deps.IDs == nil:
+		return nil, errors.New("new redeem invite service: nil id generator")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:       deps.Games,
+		invites:     deps.Invites,
+		memberships: deps.Memberships,
+		directory:   deps.Directory,
+		users:       deps.Users,
+		gapStore:    deps.GapStore,
+		intents:     deps.Intents,
+		ids:         deps.IDs,
+		clock:       clock,
+		logger:      logger.With("service", "lobby.redeeminvite"),
+		telemetry:   deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to redeem one invite.
+type Input struct {
+	// Actor identifies the caller. Must be the invitee.
+	Actor shared.Actor
+
+	// GameID identifies the game referenced by the request path; it must
+	// match the loaded invite's GameID.
+	GameID common.GameID
+
+	// InviteID identifies the target invite.
+	InviteID common.InviteID
+
+	// RaceName stores the desired in-game name in original casing.
+	RaceName string
+}
+
+// Handle authorizes the invitee, validates the invite + game state, reserves
+// the race name, transitions the invite, persists the active membership,
+// opens the gap window if appropriate, and publishes the
+// lobby.invite.redeemed intent on success.
+func (service *Service) Handle(ctx context.Context, input Input) (membership.Membership, error) {
+	if service == nil {
+		return membership.Membership{}, errors.New("redeem invite: nil service")
+	}
+	if ctx == nil {
+		return membership.Membership{}, errors.New("redeem invite: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return membership.Membership{}, fmt.Errorf(
+			"%w: only the invited user may redeem an invite",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+	if err := input.InviteID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+
+	inv, err := service.invites.Get(ctx, input.InviteID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+	if inv.GameID != input.GameID {
+		// Defensive: opaque ids must not leak across games.
+		return membership.Membership{}, fmt.Errorf(
+			"redeem invite: invite %q does not belong to game %q: %w",
+			inv.InviteID, input.GameID, invite.ErrNotFound,
+		)
+	}
+	if inv.InviteeUserID != input.Actor.UserID {
+		return membership.Membership{}, fmt.Errorf(
+			"%w: invite is addressed to a different user",
+			shared.ErrForbidden,
+		)
+	}
+	if inv.Status != invite.StatusCreated {
+		return membership.Membership{}, fmt.Errorf(
+			"redeem invite: status %q is not %q: %w",
+			inv.Status, invite.StatusCreated, invite.ErrConflict,
+		)
+	}
+
+	gameRecord, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+	if gameRecord.GameType != game.GameTypePrivate {
+		return membership.Membership{}, fmt.Errorf(
+			"redeem invite: game %q is not private: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+	if gameRecord.Status != game.StatusEnrollmentOpen {
+		return membership.Membership{}, fmt.Errorf(
+			"redeem invite: game %q is not in enrollment_open: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+
+	// cascade guard: a permanent_block or DeleteUser on the
+	// inviter or the invitee makes the invite untusable. Return
+	// subject_not_found so the caller sees the same outcome as if the
+	// invite never existed, even when the user-lifecycle cascade has
+	// not yet flipped the invite to revoked.
+	if err := service.requireActiveParty(ctx, inv.InviterUserID, "inviter"); err != nil {
+		return membership.Membership{}, err
+	}
+	if err := service.requireActiveParty(ctx, input.Actor.UserID, "invitee"); err != nil {
+		return membership.Membership{}, err
+	}
+
+	cap := gameRecord.MaxPlayers + gameRecord.StartGapPlayers
+	currentActive, err := shared.CountActiveMemberships(ctx, service.memberships, gameRecord.GameID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+	if currentActive >= cap {
+		return membership.Membership{}, fmt.Errorf(
+			"redeem invite: roster full (%d active >= %d cap): %w",
+			currentActive, cap, game.ErrConflict,
+		)
+	}
+
+	canonical, err := service.directory.Canonicalize(input.RaceName)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+
+	if err := service.directory.Reserve(ctx, gameRecord.GameID.String(), input.Actor.UserID, input.RaceName); err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+
+	now := service.clock().UTC()
+	updateErr := service.invites.UpdateStatus(ctx, ports.UpdateInviteStatusInput{
+		InviteID:     inv.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusRedeemed,
+		At:           now,
+		RaceName:     input.RaceName,
+	})
+	if updateErr != nil {
+		// Concurrent mutation lost the CAS race. Release the
+		// reservation we just made so it does not orphan; the user
+		// may retry redeem later under the same canonical key.
+		if releaseErr := service.directory.ReleaseReservation(ctx, gameRecord.GameID.String(), input.Actor.UserID, input.RaceName); releaseErr != nil {
+			service.logger.WarnContext(ctx, "release reservation after redeem cas failure",
+				"invite_id", inv.InviteID.String(),
+				"err", releaseErr.Error(),
+			)
+		}
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", updateErr)
+	}
+
+	membershipID, err := service.ids.NewMembershipID()
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+	memberRecord, err := membership.New(membership.NewMembershipInput{
+		MembershipID: membershipID,
+		GameID:       gameRecord.GameID,
+		UserID:       input.Actor.UserID,
+		RaceName:     input.RaceName,
+		CanonicalKey: canonical,
+		Now:          now,
+	})
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+	if err := service.memberships.Save(ctx, memberRecord); err != nil {
+		return membership.Membership{}, fmt.Errorf("redeem invite: %w", err)
+	}
+
+	// Gap-window trigger: count after Save now includes the new
+	// membership, so if it equals max_players we just crossed the
+	// threshold. The worker reads gap_activated_at to time
+	// out the gap; auto-transition to ready_to_start is its job.
+	if currentActive+1 == gameRecord.MaxPlayers {
+		if err := service.gapStore.MarkActivated(ctx, gameRecord.GameID, now); err != nil {
+			service.logger.WarnContext(ctx, "mark gap activation",
+				"game_id", gameRecord.GameID.String(),
+				"err", err.Error(),
+			)
+		}
+	}
+
+	intent, err := notificationintent.NewLobbyInviteRedeemedIntent(
+		notificationintent.Metadata{
+			IdempotencyKey: "lobby.invite.redeemed:" + inv.InviteID.String(),
+			OccurredAt:     now,
+		},
+		gameRecord.OwnerUserID,
+		notificationintent.LobbyInviteRedeemedPayload{
+			GameID:        gameRecord.GameID.String(),
+			GameName:      gameRecord.GameName,
+			InviteeUserID: memberRecord.UserID,
+			InviteeName:   memberRecord.RaceName,
+		},
+	)
+	if err != nil {
+		service.logger.ErrorContext(ctx, "build invite redeemed intent",
+			"invite_id", inv.InviteID.String(),
+			"err", err.Error(),
+		)
+	} else if _, publishErr := service.intents.Publish(ctx, intent); publishErr != nil {
+		service.logger.WarnContext(ctx, "publish invite redeemed intent",
+			"invite_id", inv.InviteID.String(),
+			"err", publishErr.Error(),
+		)
+	}
+
+	service.telemetry.RecordInviteOutcome(ctx, "redeemed")
+	service.telemetry.RecordMembershipChange(ctx, "activated")
+
+	logArgs := []any{
+		"game_id", gameRecord.GameID.String(),
+		"game_status", string(gameRecord.Status),
+		"invite_id", inv.InviteID.String(),
+		"membership_id", memberRecord.MembershipID.String(),
+		"user_id", memberRecord.UserID,
+		"race_name", memberRecord.RaceName,
+		"canonical_key", string(memberRecord.CanonicalKey),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "invite redeemed", logArgs...)
+	return memberRecord, nil
+}
+
+// requireActiveParty fetches the eligibility snapshot for userID and
+// returns shared.ErrSubjectNotFound when the user no longer exists or
+// has been permanently blocked. Transport failures wrap
+// shared.ErrServiceUnavailable so the caller can map to HTTP 503.
+func (service *Service) requireActiveParty(ctx context.Context, userID, role string) error {
+	eligibility, err := service.users.GetEligibility(ctx, userID)
+	if err != nil {
+		return fmt.Errorf("redeem invite: %w of %s: %w", shared.ErrServiceUnavailable, role, err)
+	}
+	if !eligibility.Exists || eligibility.PermanentBlocked {
+		return fmt.Errorf("redeem invite: %s no longer active: %w", role, shared.ErrSubjectNotFound)
+	}
+	return nil
+}

lobby/internal/service/redeeminvite/service_test.go

@@ -0,0 +1,471 @@
+package redeeminvite_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/gapactivationstub"
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/adapters/userservicestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/redeeminvite"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	ownerUserID   = "user-owner"
+	inviteeUserID = "user-invitee"
+	defaultRace   = "VoidRunner"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixedIDs struct {
+	membershipID common.MembershipID
+}
+
+func (f fixedIDs) NewGameID() (common.GameID, error)               { return "", errors.New("not used") }
+func (f fixedIDs) NewApplicationID() (common.ApplicationID, error) { return "", errors.New("not used") }
+func (f fixedIDs) NewInviteID() (common.InviteID, error)           { return "", errors.New("not used") }
+func (f fixedIDs) NewMembershipID() (common.MembershipID, error)   { return f.membershipID, nil }
+
+type fixture struct {
+	now         time.Time
+	games       *gamestub.Store
+	invites     *invitestub.Store
+	memberships *membershipstub.Store
+	directory   *racenamestub.Directory
+	users       *userservicestub.Service
+	gapStore    *gapactivationstub.Store
+	intents     *intentpubstub.Publisher
+	ids         fixedIDs
+	game        game.Game
+}
+
+func newFixture(t *testing.T, maxPlayers, gapPlayers int) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	dir, err := racenamestub.NewDirectory(racenamestub.WithClock(fixedClock(now)))
+	require.NoError(t, err)
+	games := gamestub.NewStore()
+	invites := invitestub.NewStore()
+	memberships := membershipstub.NewStore()
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              "game-private",
+		GameName:            "Friends Only",
+		GameType:            game.GameTypePrivate,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          maxPlayers,
+		StartGapHours:       2,
+		StartGapPlayers:     gapPlayers,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusEnrollmentOpen
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	users := userservicestub.NewService()
+	activeEligibility := ports.Eligibility{
+		Exists:               true,
+		CanLogin:             true,
+		CanCreatePrivateGame: true,
+		CanManagePrivateGame: true,
+		CanJoinGame:          true,
+		CanUpdateProfile:     true,
+	}
+	users.SetEligibility(ownerUserID, activeEligibility)
+	users.SetEligibility(inviteeUserID, activeEligibility)
+
+	return &fixture{
+		now:         now,
+		games:       games,
+		invites:     invites,
+		memberships: memberships,
+		directory:   dir,
+		users:       users,
+		gapStore:    gapactivationstub.NewStore(),
+		intents:     intentpubstub.NewPublisher(),
+		ids:         fixedIDs{membershipID: "membership-fixed"},
+		game:        gameRecord,
+	}
+}
+
+func newService(t *testing.T, f *fixture) *redeeminvite.Service {
+	t.Helper()
+	svc, err := redeeminvite.NewService(redeeminvite.Dependencies{
+		Games:       f.games,
+		Invites:     f.invites,
+		Memberships: f.memberships,
+		Directory:   f.directory,
+		Users:       f.users,
+		GapStore:    f.gapStore,
+		Intents:     f.intents,
+		IDs:         f.ids,
+		Clock:       fixedClock(f.now),
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func seedCreatedInvite(t *testing.T, f *fixture, inviteID common.InviteID, invitee string) invite.Invite {
+	t.Helper()
+	inv, err := invite.New(invite.NewInviteInput{
+		InviteID:      inviteID,
+		GameID:        f.game.GameID,
+		InviterUserID: ownerUserID,
+		InviteeUserID: invitee,
+		Now:           f.now,
+		ExpiresAt:     f.game.EnrollmentEndsAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.invites.Save(context.Background(), inv))
+	return inv
+}
+
+func defaultInput(f *fixture, inv invite.Invite) redeeminvite.Input {
+	return redeeminvite.Input{
+		Actor:    shared.NewUserActor(inviteeUserID),
+		GameID:   f.game.GameID,
+		InviteID: inv.InviteID,
+		RaceName: defaultRace,
+	}
+}
+
+func TestRedeemHappyPath(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.NoError(t, err)
+	assert.Equal(t, common.MembershipID("membership-fixed"), got.MembershipID)
+	assert.Equal(t, defaultRace, got.RaceName)
+	assert.Equal(t, "voidrunner", got.CanonicalKey)
+	assert.Equal(t, membership.StatusActive, got.Status)
+	assert.Equal(t, f.now, got.JoinedAt)
+	assert.Equal(t, inviteeUserID, got.UserID)
+
+	updated, err := f.invites.Get(context.Background(), inv.InviteID)
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusRedeemed, updated.Status)
+	assert.Equal(t, defaultRace, updated.RaceName)
+	require.NotNil(t, updated.DecidedAt)
+
+	avail, err := f.directory.Check(context.Background(), defaultRace, "user-other")
+	require.NoError(t, err)
+	assert.True(t, avail.Taken)
+	assert.Equal(t, inviteeUserID, avail.HolderUserID)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	assert.Equal(t, notificationintent.NotificationTypeLobbyInviteRedeemed, intents[0].NotificationType)
+	assert.Equal(t, []string{ownerUserID}, intents[0].RecipientUserIDs)
+	assert.Contains(t, intents[0].PayloadJSON, `"invitee_name":"`+defaultRace+`"`)
+
+	assert.False(t, f.gapStore.WasActivated(f.game.GameID))
+}
+
+func TestRedeemRejectsInviterPermanentBlock(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	f.users.SetEligibility(ownerUserID, ports.Eligibility{
+		Exists:           true,
+		PermanentBlocked: true,
+	})
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, shared.ErrSubjectNotFound)
+
+	updated, err := f.invites.Get(context.Background(), inv.InviteID)
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusCreated, updated.Status, "invite must remain unchanged on aborted redeem")
+}
+
+func TestRedeemRejectsInviteePermanentBlock(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	f.users.SetEligibility(inviteeUserID, ports.Eligibility{
+		Exists:           true,
+		PermanentBlocked: true,
+	})
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, shared.ErrSubjectNotFound)
+}
+
+func TestRedeemRejectsDeletedInviter(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	f.users.SetEligibility(ownerUserID, ports.Eligibility{Exists: false})
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, shared.ErrSubjectNotFound)
+}
+
+func TestRedeemSurfacesUserServiceTransportFailure(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	f.users.SetFailure(ownerUserID, ports.ErrUserServiceUnavailable)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, shared.ErrServiceUnavailable)
+}
+
+func TestRedeemActivatesGapAtMaxPlayers(t *testing.T) {
+	t.Parallel()
+	// max=2, gap=1; pre-seed 1 active member. Redeem pushes count to 2 (== max).
+	f := newFixture(t, 2, 1)
+	preexisting, err := membership.New(membership.NewMembershipInput{
+		MembershipID: "membership-pre",
+		GameID:       f.game.GameID,
+		UserID:       "user-pre",
+		RaceName:     "PriorMember",
+		CanonicalKey: "priormember",
+		Now:          f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), preexisting))
+
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err = svc.Handle(context.Background(), defaultInput(f, inv))
+	require.NoError(t, err)
+	assert.True(t, f.gapStore.WasActivated(f.game.GameID))
+	assert.Equal(t, f.now, f.gapStore.ActivatedAt(f.game.GameID))
+}
+
+func TestRedeemDoesNotActivateGapBelowMax(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.NoError(t, err)
+	assert.False(t, f.gapStore.WasActivated(f.game.GameID))
+}
+
+func TestRedeemAdminActorForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	in := defaultInput(f, inv)
+	in.Actor = shared.NewAdminActor()
+
+	_, err := svc.Handle(context.Background(), in)
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRedeemNonInviteeForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	in := defaultInput(f, inv)
+	in.Actor = shared.NewUserActor("user-impostor")
+
+	_, err := svc.Handle(context.Background(), in)
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRedeemInviteNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), redeeminvite.Input{
+		Actor:    shared.NewUserActor(inviteeUserID),
+		GameID:   f.game.GameID,
+		InviteID: "invite-missing",
+		RaceName: defaultRace,
+	})
+	require.ErrorIs(t, err, invite.ErrNotFound)
+}
+
+func TestRedeemCrossGameInviteNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	in := defaultInput(f, inv)
+	in.GameID = "game-other"
+
+	_, err := svc.Handle(context.Background(), in)
+	require.ErrorIs(t, err, invite.ErrNotFound)
+}
+
+func TestRedeemAlreadyRedeemedConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	require.NoError(t, f.invites.UpdateStatus(context.Background(), ports.UpdateInviteStatusInput{
+		InviteID:     inv.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusDeclined,
+		At:           f.now,
+	}))
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, invite.ErrConflict)
+}
+
+func TestRedeemGameNotEnrollmentOpenConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+
+	rec, err := f.games.Get(context.Background(), f.game.GameID)
+	require.NoError(t, err)
+	rec.Status = game.StatusReadyToStart
+	require.NoError(t, f.games.Save(context.Background(), rec))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestRedeemRosterFullConflict(t *testing.T) {
+	t.Parallel()
+	// Capacity = max(2) + gap(1) = 3; seed 3 active members.
+	f := newFixture(t, 2, 1)
+	for i := range 3 {
+		member, err := membership.New(membership.NewMembershipInput{
+			MembershipID: common.MembershipID("membership-seed-" + string(rune('a'+i))),
+			GameID:       f.game.GameID,
+			UserID:       "seed-user-" + string(rune('a'+i)),
+			RaceName:     "Seed " + string(rune('A'+i)),
+			CanonicalKey: "seed" + string(rune('a'+i)),
+			Now:          f.now,
+		})
+		require.NoError(t, err)
+		require.NoError(t, f.memberships.Save(context.Background(), member))
+	}
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestRedeemNameTakenByAnotherUser(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	require.NoError(t, f.directory.Reserve(context.Background(), "game-other", "user-other", defaultRace))
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, ports.ErrNameTaken)
+}
+
+func TestRedeemInvalidRaceName(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	in := defaultInput(f, inv)
+	in.RaceName = "   "
+
+	_, err := svc.Handle(context.Background(), in)
+	require.ErrorIs(t, err, ports.ErrInvalidName)
+}
+
+// redeemCASStub wraps invitestub.Store but injects ErrConflict on the next
+// UpdateStatus call so we can observe the rollback path.
+type redeemCASStub struct {
+	*invitestub.Store
+	failNext bool
+}
+
+func (s *redeemCASStub) UpdateStatus(ctx context.Context, input ports.UpdateInviteStatusInput) error {
+	if s.failNext {
+		s.failNext = false
+		return invite.ErrConflict
+	}
+	return s.Store.UpdateStatus(ctx, input)
+}
+
+func TestRedeemCASConflictReleasesReservation(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+
+	cas := &redeemCASStub{Store: f.invites, failNext: true}
+	svc, err := redeeminvite.NewService(redeeminvite.Dependencies{
+		Games:       f.games,
+		Invites:     cas,
+		Memberships: f.memberships,
+		Directory:   f.directory,
+		Users:       f.users,
+		GapStore:    f.gapStore,
+		Intents:     f.intents,
+		IDs:         f.ids,
+		Clock:       fixedClock(f.now),
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+
+	_, err = svc.Handle(context.Background(), defaultInput(f, inv))
+	require.ErrorIs(t, err, invite.ErrConflict)
+
+	avail, err := f.directory.Check(context.Background(), defaultRace, "user-other")
+	require.NoError(t, err)
+	assert.False(t, avail.Taken, "reservation must be released after CAS failure")
+	assert.Empty(t, avail.HolderUserID)
+}
+
+func TestRedeemPublishFailureDoesNotRollback(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t, 4, 1)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	f.intents.SetError(errors.New("publish failed"))
+
+	svc := newService(t, f)
+	got, err := svc.Handle(context.Background(), defaultInput(f, inv))
+	require.NoError(t, err)
+	assert.Equal(t, common.MembershipID("membership-fixed"), got.MembershipID)
+
+	updated, err := f.invites.Get(context.Background(), inv.InviteID)
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusRedeemed, updated.Status)
+}

lobby/internal/service/registerracename/service.go

@@ -0,0 +1,283 @@
+// Package registerracename implements the `lobby.race_name.register`
+// message type. It converts an active `pending_registration` Race Name
+// Directory entry, produced by capability evaluation at game
+// finish, into a permanent registered race name owned by the calling
+// user. The service enforces the eligibility snapshot
+// (`PermanentBlocked`, `MaxRegisteredRaceNames`), delegates atomic
+// commit to `RaceNameDirectory.Register`, and publishes a
+// `lobby.race_name.registered` notification intent on success.
+//
+// The 30-day pending window, capable-finish requirement, and one-name
+// idempotency are all the directory's responsibility (see
+// `lobby/README.md` §Reservation lifecycle and capability). This
+// service only adds the user-facing layer: actor authorization, quota
+// enforcement, and intent publication.
+package registerracename
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+)
+
+// Service executes the race-name registration use case.
+type Service struct {
+	directory ports.RaceNameDirectory
+	users     ports.UserService
+	intents   ports.IntentPublisher
+	clock     func() time.Time
+	logger    *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Directory atomically converts the pending entry into a registered
+	// race name. The service consults ListRegistered for the quota
+	// pre-check and idempotent-retry detection.
+	Directory ports.RaceNameDirectory
+
+	// Users supplies the lobby-relevant eligibility snapshot used to
+	// gate `PermanentBlocked` and `MaxRegisteredRaceNames`.
+	Users ports.UserService
+
+	// Intents publishes the lobby.race_name.registered intent on
+	// successful commit. The service treats publication failure as a
+	// notification-degradation signal: the intent is logged at warn but
+	// the registration result is returned successfully (README
+	// §Notification Contracts).
+	Intents ports.IntentPublisher
+
+	// Clock supplies the wall-clock used to anchor the published
+	// intent's `OccurredAt` and the fallback `RegisteredAtMs` of the
+	// returned record. Defaults to time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Directory == nil:
+		return nil, errors.New("new register race name service: nil race name directory")
+	case deps.Users == nil:
+		return nil, errors.New("new register race name service: nil user service")
+	case deps.Intents == nil:
+		return nil, errors.New("new register race name service: nil intent publisher")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		directory: deps.Directory,
+		users:     deps.Users,
+		intents:   deps.Intents,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.registerracename"),
+	}, nil
+}
+
+// Input stores the arguments required to register one race name.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindUser; admin actors
+	// are rejected because the README catalog scopes
+	// `lobby.race_name.register` to the authenticated user.
+	Actor shared.Actor
+
+	// SourceGameID identifies the game whose capable finish produced
+	// the pending registration that the caller wants to convert.
+	SourceGameID common.GameID
+
+	// RaceName is the original-casing name to register. The directory
+	// canonicalizes and validates it.
+	RaceName string
+}
+
+// Output stores the post-commit registration record returned to the
+// caller. Fields mirror ports.RegisteredName so the HTTP layer can
+// expose the same shape.
+type Output struct {
+	CanonicalKey   string
+	RaceName       string
+	SourceGameID   string
+	RegisteredAtMs int64
+}
+
+// Handle authorizes the actor, gates the eligibility snapshot,
+// short-circuits idempotent retries, enforces the per-tariff quota,
+// commits the registration through the Race Name Directory, and
+// publishes the `lobby.race_name.registered` intent on success.
+func (service *Service) Handle(ctx context.Context, input Input) (Output, error) {
+	if service == nil {
+		return Output{}, errors.New("register race name: nil service")
+	}
+	if ctx == nil {
+		return Output{}, errors.New("register race name: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return Output{}, fmt.Errorf("register race name: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return Output{}, fmt.Errorf(
+			"%w: only authenticated user actors may register a race name",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.SourceGameID.Validate(); err != nil {
+		return Output{}, fmt.Errorf("register race name: %w", err)
+	}
+	raceName := strings.TrimSpace(input.RaceName)
+	if raceName == "" {
+		return Output{}, fmt.Errorf("register race name: race name must not be empty")
+	}
+
+	canonical, err := service.directory.Canonicalize(raceName)
+	if err != nil {
+		return Output{}, fmt.Errorf("register race name: %w", err)
+	}
+
+	eligibility, err := service.users.GetEligibility(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("register race name: %w", err)
+	}
+	if !eligibility.Exists {
+		return Output{}, fmt.Errorf("register race name: user %q: %w",
+			input.Actor.UserID, shared.ErrSubjectNotFound)
+	}
+	if eligibility.PermanentBlocked {
+		return Output{}, fmt.Errorf(
+			"%w: user %q carries an active permanent_block sanction",
+			shared.ErrForbidden, input.Actor.UserID,
+		)
+	}
+
+	registered, err := service.directory.ListRegistered(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("register race name: %w", err)
+	}
+	sourceGameIDStr := input.SourceGameID.String()
+	if existing, ok := findExistingRegistration(registered, sourceGameIDStr, canonical); ok {
+		// Idempotent retry: the same caller is replaying the same
+		// register call after a previous success. Re-publish the
+		// intent (consumer dedupes on the stable idempotency key) and
+		// return the existing record.
+		out := Output{
+			CanonicalKey:   existing.CanonicalKey,
+			RaceName:       existing.RaceName,
+			SourceGameID:   existing.SourceGameID,
+			RegisteredAtMs: existing.RegisteredAtMs,
+		}
+		service.publishRegisteredIntent(ctx, sourceGameIDStr, input.Actor.UserID, existing.RaceName, out.RegisteredAtMs)
+		return out, nil
+	}
+
+	if eligibility.MaxRegisteredRaceNames > 0 && len(registered) >= eligibility.MaxRegisteredRaceNames {
+		return Output{}, fmt.Errorf(
+			"register race name: user %q has %d of %d registered: %w",
+			input.Actor.UserID, len(registered), eligibility.MaxRegisteredRaceNames,
+			ports.ErrQuotaExceeded,
+		)
+	}
+
+	if err := service.directory.Register(ctx, sourceGameIDStr, input.Actor.UserID, raceName); err != nil {
+		return Output{}, fmt.Errorf("register race name: %w", err)
+	}
+
+	registeredAfter, err := service.directory.ListRegistered(ctx, input.Actor.UserID)
+	if err != nil {
+		return Output{}, fmt.Errorf("register race name: load post-commit: %w", err)
+	}
+	out := Output{
+		CanonicalKey: canonical,
+		RaceName:     raceName,
+		SourceGameID: sourceGameIDStr,
+	}
+	if record, ok := findExistingRegistration(registeredAfter, sourceGameIDStr, canonical); ok {
+		out.RaceName = record.RaceName
+		out.RegisteredAtMs = record.RegisteredAtMs
+	} else {
+		// Defensive: the directory should always expose the entry we
+		// just registered. Fall back to the wall-clock so the response
+		// still carries a usable timestamp.
+		out.RegisteredAtMs = service.clock().UTC().UnixMilli()
+	}
+
+	service.publishRegisteredIntent(ctx, sourceGameIDStr, input.Actor.UserID, out.RaceName, out.RegisteredAtMs)
+
+	service.logger.InfoContext(ctx, "race name registered",
+		"user_id", input.Actor.UserID,
+		"source_game_id", sourceGameIDStr,
+		"race_name", out.RaceName,
+		"canonical_key", out.CanonicalKey,
+	)
+	return out, nil
+}
+
+// findExistingRegistration returns the registered entry that matches
+// (sourceGameID, canonicalKey) when one exists.
+func findExistingRegistration(
+	registered []ports.RegisteredName,
+	sourceGameID, canonical string,
+) (ports.RegisteredName, bool) {
+	for _, entry := range registered {
+		if entry.SourceGameID == sourceGameID && entry.CanonicalKey == canonical {
+			return entry, true
+		}
+	}
+	return ports.RegisteredName{}, false
+}
+
+// publishRegisteredIntent builds and publishes the
+// `lobby.race_name.registered` notification intent. Failures are
+// logged at warn level and do not roll back the registration commit
+// (README §Notification Contracts).
+func (service *Service) publishRegisteredIntent(
+	ctx context.Context,
+	sourceGameID, userID, raceName string,
+	registeredAtMs int64,
+) {
+	occurredAt := service.clock().UTC()
+	if registeredAtMs > 0 {
+		occurredAt = time.UnixMilli(registeredAtMs).UTC()
+	}
+	intent, err := notificationintent.NewLobbyRaceNameRegisteredIntent(
+		notificationintent.Metadata{
+			IdempotencyKey: "lobby.race_name.registered:" + sourceGameID + ":" + userID,
+			OccurredAt:     occurredAt,
+		},
+		userID,
+		notificationintent.LobbyRaceNameRegisteredPayload{
+			RaceName: raceName,
+		},
+	)
+	if err != nil {
+		service.logger.ErrorContext(ctx, "build race name registered intent",
+			"user_id", userID,
+			"source_game_id", sourceGameID,
+			"err", err.Error(),
+		)
+		return
+	}
+	if _, err := service.intents.Publish(ctx, intent); err != nil {
+		service.logger.WarnContext(ctx, "publish race name registered intent",
+			"user_id", userID,
+			"source_game_id", sourceGameID,
+			"err", err.Error(),
+		)
+	}
+}

lobby/internal/service/registerracename/service_test.go

@@ -0,0 +1,409 @@
+package registerracename_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/adapters/userservicestub"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/registerracename"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixture struct {
+	now       time.Time
+	directory *racenamestub.Directory
+	users     *userservicestub.Service
+	intents   *intentpubstub.Publisher
+}
+
+func newFixture(t *testing.T, now time.Time) *fixture {
+	t.Helper()
+	directory, err := racenamestub.NewDirectory(racenamestub.WithClock(fixedClock(now)))
+	require.NoError(t, err)
+	return &fixture{
+		now:       now,
+		directory: directory,
+		users:     userservicestub.NewService(),
+		intents:   intentpubstub.NewPublisher(),
+	}
+}
+
+func (f *fixture) newService(t *testing.T) *registerracename.Service {
+	t.Helper()
+	svc, err := registerracename.NewService(registerracename.Dependencies{
+		Directory: f.directory,
+		Users:     f.users,
+		Intents:   f.intents,
+		Clock:     fixedClock(f.now),
+		Logger:    silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+// seedPending creates a pending_registration for (gameID, userID,
+// raceName) with eligibleUntil. It mirrors the production sequence
+// (Reserve at approve-time, MarkPendingRegistration at game finish).
+func (f *fixture) seedPending(
+	t *testing.T,
+	gameID, userID, raceName string,
+	eligibleUntil time.Time,
+) {
+	t.Helper()
+	require.NoError(t, f.directory.Reserve(context.Background(), gameID, userID, raceName))
+	require.NoError(t, f.directory.MarkPendingRegistration(context.Background(), gameID, userID, raceName, eligibleUntil))
+}
+
+// seedRegistered creates an existing registered entry by walking through
+// the full Reserve → MarkPending → Register flow. It is used to grow the
+// `len(registered)` for quota tests.
+func (f *fixture) seedRegistered(t *testing.T, gameID, userID, raceName string) {
+	t.Helper()
+	eligibleUntil := f.now.Add(24 * time.Hour)
+	f.seedPending(t, gameID, userID, raceName, eligibleUntil)
+	require.NoError(t, f.directory.Register(context.Background(), gameID, userID, raceName))
+}
+
+func defaultEligibility(maxRegistered int) ports.Eligibility {
+	return ports.Eligibility{
+		Exists:                 true,
+		CanLogin:               true,
+		CanJoinGame:            true,
+		CanUpdateProfile:       true,
+		MaxRegisteredRaceNames: maxRegistered,
+	}
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+
+	_, err := registerracename.NewService(registerracename.Dependencies{})
+	require.Error(t, err)
+}
+
+func TestRegisterRaceNameHappyPath(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetEligibility("user-1", defaultEligibility(2))
+	f.seedPending(t, "game-1", "user-1", "Stellaris", now.Add(7*24*time.Hour))
+
+	svc := f.newService(t)
+	out, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "game-1", out.SourceGameID)
+	assert.Equal(t, "Stellaris", out.RaceName)
+	expectedCanonical, err := f.directory.Canonicalize("Stellaris")
+	require.NoError(t, err)
+	assert.Equal(t, expectedCanonical, out.CanonicalKey)
+	assert.Equal(t, now.UnixMilli(), out.RegisteredAtMs)
+
+	registered, err := f.directory.ListRegistered(context.Background(), "user-1")
+	require.NoError(t, err)
+	require.Len(t, registered, 1)
+	assert.Equal(t, "game-1", registered[0].SourceGameID)
+
+	pending, err := f.directory.ListPendingRegistrations(context.Background(), "user-1")
+	require.NoError(t, err)
+	assert.Empty(t, pending)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	intent := intents[0]
+	assert.Equal(t, notificationintent.NotificationTypeLobbyRaceNameRegistered, intent.NotificationType)
+	require.Equal(t, []string{"user-1"}, intent.RecipientUserIDs)
+	assert.Equal(t, "lobby.race_name.registered:game-1:user-1", intent.IdempotencyKey)
+	var payload notificationintent.LobbyRaceNameRegisteredPayload
+	require.NoError(t, json.Unmarshal([]byte(intent.PayloadJSON), &payload))
+	assert.Equal(t, "Stellaris", payload.RaceName)
+}
+
+func TestRegisterRaceNameIdempotentRetry(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetEligibility("user-1", defaultEligibility(1))
+	f.seedPending(t, "game-1", "user-1", "Stellaris", now.Add(7*24*time.Hour))
+
+	svc := f.newService(t)
+	first, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.NoError(t, err)
+
+	second, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, first, second)
+
+	registered, err := f.directory.ListRegistered(context.Background(), "user-1")
+	require.NoError(t, err)
+	assert.Len(t, registered, 1, "registration must remain idempotent")
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 2, "idempotent retry republishes the intent")
+	for _, intent := range intents {
+		assert.Equal(t, "lobby.race_name.registered:game-1:user-1", intent.IdempotencyKey)
+	}
+}
+
+func TestRegisterRaceNameRejectsAdminActor(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewAdminActor(),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRegisterRaceNameRejectsInvalidActor(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.Actor{Kind: shared.ActorKindUser},
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestRegisterRaceNameRejectsEmptyRaceName(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "   ",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "must not be empty")
+}
+
+func TestRegisterRaceNameRejectsInvalidName(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		// "<>" fails ValidateTypeName.
+		RaceName: "<>",
+	})
+	require.ErrorIs(t, err, ports.ErrInvalidName)
+}
+
+func TestRegisterRaceNameRejectsUnknownUser(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-ghost"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.ErrorIs(t, err, shared.ErrSubjectNotFound)
+}
+
+func TestRegisterRaceNameRejectsPermanentBlock(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetEligibility("user-1", ports.Eligibility{
+		Exists:                 true,
+		PermanentBlocked:       true,
+		MaxRegisteredRaceNames: 2,
+	})
+	f.seedPending(t, "game-1", "user-1", "Stellaris", now.Add(7*24*time.Hour))
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRegisterRaceNamePendingMissing(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetEligibility("user-1", defaultEligibility(2))
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.ErrorIs(t, err, ports.ErrPendingMissing)
+}
+
+func TestRegisterRaceNamePendingForOtherUserSurfacesAsMissing(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetEligibility("user-1", defaultEligibility(2))
+	// Pending exists for a different user; the actor has none.
+	f.seedPending(t, "game-1", "user-other", "Stellaris", now.Add(24*time.Hour))
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	// A pending entry held by a different user is reported as missing
+	// for the actor: only registered names by another user surface as
+	// ErrNameTaken on Register (see racenamedir.go port comment and
+	// the Redis adapter behaviour).
+	require.ErrorIs(t, err, ports.ErrPendingMissing)
+}
+
+func TestRegisterRaceNamePendingExpired(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetEligibility("user-1", defaultEligibility(2))
+	// Pending elig until is in the past relative to now.
+	f.seedPending(t, "game-1", "user-1", "Stellaris", now.Add(-time.Minute))
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.ErrorIs(t, err, ports.ErrPendingExpired)
+}
+
+func TestRegisterRaceNameQuotaExceeded(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	// Free-tier quota = 1; user already has one registered name.
+	f.users.SetEligibility("user-1", defaultEligibility(1))
+	f.seedRegistered(t, "game-existing", "user-1", "OldName")
+	f.seedPending(t, "game-new", "user-1", "Stellaris", now.Add(24*time.Hour))
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-new",
+		RaceName:     "Stellaris",
+	})
+	require.ErrorIs(t, err, ports.ErrQuotaExceeded)
+}
+
+func TestRegisterRaceNameUnlimitedQuotaAllowsManyRegistrations(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	// MaxRegisteredRaceNames=0 marker → unlimited.
+	f.users.SetEligibility("user-1", defaultEligibility(0))
+	f.seedRegistered(t, "game-a", "user-1", "First")
+	f.seedRegistered(t, "game-b", "user-1", "Second")
+	f.seedPending(t, "game-c", "user-1", "Third", now.Add(24*time.Hour))
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-c",
+		RaceName:     "Third",
+	})
+	require.NoError(t, err)
+}
+
+func TestRegisterRaceNameUserServiceUnavailable(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetFailure("user-1", ports.ErrUserServiceUnavailable)
+	f.seedPending(t, "game-1", "user-1", "Stellaris", now.Add(24*time.Hour))
+
+	svc := f.newService(t)
+	_, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.ErrorIs(t, err, ports.ErrUserServiceUnavailable)
+}
+
+func TestRegisterRaceNameCommitsEvenIfPublishFails(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixture(t, now)
+	f.users.SetEligibility("user-1", defaultEligibility(2))
+	f.seedPending(t, "game-1", "user-1", "Stellaris", now.Add(7*24*time.Hour))
+	f.intents.SetError(errors.New("notification stream unavailable"))
+
+	svc := f.newService(t)
+	out, err := svc.Handle(context.Background(), registerracename.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		SourceGameID: "game-1",
+		RaceName:     "Stellaris",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "Stellaris", out.RaceName)
+
+	registered, err := f.directory.ListRegistered(context.Background(), "user-1")
+	require.NoError(t, err)
+	require.Len(t, registered, 1)
+}

lobby/internal/service/rejectapplication/service.go

@@ -0,0 +1,216 @@
+// Package rejectapplication implements the `lobby.application.reject`
+// message type. It transitions the application from submitted to
+// rejected, defensively releases any race name reservation held for
+// the applicant in the game, and publishes the
+// `lobby.membership.rejected` notification intent.
+package rejectapplication
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+	"galaxy/notificationintent"
+)
+
+// Service executes the public-game application rejection use case.
+type Service struct {
+	games        ports.GameStore
+	applications ports.ApplicationStore
+	directory    ports.RaceNameDirectory
+	intents      ports.IntentPublisher
+	clock        func() time.Time
+	logger       *slog.Logger
+	telemetry    *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the game record so the rejection intent can carry
+	// the human-readable game_name for display.
+	Games ports.GameStore
+
+	// Applications applies the submitted → rejected transition.
+	Applications ports.ApplicationStore
+
+	// Directory releases any reservation held for the applicant in
+	// the game (no-op when none exists).
+	Directory ports.RaceNameDirectory
+
+	// Intents publishes the lobby.membership.rejected intent.
+	Intents ports.IntentPublisher
+
+	// Clock supplies the wall-clock used for DecidedAt and the
+	// notification's OccurredAt.
+	Clock func() time.Time
+
+	// Logger records structured service-level events.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.application.outcomes` counter on
+	// each rejection. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new reject application service: nil game store")
+	case deps.Applications == nil:
+		return nil, errors.New("new reject application service: nil application store")
+	case deps.Directory == nil:
+		return nil, errors.New("new reject application service: nil race name directory")
+	case deps.Intents == nil:
+		return nil, errors.New("new reject application service: nil intent publisher")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:        deps.Games,
+		applications: deps.Applications,
+		directory:    deps.Directory,
+		intents:      deps.Intents,
+		clock:        clock,
+		logger:       logger.With("service", "lobby.rejectapplication"),
+		telemetry:    deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to reject one application.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindAdmin.
+	Actor shared.Actor
+
+	// GameID identifies the game referenced by the request path; it
+	// must match the loaded application's GameID.
+	GameID common.GameID
+
+	// ApplicationID identifies the target application.
+	ApplicationID common.ApplicationID
+}
+
+// Handle authorizes the actor, validates the application state,
+// transitions the application to rejected, releases any held
+// reservation, and publishes the lobby.membership.rejected intent on
+// success.
+func (service *Service) Handle(ctx context.Context, input Input) (application.Application, error) {
+	if service == nil {
+		return application.Application{}, errors.New("reject application: nil service")
+	}
+	if ctx == nil {
+		return application.Application{}, errors.New("reject application: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return application.Application{}, fmt.Errorf("reject application: actor: %w", err)
+	}
+	if !input.Actor.IsAdmin() {
+		return application.Application{}, fmt.Errorf(
+			"%w: only admin callers may reject applications",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return application.Application{}, fmt.Errorf("reject application: %w", err)
+	}
+	if err := input.ApplicationID.Validate(); err != nil {
+		return application.Application{}, fmt.Errorf("reject application: %w", err)
+	}
+
+	app, err := service.applications.Get(ctx, input.ApplicationID)
+	if err != nil {
+		return application.Application{}, fmt.Errorf("reject application: %w", err)
+	}
+	if app.GameID != input.GameID {
+		return application.Application{}, fmt.Errorf(
+			"reject application: application %q does not belong to game %q: %w",
+			app.ApplicationID, input.GameID, application.ErrNotFound,
+		)
+	}
+	if app.Status != application.StatusSubmitted {
+		return application.Application{}, fmt.Errorf(
+			"reject application: status %q is not %q: %w",
+			app.Status, application.StatusSubmitted, application.ErrConflict,
+		)
+	}
+
+	gameRecord, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return application.Application{}, fmt.Errorf("reject application: %w", err)
+	}
+
+	now := service.clock().UTC()
+	if err := service.applications.UpdateStatus(ctx, ports.UpdateApplicationStatusInput{
+		ApplicationID: app.ApplicationID,
+		ExpectedFrom:  application.StatusSubmitted,
+		To:            application.StatusRejected,
+		At:            now,
+	}); err != nil {
+		return application.Application{}, fmt.Errorf("reject application: %w", err)
+	}
+
+	if err := service.directory.ReleaseReservation(ctx, gameRecord.GameID.String(), app.ApplicantUserID, app.RaceName); err != nil {
+		// The directory contract states ReleaseReservation is a no-op
+		// for missing / mismatched / invalid records, so a non-nil
+		// error here is unexpected. Log and proceed — the
+		// application is already rejected.
+		service.logger.WarnContext(ctx, "release reservation on reject",
+			"application_id", app.ApplicationID.String(),
+			"err", err.Error(),
+		)
+	}
+
+	intent, err := notificationintent.NewLobbyMembershipRejectedIntent(
+		notificationintent.Metadata{
+			IdempotencyKey: "lobby.membership.rejected:" + app.ApplicationID.String(),
+			OccurredAt:     now,
+		},
+		app.ApplicantUserID,
+		notificationintent.LobbyMembershipRejectedPayload{
+			GameID:   gameRecord.GameID.String(),
+			GameName: gameRecord.GameName,
+		},
+	)
+	if err != nil {
+		service.logger.ErrorContext(ctx, "build membership rejected intent",
+			"application_id", app.ApplicationID.String(),
+			"err", err.Error(),
+		)
+	} else if _, publishErr := service.intents.Publish(ctx, intent); publishErr != nil {
+		service.logger.WarnContext(ctx, "publish membership rejected intent",
+			"application_id", app.ApplicationID.String(),
+			"err", publishErr.Error(),
+		)
+	}
+
+	rejected, err := service.applications.Get(ctx, app.ApplicationID)
+	if err != nil {
+		return application.Application{}, fmt.Errorf("reject application: %w", err)
+	}
+
+	service.telemetry.RecordApplicationOutcome(ctx, "rejected")
+
+	logArgs := []any{
+		"game_id", gameRecord.GameID.String(),
+		"game_status", string(gameRecord.Status),
+		"application_id", app.ApplicationID.String(),
+		"user_id", app.ApplicantUserID,
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "application rejected", logArgs...)
+	return rejected, nil
+}

lobby/internal/service/rejectapplication/service_test.go

@@ -0,0 +1,225 @@
+package rejectapplication_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/applicationstub"
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/rejectapplication"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixture struct {
+	now              time.Time
+	games            *gamestub.Store
+	applications     *applicationstub.Store
+	directory        *racenamestub.Directory
+	intents          *intentpubstub.Publisher
+	openPublicGameID common.GameID
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	dir, err := racenamestub.NewDirectory(racenamestub.WithClock(fixedClock(now)))
+	require.NoError(t, err)
+	games := gamestub.NewStore()
+	applications := applicationstub.NewStore()
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              "game-public",
+		GameName:            "Galactic Open",
+		GameType:            game.GameTypePublic,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusEnrollmentOpen
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	return &fixture{
+		now:              now,
+		games:            games,
+		applications:     applications,
+		directory:        dir,
+		intents:          intentpubstub.NewPublisher(),
+		openPublicGameID: gameRecord.GameID,
+	}
+}
+
+func newService(t *testing.T, f *fixture) *rejectapplication.Service {
+	t.Helper()
+	svc, err := rejectapplication.NewService(rejectapplication.Dependencies{
+		Games:        f.games,
+		Applications: f.applications,
+		Directory:    f.directory,
+		Intents:      f.intents,
+		Clock:        fixedClock(f.now),
+		Logger:       silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func seedSubmittedApplication(t *testing.T, f *fixture, applicationID common.ApplicationID, userID, raceName string) application.Application {
+	t.Helper()
+	app, err := application.New(application.NewApplicationInput{
+		ApplicationID:   applicationID,
+		GameID:          f.openPublicGameID,
+		ApplicantUserID: userID,
+		RaceName:        raceName,
+		Now:             f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.applications.Save(context.Background(), app))
+	return app
+}
+
+func TestRejectHappyPath(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), rejectapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusRejected, got.Status)
+	require.NotNil(t, got.DecidedAt)
+	assert.Equal(t, f.now, got.DecidedAt.UTC())
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	assert.Equal(t, notificationintent.NotificationTypeLobbyMembershipRejected, intents[0].NotificationType)
+	assert.Equal(t, []string{"user-1"}, intents[0].RecipientUserIDs)
+}
+
+func TestRejectReleasesPriorReservation(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+
+	require.NoError(t, f.directory.Reserve(context.Background(), f.openPublicGameID.String(), "user-1", "SolarPilot"))
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), rejectapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.NoError(t, err)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-other")
+	require.NoError(t, err)
+	assert.False(t, availability.Taken)
+	assert.Empty(t, availability.HolderUserID)
+}
+
+func TestRejectUserActorForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), rejectapplication.Input{
+		Actor:         shared.NewUserActor("user-1"),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRejectNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), rejectapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: "application-missing",
+	})
+	require.ErrorIs(t, err, application.ErrNotFound)
+}
+
+func TestRejectCrossGameNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), rejectapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        "game-other",
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, application.ErrNotFound)
+}
+
+func TestRejectAlreadyDecidedConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	require.NoError(t, f.applications.UpdateStatus(context.Background(), ports.UpdateApplicationStatusInput{
+		ApplicationID: app.ApplicationID,
+		ExpectedFrom:  application.StatusSubmitted,
+		To:            application.StatusApproved,
+		At:            f.now,
+	}))
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), rejectapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.ErrorIs(t, err, application.ErrConflict)
+}
+
+func TestRejectPublishFailureDoesNotRollback(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	app := seedSubmittedApplication(t, f, "application-1", "user-1", "SolarPilot")
+	f.intents.SetError(errors.New("publish failed"))
+
+	svc := newService(t, f)
+	got, err := svc.Handle(context.Background(), rejectapplication.Input{
+		Actor:         shared.NewAdminActor(),
+		GameID:        f.openPublicGameID,
+		ApplicationID: app.ApplicationID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusRejected, got.Status)
+
+	stored, err := f.applications.Get(context.Background(), app.ApplicationID)
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusRejected, stored.Status)
+}

lobby/internal/service/removemember/service.go

@@ -0,0 +1,259 @@
+// Package removemember implements the `lobby.membership.remove` message
+// type. Before the game has reached the running engine slot the
+// membership record is dropped from the store and the race name
+// reservation is released; after the engine slot exists the membership
+// transitions to `removed` and the reservation is preserved so the
+// capability evaluator at game finish can resolve it.
+package removemember
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// preStartStatuses enumerates the game statuses in which a membership
+// may exist but the engine container slot does not. Removing in these
+// statuses drops the membership outright and releases the reservation.
+var preStartStatuses = map[game.Status]struct{}{
+	game.StatusEnrollmentOpen: {},
+	game.StatusReadyToStart:   {},
+	game.StatusStarting:       {},
+	game.StatusStartFailed:    {},
+}
+
+// postStartStatuses enumerates the game statuses in which the engine
+// container slot is alive. Removing in these statuses transitions the
+// membership to `removed` and keeps the reservation until the
+// capability evaluator runs at `game_finished`.
+var postStartStatuses = map[game.Status]struct{}{
+	game.StatusRunning: {},
+	game.StatusPaused:  {},
+}
+
+// Service executes the remove-member use case.
+type Service struct {
+	games       ports.GameStore
+	memberships ports.MembershipStore
+	directory   ports.RaceNameDirectory
+	clock       func() time.Time
+	logger      *slog.Logger
+	telemetry   *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the game record so the service can branch on
+	// game.Status and authorize the actor against the owner.
+	Games ports.GameStore
+
+	// Memberships persists the post-start status transition and the
+	// pre-start drop.
+	Memberships ports.MembershipStore
+
+	// Directory releases the race name reservation in the pre-start
+	// branch. The post-start branch never invokes Directory.
+	Directory ports.RaceNameDirectory
+
+	// Clock supplies the wall-clock used for the RemovedAt stamp.
+	// Defaults to time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.membership.changes` counter on each
+	// successful removal. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new remove member service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new remove member service: nil membership store")
+	case deps.Directory == nil:
+		return nil, errors.New("new remove member service: nil race name directory")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:       deps.Games,
+		memberships: deps.Memberships,
+		directory:   deps.Directory,
+		clock:       clock,
+		logger:      logger.With("service", "lobby.removemember"),
+		telemetry:   deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to remove one membership.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the game referenced by the request path; it
+	// must match the loaded membership's GameID.
+	GameID common.GameID
+
+	// MembershipID identifies the target membership.
+	MembershipID common.MembershipID
+}
+
+// Handle authorizes the actor, asserts the membership belongs to the
+// game, branches on the game status to either drop or transition the
+// membership, and returns the post-removal record. The pre-start
+// branch returns a synthesized record with status=removed because the
+// underlying primary record has been deleted from the store.
+func (service *Service) Handle(ctx context.Context, input Input) (membership.Membership, error) {
+	if service == nil {
+		return membership.Membership{}, errors.New("remove member: nil service")
+	}
+	if ctx == nil {
+		return membership.Membership{}, errors.New("remove member: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("remove member: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("remove member: %w", err)
+	}
+	if err := input.MembershipID.Validate(); err != nil {
+		return membership.Membership{}, fmt.Errorf("remove member: %w", err)
+	}
+
+	member, err := service.memberships.Get(ctx, input.MembershipID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("remove member: %w", err)
+	}
+	if member.GameID != input.GameID {
+		return membership.Membership{}, fmt.Errorf(
+			"remove member: membership %q does not belong to game %q: %w",
+			member.MembershipID, input.GameID, membership.ErrNotFound,
+		)
+	}
+
+	gameRecord, err := service.games.Get(ctx, member.GameID)
+	if err != nil {
+		return membership.Membership{}, fmt.Errorf("remove member: %w", err)
+	}
+	if err := authorize(input.Actor, gameRecord); err != nil {
+		return membership.Membership{}, err
+	}
+
+	if member.Status != membership.StatusActive {
+		return membership.Membership{}, fmt.Errorf(
+			"remove member: status %q is not %q: %w",
+			member.Status, membership.StatusActive, membership.ErrConflict,
+		)
+	}
+
+	_, preStart := preStartStatuses[gameRecord.Status]
+	_, postStart := postStartStatuses[gameRecord.Status]
+	if !preStart && !postStart {
+		return membership.Membership{}, fmt.Errorf(
+			"remove member: game status %q does not allow remove: %w",
+			gameRecord.Status, game.ErrConflict,
+		)
+	}
+
+	now := service.clock().UTC()
+
+	if postStart {
+		if err := service.memberships.UpdateStatus(ctx, ports.UpdateMembershipStatusInput{
+			MembershipID: member.MembershipID,
+			ExpectedFrom: membership.StatusActive,
+			To:           membership.StatusRemoved,
+			At:           now,
+		}); err != nil {
+			return membership.Membership{}, fmt.Errorf("remove member: %w", err)
+		}
+		service.telemetry.RecordMembershipChange(ctx, "removed")
+		updated, err := service.memberships.Get(ctx, member.MembershipID)
+		if err != nil {
+			return membership.Membership{}, fmt.Errorf("remove member: %w", err)
+		}
+		logArgs := []any{
+			"game_id", gameRecord.GameID.String(),
+			"game_status", string(gameRecord.Status),
+			"membership_id", member.MembershipID.String(),
+			"user_id", member.UserID,
+			"trigger", "post_start",
+			"actor_kind", string(input.Actor.Kind),
+		}
+		logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+		service.logger.InfoContext(ctx, "member removed (post-start)", logArgs...)
+		return updated, nil
+	}
+
+	if err := service.memberships.Delete(ctx, member.MembershipID); err != nil {
+		return membership.Membership{}, fmt.Errorf("remove member: %w", err)
+	}
+	if err := service.directory.ReleaseReservation(
+		ctx,
+		gameRecord.GameID.String(),
+		member.UserID,
+		member.RaceName,
+	); err != nil {
+		// The directory contract states ReleaseReservation is a no-op
+		// for missing / mismatched / invalid records, so a non-nil
+		// error here is unexpected. Log and proceed — the membership
+		// record is already gone.
+		service.logger.WarnContext(ctx, "release reservation on pre-start remove",
+			"membership_id", member.MembershipID.String(),
+			"err", err.Error(),
+		)
+	}
+
+	service.telemetry.RecordMembershipChange(ctx, "removed")
+
+	logArgs := []any{
+		"game_id", gameRecord.GameID.String(),
+		"game_status", string(gameRecord.Status),
+		"membership_id", member.MembershipID.String(),
+		"user_id", member.UserID,
+		"trigger", "pre_start",
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "member removed (pre-start drop)", logArgs...)
+
+	removedAt := now
+	synthesized := member
+	synthesized.Status = membership.StatusRemoved
+	synthesized.RemovedAt = &removedAt
+	return synthesized, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to remove members from game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/removemember/service_test.go

@@ -0,0 +1,425 @@
+package removemember_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/removemember"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+type fixtures struct {
+	games       *gamestub.Store
+	memberships *membershipstub.Store
+	directory   *racenamestub.Directory
+}
+
+func newFixtures(t *testing.T) *fixtures {
+	t.Helper()
+
+	directory, err := racenamestub.NewDirectory()
+	require.NoError(t, err)
+
+	return &fixtures{
+		games:       gamestub.NewStore(),
+		memberships: membershipstub.NewStore(),
+		directory:   directory,
+	}
+}
+
+func (f *fixtures) newService(t *testing.T, clock func() time.Time) *removemember.Service {
+	t.Helper()
+
+	svc, err := removemember.NewService(removemember.Dependencies{
+		Games:       f.games,
+		Memberships: f.memberships,
+		Directory:   f.directory,
+		Clock:       clock,
+		Logger:      silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func (f *fixtures) seedGame(
+	t *testing.T,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	status game.Status,
+	now time.Time,
+) game.Game {
+	t.Helper()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "test remove",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = now.Add(time.Minute)
+		switch status {
+		case game.StatusRunning, game.StatusPaused, game.StatusFinished:
+			startedAt := now.Add(time.Minute)
+			record.StartedAt = &startedAt
+		}
+		if status == game.StatusFinished {
+			finishedAt := now.Add(2 * time.Minute)
+			record.FinishedAt = &finishedAt
+		}
+	}
+	require.NoError(t, f.games.Save(context.Background(), record))
+	return record
+}
+
+// seedMembership saves an active membership record and reserves the
+// matching race name in the directory. It returns the persisted record.
+func (f *fixtures) seedMembership(
+	t *testing.T,
+	gameID common.GameID,
+	membershipID common.MembershipID,
+	userID, raceName string,
+	now time.Time,
+) membership.Membership {
+	t.Helper()
+
+	record, err := membership.New(membership.NewMembershipInput{
+		MembershipID: membershipID,
+		GameID:       gameID,
+		UserID:       userID,
+		RaceName:     raceName,
+		CanonicalKey: strings.ToLower(strings.ReplaceAll(raceName, " ", "")),
+		Now:          now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.memberships.Save(context.Background(), record))
+	require.NoError(t, f.directory.Reserve(context.Background(), gameID.String(), userID, raceName))
+	return record
+}
+
+func (f *fixtures) markMembership(
+	t *testing.T,
+	membershipID common.MembershipID,
+	to membership.Status,
+	at time.Time,
+) {
+	t.Helper()
+
+	require.NoError(t, f.memberships.UpdateStatus(context.Background(), ports.UpdateMembershipStatusInput{
+		MembershipID: membershipID,
+		ExpectedFrom: membership.StatusActive,
+		To:           to,
+		At:           at,
+	}))
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+
+	_, err := removemember.NewService(removemember.Dependencies{})
+	require.Error(t, err)
+}
+
+func TestRemoveMemberAdminPreStartDropsAndReleasesReservation(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	at := now.Add(time.Hour)
+	svc := f.newService(t, fixedClock(at))
+
+	result, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusRemoved, result.Status)
+	require.NotNil(t, result.RemovedAt)
+	assert.True(t, result.RemovedAt.Equal(at))
+
+	_, getErr := f.memberships.Get(context.Background(), member.MembershipID)
+	require.ErrorIs(t, getErr, membership.ErrNotFound)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-other")
+	require.NoError(t, err)
+	assert.False(t, availability.Taken)
+	assert.Empty(t, availability.HolderUserID)
+}
+
+func TestRemoveMemberAdminPostStartTransitionsAndKeepsReservation(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusRunning, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	at := now.Add(time.Hour)
+	svc := f.newService(t, fixedClock(at))
+
+	result, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusRemoved, result.Status)
+	require.NotNil(t, result.RemovedAt)
+	assert.True(t, result.RemovedAt.Equal(at))
+
+	persisted, err := f.memberships.Get(context.Background(), member.MembershipID)
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusRemoved, persisted.Status)
+
+	availability, err := f.directory.Check(context.Background(), "SolarPilot", "user-other")
+	require.NoError(t, err)
+	assert.True(t, availability.Taken)
+	assert.Equal(t, "user-1", availability.HolderUserID)
+	assert.Equal(t, ports.KindReservation, availability.Kind)
+}
+
+func TestRemoveMemberPrivateOwnerPreStart(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-priv", game.GameTypePrivate, "user-owner", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-priv", "user-2", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+
+	_, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewUserActor("user-owner"),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.NoError(t, err)
+
+	_, getErr := f.memberships.Get(context.Background(), member.MembershipID)
+	require.ErrorIs(t, getErr, membership.ErrNotFound)
+}
+
+func TestRemoveMemberPrivateOwnerPostStart(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-priv", game.GameTypePrivate, "user-owner", game.StatusPaused, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-priv", "user-2", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+
+	result, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewUserActor("user-owner"),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusRemoved, result.Status)
+
+	persisted, err := f.memberships.Get(context.Background(), member.MembershipID)
+	require.NoError(t, err)
+	assert.Equal(t, membership.StatusRemoved, persisted.Status)
+}
+
+func TestRemoveMemberRejectsPublicGameUserActor(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewUserActor("user-1"),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRemoveMemberRejectsNonOwnerUser(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-priv", game.GameTypePrivate, "user-owner", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-priv", "user-2", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewUserActor("user-other"),
+		GameID:       gameRecord.GameID,
+		MembershipID: member.MembershipID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRemoveMemberRejectsMismatchedGameID(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+	member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       common.GameID("game-other"),
+		MembershipID: member.MembershipID,
+	})
+	require.ErrorIs(t, err, membership.ErrNotFound)
+}
+
+func TestRemoveMemberRejectsMissingMembership(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	f := newFixtures(t)
+	f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusEnrollmentOpen, now)
+
+	svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+	_, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       "game-public",
+		MembershipID: common.MembershipID("membership-missing"),
+	})
+	require.ErrorIs(t, err, membership.ErrNotFound)
+}
+
+func TestRemoveMemberRejectsAlreadyTerminalMembership(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		to   membership.Status
+	}{
+		{"removed", membership.StatusRemoved},
+		{"blocked", membership.StatusBlocked},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+			f := newFixtures(t)
+			gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", game.StatusRunning, now)
+			member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+			f.markMembership(t, member.MembershipID, tc.to, now.Add(time.Minute))
+
+			svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+			_, err := svc.Handle(context.Background(), removemember.Input{
+				Actor:        shared.NewAdminActor(),
+				GameID:       gameRecord.GameID,
+				MembershipID: member.MembershipID,
+			})
+			require.ErrorIs(t, err, membership.ErrConflict)
+		})
+	}
+}
+
+func TestRemoveMemberRejectsTerminalGameStatuses(t *testing.T) {
+	t.Parallel()
+
+	statuses := []game.Status{
+		game.StatusDraft,
+		game.StatusFinished,
+		game.StatusCancelled,
+	}
+
+	for _, status := range statuses {
+		t.Run(string(status), func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+			f := newFixtures(t)
+			gameRecord := f.seedGame(t, "game-public", game.GameTypePublic, "", status, now)
+			member := f.seedMembership(t, gameRecord.GameID, "membership-pub", "user-1", "SolarPilot", now)
+
+			svc := f.newService(t, fixedClock(now.Add(time.Hour)))
+			_, err := svc.Handle(context.Background(), removemember.Input{
+				Actor:        shared.NewAdminActor(),
+				GameID:       gameRecord.GameID,
+				MembershipID: member.MembershipID,
+			})
+			require.ErrorIs(t, err, game.ErrConflict)
+		})
+	}
+}
+
+func TestRemoveMemberInvalidActor(t *testing.T) {
+	t.Parallel()
+
+	f := newFixtures(t)
+	svc := f.newService(t, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.Actor{Kind: shared.ActorKindUser},
+		GameID:       "game-x",
+		MembershipID: "membership-x",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestRemoveMemberInvalidIDs(t *testing.T) {
+	t.Parallel()
+
+	f := newFixtures(t)
+	svc := f.newService(t, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       "bad",
+		MembershipID: "membership-x",
+	})
+	require.Error(t, err)
+
+	_, err = svc.Handle(context.Background(), removemember.Input{
+		Actor:        shared.NewAdminActor(),
+		GameID:       "game-x",
+		MembershipID: "bad",
+	})
+	require.Error(t, err)
+}

lobby/internal/service/resumegame/service.go

@@ -0,0 +1,175 @@
+// Package resumegame implements the `lobby.game.resume` message type.
+// It transitions a `paused` game back to `running` after enforcing
+// admin-or-owner authorization and a synchronous Game Master liveness
+// probe. When Game Master is unreachable the game stays `paused` and
+// the caller receives `service_unavailable`.
+package resumegame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the resume-game use case.
+type Service struct {
+	games     ports.GameStore
+	gm        ports.GMClient
+	clock     func() time.Time
+	logger    *slog.Logger
+	telemetry *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games mediates the CAS status transition and the result read.
+	Games ports.GameStore
+
+	// GM is the synchronous Game Master client used for the liveness
+	// probe issued before the status transition.
+	GM ports.GMClient
+
+	// Clock supplies the wall-clock used for UpdatedAt. Defaults to
+	// time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.game.transitions` counter on each
+	// successful resume. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new resume game service: nil game store")
+	case deps.GM == nil:
+		return nil, errors.New("new resume game service: nil gm client")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:     deps.Games,
+		gm:        deps.GM,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.resumegame"),
+		telemetry: deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to resume one game.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, asserts the source status is `paused`,
+// pings Game Master, and on a healthy probe transitions the record to
+// `running`. A failed probe returns shared.ErrServiceUnavailable
+// without mutating the record so the game stays `paused`.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("resume game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("resume game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("resume game: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("resume game: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("resume game: %w", err)
+	}
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+	if record.Status != game.StatusPaused {
+		return game.Game{}, fmt.Errorf(
+			"resume game: status %q is not %q: %w",
+			record.Status, game.StatusPaused, game.ErrConflict,
+		)
+	}
+
+	if err := service.gm.Ping(ctx); err != nil {
+		service.logger.WarnContext(ctx, "resume game: game master unavailable",
+			"game_id", input.GameID.String(),
+			"err", err.Error(),
+		)
+		return game.Game{}, fmt.Errorf("resume game: %w",
+			errors.Join(shared.ErrServiceUnavailable, err))
+	}
+
+	at := service.clock().UTC()
+	if err := service.games.UpdateStatus(ctx, ports.UpdateStatusInput{
+		GameID:       input.GameID,
+		ExpectedFrom: game.StatusPaused,
+		To:           game.StatusRunning,
+		Trigger:      game.TriggerCommand,
+		At:           at,
+	}); err != nil {
+		return game.Game{}, fmt.Errorf("resume game: %w", err)
+	}
+
+	service.telemetry.RecordGameTransition(ctx,
+		string(game.StatusPaused),
+		string(game.StatusRunning),
+		string(game.TriggerCommand),
+	)
+
+	updated, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("resume game: %w", err)
+	}
+
+	logArgs := []any{
+		"game_id", updated.GameID.String(),
+		"from_status", string(game.StatusPaused),
+		"to_status", string(updated.Status),
+		"trigger", string(game.TriggerCommand),
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "game resumed", logArgs...)
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to resume game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/resumegame/service_test.go

@@ -0,0 +1,284 @@
+package resumegame_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/gmclientstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/resumegame"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+// seedGameWithStatus persists a fresh game and overrides Status to the
+// requested value so individual tests can exercise resume against any
+// source status.
+func seedGameWithStatus(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	status game.Status,
+	now time.Time,
+) game.Game {
+	t.Helper()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "test resume game",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+
+	if status != game.StatusDraft {
+		record.Status = status
+		record.UpdatedAt = now.Add(time.Minute)
+		if status == game.StatusRunning || status == game.StatusPaused ||
+			status == game.StatusFinished {
+			startedAt := now.Add(time.Minute)
+			record.StartedAt = &startedAt
+		}
+		if status == game.StatusFinished {
+			finishedAt := now.Add(2 * time.Minute)
+			record.FinishedAt = &finishedAt
+		}
+	}
+	require.NoError(t, store.Save(context.Background(), record))
+
+	return record
+}
+
+func newService(
+	t *testing.T,
+	store ports.GameStore,
+	gm ports.GMClient,
+	clock func() time.Time,
+) *resumegame.Service {
+	t.Helper()
+
+	svc, err := resumegame.NewService(resumegame.Dependencies{
+		Games:  store,
+		GM:     gm,
+		Clock:  clock,
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	t.Parallel()
+
+	_, err := resumegame.NewService(resumegame.Dependencies{})
+	require.Error(t, err)
+
+	_, err = resumegame.NewService(resumegame.Dependencies{Games: gamestub.NewStore()})
+	require.Error(t, err)
+}
+
+func TestResumeGameAdminHappyPath(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-pub", game.GameTypePublic, "", game.StatusPaused, now)
+
+	gm := gmclientstub.NewClient()
+	service := newService(t, store, gm, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusRunning, updated.Status)
+	assert.Equal(t, 1, gm.PingCalls())
+}
+
+func TestResumeGamePrivateOwnerHappyPath(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-priv", game.GameTypePrivate, "user-owner", game.StatusPaused, now)
+
+	gm := gmclientstub.NewClient()
+	service := newService(t, store, gm, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.NewUserActor("user-owner"),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusRunning, updated.Status)
+	assert.Equal(t, 1, gm.PingCalls())
+}
+
+func TestResumeGameRejectsNonOwnerUser(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-priv", game.GameTypePrivate, "user-owner", game.StatusPaused, now)
+
+	gm := gmclientstub.NewClient()
+	service := newService(t, store, gm, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.NewUserActor("user-other"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+	assert.Equal(t, 0, gm.PingCalls(), "ping must not run before authorization passes")
+}
+
+func TestResumeGameRejectsUserActorOnPublicGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-pub", game.GameTypePublic, "", game.StatusPaused, now)
+
+	gm := gmclientstub.NewClient()
+	service := newService(t, store, gm, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.NewUserActor("user-x"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+	assert.Equal(t, 0, gm.PingCalls())
+}
+
+func TestResumeGameRejectsWrongStatuses(t *testing.T) {
+	t.Parallel()
+
+	statuses := []game.Status{
+		game.StatusDraft,
+		game.StatusEnrollmentOpen,
+		game.StatusReadyToStart,
+		game.StatusStarting,
+		game.StatusStartFailed,
+		game.StatusRunning,
+		game.StatusFinished,
+		game.StatusCancelled,
+	}
+
+	for _, status := range statuses {
+		t.Run(string(status), func(t *testing.T) {
+			t.Parallel()
+
+			now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+			store := gamestub.NewStore()
+			record := seedGameWithStatus(t, store, "game-x", game.GameTypePublic, "", status, now)
+
+			gm := gmclientstub.NewClient()
+			service := newService(t, store, gm, fixedClock(now.Add(time.Hour)))
+
+			_, err := service.Handle(context.Background(), resumegame.Input{
+				Actor:  shared.NewAdminActor(),
+				GameID: record.GameID,
+			})
+			require.ErrorIs(t, err, game.ErrConflict)
+			assert.Equal(t, 0, gm.PingCalls(), "ping must not run before status check passes")
+		})
+	}
+}
+
+func TestResumeGameGMUnavailableKeepsPaused(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedGameWithStatus(t, store, "game-pub", game.GameTypePublic, "", game.StatusPaused, now)
+
+	gm := gmclientstub.NewClient()
+	gm.SetPingError(errors.Join(ports.ErrGMUnavailable, errors.New("dial tcp: connection refused")))
+	service := newService(t, store, gm, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.Error(t, err)
+	assert.ErrorIs(t, err, shared.ErrServiceUnavailable)
+	assert.ErrorIs(t, err, ports.ErrGMUnavailable)
+	assert.Equal(t, 1, gm.PingCalls())
+
+	persisted, err := store.Get(context.Background(), record.GameID)
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusPaused, persisted.Status,
+		"game must remain paused when GM is unavailable")
+}
+
+func TestResumeGameRejectsMissingRecord(t *testing.T) {
+	t.Parallel()
+
+	gm := gmclientstub.NewClient()
+	store := gamestub.NewStore()
+	service := newService(t, store, gm, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: common.GameID("game-missing"),
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+	assert.Equal(t, 0, gm.PingCalls())
+}
+
+func TestResumeGameInvalidActor(t *testing.T) {
+	t.Parallel()
+
+	gm := gmclientstub.NewClient()
+	store := gamestub.NewStore()
+	service := newService(t, store, gm, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.Actor{Kind: shared.ActorKindUser},
+		GameID: "game-x",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestResumeGameInvalidGameID(t *testing.T) {
+	t.Parallel()
+
+	gm := gmclientstub.NewClient()
+	store := gamestub.NewStore()
+	service := newService(t, store, gm, fixedClock(time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), resumegame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: "bad",
+	})
+	require.Error(t, err)
+}

lobby/internal/service/retrystartgame/service.go

@@ -0,0 +1,156 @@
+// Package retrystartgame implements the `lobby.game.retry_start` message
+// type. It transitions a `start_failed` game back to `ready_to_start` so
+// the admin or owner can issue a fresh start command. Membership and
+// race name reservations are not touched; the rebuilt start sequence
+// runs against the same roster.
+package retrystartgame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the retry-start use case.
+type Service struct {
+	games     ports.GameStore
+	clock     func() time.Time
+	logger    *slog.Logger
+	telemetry *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games mediates the CAS status transition and the result read.
+	Games ports.GameStore
+
+	// Clock supplies the wall-clock used for UpdatedAt. Defaults to
+	// time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.game.transitions` counter on each
+	// successful retry. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Games == nil {
+		return nil, errors.New("new retry start game service: nil game store")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:     deps.Games,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.retrystartgame"),
+		telemetry: deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to retry-start one game.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, asserts the source status is
+// `start_failed`, transitions the record to `ready_to_start`, and
+// returns the post-transition snapshot.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("retry start game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("retry start game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("retry start game: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("retry start game: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("retry start game: %w", err)
+	}
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+	if record.Status != game.StatusStartFailed {
+		return game.Game{}, fmt.Errorf(
+			"retry start game: status %q is not %q: %w",
+			record.Status, game.StatusStartFailed, game.ErrConflict,
+		)
+	}
+
+	at := service.clock().UTC()
+	if err := service.games.UpdateStatus(ctx, ports.UpdateStatusInput{
+		GameID:       input.GameID,
+		ExpectedFrom: game.StatusStartFailed,
+		To:           game.StatusReadyToStart,
+		Trigger:      game.TriggerCommand,
+		At:           at,
+	}); err != nil {
+		return game.Game{}, fmt.Errorf("retry start game: %w", err)
+	}
+
+	service.telemetry.RecordGameTransition(ctx,
+		string(game.StatusStartFailed),
+		string(game.StatusReadyToStart),
+		string(game.TriggerCommand),
+	)
+
+	updated, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("retry start game: %w", err)
+	}
+
+	logArgs := []any{
+		"game_id", updated.GameID.String(),
+		"from_status", string(game.StatusStartFailed),
+		"to_status", string(updated.Status),
+		"trigger", string(game.TriggerCommand),
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "game retry start requested", logArgs...)
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to retry start game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/retrystartgame/service_test.go

@@ -0,0 +1,132 @@
+package retrystartgame_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/service/retrystartgame"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+func newFailedGame(t *testing.T, gameType game.GameType, ownerID string) (game.Game, time.Time) {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	record, err := game.New(game.NewGameInput{
+		GameID:              common.GameID("game-r"),
+		GameName:            "test retry game",
+		GameType:            gameType,
+		OwnerUserID:         ownerID,
+		MinPlayers:          4,
+		MaxPlayers:          8,
+		StartGapHours:       12,
+		StartGapPlayers:     2,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 18 * * *",
+		TargetEngineVersion: "v1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	record.Status = game.StatusStartFailed
+	return record, now
+}
+
+func newService(t *testing.T, games *gamestub.Store, at time.Time) *retrystartgame.Service {
+	t.Helper()
+	service, err := retrystartgame.NewService(retrystartgame.Dependencies{
+		Games:  games,
+		Clock:  fixedClock(at),
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+	return service
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	_, err := retrystartgame.NewService(retrystartgame.Dependencies{})
+	require.Error(t, err)
+}
+
+func TestRetryStartGameAdminHappyPath(t *testing.T) {
+	record, now := newFailedGame(t, game.GameTypePublic, "")
+	games := gamestub.NewStore()
+	require.NoError(t, games.Save(context.Background(), record))
+
+	service := newService(t, games, now.Add(time.Hour))
+	updated, err := service.Handle(context.Background(), retrystartgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusReadyToStart, updated.Status)
+}
+
+func TestRetryStartGamePrivateOwnerHappyPath(t *testing.T) {
+	record, now := newFailedGame(t, game.GameTypePrivate, "user-owner")
+	games := gamestub.NewStore()
+	require.NoError(t, games.Save(context.Background(), record))
+
+	service := newService(t, games, now.Add(time.Hour))
+	updated, err := service.Handle(context.Background(), retrystartgame.Input{
+		Actor:  shared.NewUserActor("user-owner"),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusReadyToStart, updated.Status)
+}
+
+func TestRetryStartGameRejectsNonOwnerUser(t *testing.T) {
+	record, now := newFailedGame(t, game.GameTypePrivate, "user-owner")
+	games := gamestub.NewStore()
+	require.NoError(t, games.Save(context.Background(), record))
+
+	service := newService(t, games, now.Add(time.Hour))
+	_, err := service.Handle(context.Background(), retrystartgame.Input{
+		Actor:  shared.NewUserActor("user-other"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRetryStartGameRejectsWrongStatus(t *testing.T) {
+	record, now := newFailedGame(t, game.GameTypePublic, "")
+	record.Status = game.StatusRunning
+	startedAt := now.Add(30 * time.Minute)
+	record.StartedAt = &startedAt
+	games := gamestub.NewStore()
+	require.NoError(t, games.Save(context.Background(), record))
+
+	service := newService(t, games, now.Add(time.Hour))
+	_, err := service.Handle(context.Background(), retrystartgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestRetryStartGameRejectsMissingRecord(t *testing.T) {
+	games := gamestub.NewStore()
+	service := newService(t, games, time.Now().UTC())
+
+	_, err := service.Handle(context.Background(), retrystartgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: common.GameID("game-missing"),
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}

lobby/internal/service/revokeinvite/service.go

@@ -0,0 +1,167 @@
+// Package revokeinvite implements the `lobby.invite.revoke` message type. It
+// transitions the invite from created to revoked when the actor is the
+// private-game owner. Per `lobby/README.md` §Invite Lifecycle, no
+// notification is published in v1.
+package revokeinvite
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the private-game invite revoke use case.
+type Service struct {
+	games     ports.GameStore
+	invites   ports.InviteStore
+	clock     func() time.Time
+	logger    *slog.Logger
+	telemetry *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the game record for the owner-authorization check.
+	Games ports.GameStore
+
+	// Invites loads the target invite and applies the
+	// created → revoked transition.
+	Invites ports.InviteStore
+
+	// Clock supplies the wall-clock used for DecidedAt.
+	Clock func() time.Time
+
+	// Logger records structured service-level events.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.invite.outcomes` counter on each
+	// successful revoke. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new revoke invite service: nil game store")
+	case deps.Invites == nil:
+		return nil, errors.New("new revoke invite service: nil invite store")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:     deps.Games,
+		invites:   deps.Invites,
+		clock:     clock,
+		logger:    logger.With("service", "lobby.revokeinvite"),
+		telemetry: deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to revoke one invite.
+type Input struct {
+	// Actor identifies the caller. Must be the private-game owner.
+	Actor shared.Actor
+
+	// GameID identifies the game referenced by the request path; it must
+	// match the loaded invite's GameID.
+	GameID common.GameID
+
+	// InviteID identifies the target invite.
+	InviteID common.InviteID
+}
+
+// Handle authorizes the owner, validates the invite state, transitions the
+// invite to revoked, and returns the updated record.
+func (service *Service) Handle(ctx context.Context, input Input) (invite.Invite, error) {
+	if service == nil {
+		return invite.Invite{}, errors.New("revoke invite: nil service")
+	}
+	if ctx == nil {
+		return invite.Invite{}, errors.New("revoke invite: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("revoke invite: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return invite.Invite{}, fmt.Errorf(
+			"%w: only the private-game owner may revoke an invite",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("revoke invite: %w", err)
+	}
+	if err := input.InviteID.Validate(); err != nil {
+		return invite.Invite{}, fmt.Errorf("revoke invite: %w", err)
+	}
+
+	inv, err := service.invites.Get(ctx, input.InviteID)
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("revoke invite: %w", err)
+	}
+	if inv.GameID != input.GameID {
+		return invite.Invite{}, fmt.Errorf(
+			"revoke invite: invite %q does not belong to game %q: %w",
+			inv.InviteID, input.GameID, invite.ErrNotFound,
+		)
+	}
+	if inv.Status != invite.StatusCreated {
+		return invite.Invite{}, fmt.Errorf(
+			"revoke invite: status %q is not %q: %w",
+			inv.Status, invite.StatusCreated, invite.ErrConflict,
+		)
+	}
+
+	gameRecord, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("revoke invite: %w", err)
+	}
+	if gameRecord.OwnerUserID != input.Actor.UserID {
+		return invite.Invite{}, fmt.Errorf(
+			"%w: actor is not the owner of game %q",
+			shared.ErrForbidden, gameRecord.GameID,
+		)
+	}
+
+	now := service.clock().UTC()
+	if err := service.invites.UpdateStatus(ctx, ports.UpdateInviteStatusInput{
+		InviteID:     inv.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusRevoked,
+		At:           now,
+	}); err != nil {
+		return invite.Invite{}, fmt.Errorf("revoke invite: %w", err)
+	}
+
+	revoked, err := service.invites.Get(ctx, inv.InviteID)
+	if err != nil {
+		return invite.Invite{}, fmt.Errorf("revoke invite: %w", err)
+	}
+
+	service.telemetry.RecordInviteOutcome(ctx, "revoked")
+
+	logArgs := []any{
+		"game_id", revoked.GameID.String(),
+		"invite_id", revoked.InviteID.String(),
+		"invitee_user_id", revoked.InviteeUserID,
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "invite revoked", logArgs...)
+	return revoked, nil
+}

lobby/internal/service/revokeinvite/service_test.go

@@ -0,0 +1,212 @@
+package revokeinvite_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/revokeinvite"
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	ownerUserID   = "user-owner"
+	inviteeUserID = "user-invitee"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func fixedClock(at time.Time) func() time.Time { return func() time.Time { return at } }
+
+type fixture struct {
+	now     time.Time
+	games   *gamestub.Store
+	invites *invitestub.Store
+	game    game.Game
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	games := gamestub.NewStore()
+	invites := invitestub.NewStore()
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              "game-private",
+		GameName:            "Friends Only",
+		GameType:            game.GameTypePrivate,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusEnrollmentOpen
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	return &fixture{
+		now:     now,
+		games:   games,
+		invites: invites,
+		game:    gameRecord,
+	}
+}
+
+func newService(t *testing.T, f *fixture) *revokeinvite.Service {
+	t.Helper()
+	svc, err := revokeinvite.NewService(revokeinvite.Dependencies{
+		Games:   f.games,
+		Invites: f.invites,
+		Clock:   fixedClock(f.now),
+		Logger:  silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func seedCreatedInvite(t *testing.T, f *fixture, inviteID common.InviteID, invitee string) invite.Invite {
+	t.Helper()
+	inv, err := invite.New(invite.NewInviteInput{
+		InviteID:      inviteID,
+		GameID:        f.game.GameID,
+		InviterUserID: ownerUserID,
+		InviteeUserID: invitee,
+		Now:           f.now,
+		ExpiresAt:     f.game.EnrollmentEndsAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.invites.Save(context.Background(), inv))
+	return inv
+}
+
+func TestRevokeHappyPath(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), revokeinvite.Input{
+		Actor:    shared.NewUserActor(ownerUserID),
+		GameID:   f.game.GameID,
+		InviteID: inv.InviteID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusRevoked, got.Status)
+	require.NotNil(t, got.DecidedAt)
+	assert.Equal(t, f.now, *got.DecidedAt)
+}
+
+func TestRevokeAdminActorForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), revokeinvite.Input{
+		Actor:    shared.NewAdminActor(),
+		GameID:   f.game.GameID,
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRevokeNonOwnerForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), revokeinvite.Input{
+		Actor:    shared.NewUserActor("user-impostor"),
+		GameID:   f.game.GameID,
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestRevokeInviteNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), revokeinvite.Input{
+		Actor:    shared.NewUserActor(ownerUserID),
+		GameID:   f.game.GameID,
+		InviteID: "invite-missing",
+	})
+	require.ErrorIs(t, err, invite.ErrNotFound)
+}
+
+func TestRevokeCrossGameNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), revokeinvite.Input{
+		Actor:    shared.NewUserActor(ownerUserID),
+		GameID:   "game-other",
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, invite.ErrNotFound)
+}
+
+func TestRevokeWrongStatusConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	require.NoError(t, f.invites.UpdateStatus(context.Background(), ports.UpdateInviteStatusInput{
+		InviteID:     inv.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusDeclined,
+		At:           f.now,
+	}))
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), revokeinvite.Input{
+		Actor:    shared.NewUserActor(ownerUserID),
+		GameID:   f.game.GameID,
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, invite.ErrConflict)
+}
+
+func TestRevokeGameNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	inv := seedCreatedInvite(t, f, "invite-1", inviteeUserID)
+	// Re-wire the service against a fresh empty games store so the
+	// owner-check load fails. The invite remains addressable; the missing
+	// game path is a defensive guard, but the surfaced error must be
+	// subject_not_found rather than forbidden.
+	svc, err := revokeinvite.NewService(revokeinvite.Dependencies{
+		Games:   gamestub.NewStore(),
+		Invites: f.invites,
+		Clock:   fixedClock(f.now),
+		Logger:  silentLogger(),
+	})
+	require.NoError(t, err)
+
+	_, err = svc.Handle(context.Background(), revokeinvite.Input{
+		Actor:    shared.NewUserActor(ownerUserID),
+		GameID:   f.game.GameID,
+		InviteID: inv.InviteID,
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}

lobby/internal/service/shared/closeenrollment.go

@@ -0,0 +1,198 @@
+package shared
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/telemetry"
+	"galaxy/notificationintent"
+)
+
+// CloseEnrollmentDeps groups the collaborators that CloseEnrollment
+// requires. The struct is reused by manualreadytostart and the
+// enrollmentautomation worker so the enrollment-close pipeline lives in a
+// single place.
+type CloseEnrollmentDeps struct {
+	// Games mediates the authoritative game status transition.
+	Games ports.GameStore
+
+	// Invites is scanned for created records that must transition to
+	// expired alongside the close.
+	Invites ports.InviteStore
+
+	// Intents publishes lobby.invite.expired notifications, one per
+	// expired record. Failures are best-effort and do not roll back the
+	// already-committed status transitions.
+	Intents ports.IntentPublisher
+
+	// Logger receives best-effort warnings for invite-CAS conflicts and
+	// notification-publish failures. CloseEnrollment falls back to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records `lobby.game.transitions` once per close and
+	// `lobby.invite.outcomes` once per expired invite. Optional; nil
+	// disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// CloseEnrollment performs the enrollment_open → ready_to_start transition
+// for gameID using trigger and at, then expires every still-created invite
+// attached to the game, publishing one lobby.invite.expired intent per
+// expired record. The post-transition game snapshot is returned.
+//
+// Failures of the game status transition (game.ErrConflict,
+// game.ErrInvalidTransition, store technical errors) are returned to the
+// caller so manualreadytostart can map them to HTTP responses and the
+// worker can log and continue. Failures of individual invite CAS updates
+// or intent publishes are logged and ignored — they are notification
+// degradations, not authoritative state changes.
+func CloseEnrollment(
+	ctx context.Context,
+	deps CloseEnrollmentDeps,
+	gameID common.GameID,
+	trigger game.Trigger,
+	at time.Time,
+) (game.Game, error) {
+	if ctx == nil {
+		return game.Game{}, errors.New("close enrollment: nil context")
+	}
+	if deps.Games == nil {
+		return game.Game{}, errors.New("close enrollment: nil game store")
+	}
+	if deps.Invites == nil {
+		return game.Game{}, errors.New("close enrollment: nil invite store")
+	}
+	if deps.Intents == nil {
+		return game.Game{}, errors.New("close enrollment: nil intent publisher")
+	}
+	if err := gameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("close enrollment: %w", err)
+	}
+	if !trigger.IsKnown() {
+		return game.Game{}, fmt.Errorf("close enrollment: trigger %q is unsupported", trigger)
+	}
+	if at.IsZero() {
+		return game.Game{}, errors.New("close enrollment: at must not be zero")
+	}
+
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	if err := deps.Games.UpdateStatus(ctx, ports.UpdateStatusInput{
+		GameID:       gameID,
+		ExpectedFrom: game.StatusEnrollmentOpen,
+		To:           game.StatusReadyToStart,
+		Trigger:      trigger,
+		At:           at,
+	}); err != nil {
+		return game.Game{}, fmt.Errorf("close enrollment: %w", err)
+	}
+
+	deps.Telemetry.RecordGameTransition(ctx,
+		string(game.StatusEnrollmentOpen),
+		string(game.StatusReadyToStart),
+		string(trigger),
+	)
+
+	updated, err := deps.Games.Get(ctx, gameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("close enrollment: %w", err)
+	}
+
+	expireCreatedInvites(ctx, deps, logger, updated, at)
+
+	return updated, nil
+}
+
+// expireCreatedInvites scans the invite store for the game and pushes
+// every still-created record to the expired terminal status, publishing a
+// per-invite lobby.invite.expired intent on success. All errors are
+// logged and swallowed: an expired-but-unnotified invite is acceptable
+// degradation while the authoritative game status is already advanced.
+func expireCreatedInvites(
+	ctx context.Context,
+	deps CloseEnrollmentDeps,
+	logger *slog.Logger,
+	gameRecord game.Game,
+	at time.Time,
+) {
+	invites, err := deps.Invites.GetByGame(ctx, gameRecord.GameID)
+	if err != nil {
+		logger.WarnContext(ctx, "list invites on enrollment close",
+			"game_id", gameRecord.GameID.String(),
+			"err", err.Error(),
+		)
+		return
+	}
+
+	for _, record := range invites {
+		if record.Status != invite.StatusCreated {
+			continue
+		}
+
+		if err := deps.Invites.UpdateStatus(ctx, ports.UpdateInviteStatusInput{
+			InviteID:     record.InviteID,
+			ExpectedFrom: invite.StatusCreated,
+			To:           invite.StatusExpired,
+			At:           at,
+		}); err != nil {
+			logger.WarnContext(ctx, "expire invite on enrollment close",
+				"game_id", gameRecord.GameID.String(),
+				"invite_id", record.InviteID.String(),
+				"err", err.Error(),
+			)
+			continue
+		}
+
+		deps.Telemetry.RecordInviteOutcome(ctx, "expired")
+
+		intent, err := notificationintent.NewLobbyInviteExpiredIntent(
+			notificationintent.Metadata{
+				IdempotencyKey: "lobby.invite.expired:" + record.InviteID.String(),
+				OccurredAt:     at,
+			},
+			gameRecord.OwnerUserID,
+			notificationintent.LobbyInviteExpiredPayload{
+				GameID:        gameRecord.GameID.String(),
+				GameName:      gameRecord.GameName,
+				InviteeUserID: record.InviteeUserID,
+				InviteeName:   inviteeDisplayName(record),
+			},
+		)
+		if err != nil {
+			logger.ErrorContext(ctx, "build invite expired intent",
+				"invite_id", record.InviteID.String(),
+				"err", err.Error(),
+			)
+			continue
+		}
+		if _, publishErr := deps.Intents.Publish(ctx, intent); publishErr != nil {
+			logger.WarnContext(ctx, "publish invite expired intent",
+				"invite_id", record.InviteID.String(),
+				"err", publishErr.Error(),
+			)
+		}
+	}
+}
+
+// inviteeDisplayName returns the invitee display name carried by the
+// expired-invite notification. The invitee never redeemed (RaceName is
+// empty for created invites) so the user id stands in as the readable
+// label, matching the createinvite fallback for absent inviter
+// memberships.
+func inviteeDisplayName(record invite.Invite) string {
+	if record.RaceName != "" {
+		return record.RaceName
+	}
+	return record.InviteeUserID
+}

lobby/internal/service/shared/closeenrollment_test.go

@@ -0,0 +1,249 @@
+package shared_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/invitestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/invite"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	closeOwnerUserID = "user-owner"
+	closeGameID      = common.GameID("game-private")
+	closeGameName    = "Friends Only"
+)
+
+func silentLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+type closeFixture struct {
+	now     time.Time
+	games   *gamestub.Store
+	invites *invitestub.Store
+	intents *intentpubstub.Publisher
+	game    game.Game
+}
+
+func newCloseFixture(t *testing.T) *closeFixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	games := gamestub.NewStore()
+	invites := invitestub.NewStore()
+	intents := intentpubstub.NewPublisher()
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              closeGameID,
+		GameName:            closeGameName,
+		GameType:            game.GameTypePrivate,
+		OwnerUserID:         closeOwnerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusEnrollmentOpen
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	return &closeFixture{
+		now:     now,
+		games:   games,
+		invites: invites,
+		intents: intents,
+		game:    gameRecord,
+	}
+}
+
+func (f *closeFixture) addCreatedInvite(t *testing.T, inviteID common.InviteID, inviteeUserID string) invite.Invite {
+	t.Helper()
+	rec, err := invite.New(invite.NewInviteInput{
+		InviteID:      inviteID,
+		GameID:        f.game.GameID,
+		InviterUserID: closeOwnerUserID,
+		InviteeUserID: inviteeUserID,
+		Now:           f.now,
+		ExpiresAt:     f.game.EnrollmentEndsAt,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.invites.Save(context.Background(), rec))
+	return rec
+}
+
+func (f *closeFixture) deps() shared.CloseEnrollmentDeps {
+	return shared.CloseEnrollmentDeps{
+		Games:   f.games,
+		Invites: f.invites,
+		Intents: f.intents,
+		Logger:  silentLogger(),
+	}
+}
+
+func TestCloseEnrollmentTransitionsGameAndExpiresInvites(t *testing.T) {
+	t.Parallel()
+	f := newCloseFixture(t)
+	f.addCreatedInvite(t, "invite-1", "user-a")
+	f.addCreatedInvite(t, "invite-2", "user-b")
+
+	updated, err := shared.CloseEnrollment(
+		context.Background(),
+		f.deps(),
+		f.game.GameID,
+		game.TriggerManual,
+		f.now.Add(time.Minute),
+	)
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusReadyToStart, updated.Status)
+
+	first, err := f.invites.Get(context.Background(), "invite-1")
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusExpired, first.Status)
+
+	second, err := f.invites.Get(context.Background(), "invite-2")
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusExpired, second.Status)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 2)
+	for _, intent := range intents {
+		assert.Equal(t, notificationintent.NotificationTypeLobbyInviteExpired, intent.NotificationType)
+		assert.Equal(t, []string{closeOwnerUserID}, intent.RecipientUserIDs)
+	}
+}
+
+func TestCloseEnrollmentLeavesNonCreatedInvitesUntouched(t *testing.T) {
+	t.Parallel()
+	f := newCloseFixture(t)
+	created := f.addCreatedInvite(t, "invite-1", "user-a")
+	declined := f.addCreatedInvite(t, "invite-2", "user-b")
+
+	require.NoError(t, f.invites.UpdateStatus(context.Background(), ports.UpdateInviteStatusInput{
+		InviteID:     declined.InviteID,
+		ExpectedFrom: invite.StatusCreated,
+		To:           invite.StatusDeclined,
+		At:           f.now,
+	}))
+
+	_, err := shared.CloseEnrollment(
+		context.Background(),
+		f.deps(),
+		f.game.GameID,
+		game.TriggerManual,
+		f.now.Add(time.Minute),
+	)
+	require.NoError(t, err)
+
+	createdAfter, err := f.invites.Get(context.Background(), created.InviteID)
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusExpired, createdAfter.Status)
+
+	declinedAfter, err := f.invites.Get(context.Background(), declined.InviteID)
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusDeclined, declinedAfter.Status)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+}
+
+func TestCloseEnrollmentSurfacesGameConflict(t *testing.T) {
+	t.Parallel()
+	f := newCloseFixture(t)
+	f.addCreatedInvite(t, "invite-1", "user-a")
+
+	rec, err := f.games.Get(context.Background(), f.game.GameID)
+	require.NoError(t, err)
+	rec.Status = game.StatusDraft
+	require.NoError(t, f.games.Save(context.Background(), rec))
+
+	_, err = shared.CloseEnrollment(
+		context.Background(),
+		f.deps(),
+		f.game.GameID,
+		game.TriggerManual,
+		f.now.Add(time.Minute),
+	)
+	require.ErrorIs(t, err, game.ErrConflict)
+
+	stillCreated, err := f.invites.Get(context.Background(), "invite-1")
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusCreated, stillCreated.Status)
+	assert.Empty(t, f.intents.Published())
+}
+
+func TestCloseEnrollmentSwallowsIntentPublishFailure(t *testing.T) {
+	t.Parallel()
+	f := newCloseFixture(t)
+	f.addCreatedInvite(t, "invite-1", "user-a")
+	f.intents.SetError(errors.New("publisher offline"))
+
+	updated, err := shared.CloseEnrollment(
+		context.Background(),
+		f.deps(),
+		f.game.GameID,
+		game.TriggerManual,
+		f.now.Add(time.Minute),
+	)
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusReadyToStart, updated.Status)
+
+	expired, err := f.invites.Get(context.Background(), "invite-1")
+	require.NoError(t, err)
+	assert.Equal(t, invite.StatusExpired, expired.Status)
+}
+
+func TestCloseEnrollmentIsIdempotentOnSecondCall(t *testing.T) {
+	t.Parallel()
+	f := newCloseFixture(t)
+	f.addCreatedInvite(t, "invite-1", "user-a")
+
+	_, err := shared.CloseEnrollment(
+		context.Background(),
+		f.deps(),
+		f.game.GameID,
+		game.TriggerManual,
+		f.now.Add(time.Minute),
+	)
+	require.NoError(t, err)
+	assert.Len(t, f.intents.Published(), 1)
+
+	_, err = shared.CloseEnrollment(
+		context.Background(),
+		f.deps(),
+		f.game.GameID,
+		game.TriggerManual,
+		f.now.Add(2*time.Minute),
+	)
+	require.ErrorIs(t, err, game.ErrConflict)
+	assert.Len(t, f.intents.Published(), 1)
+}
+
+func TestCloseEnrollmentRejectsUnknownTrigger(t *testing.T) {
+	t.Parallel()
+	f := newCloseFixture(t)
+
+	_, err := shared.CloseEnrollment(
+		context.Background(),
+		f.deps(),
+		f.game.GameID,
+		game.Trigger("bogus"),
+		f.now,
+	)
+	require.Error(t, err)
+}

lobby/internal/service/shared/page.go

@@ -0,0 +1,99 @@
+package shared
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strconv"
+)
+
+// DefaultPageSize is the default page_size returned when callers omit the
+// query parameter on list endpoints. It mirrors the OpenAPI
+// schema default declared in lobby/api/public-openapi.yaml.
+const DefaultPageSize = 50
+
+// MaxPageSize bounds the page_size parameter on list endpoints.
+// It mirrors the OpenAPI schema maximum declared in
+// lobby/api/public-openapi.yaml.
+const MaxPageSize = 200
+
+// Page describes a service-level pagination request derived from the
+// transport-layer page_size + page_token parameters. The service is
+// expected to assemble the full in-memory candidate slice, sort it
+// deterministically, and then call Window to compute the slice indices
+// to return alongside the optional continuation token.
+type Page struct {
+	// Size stores the maximum number of items returned in one page.
+	Size int
+
+	// Offset stores the zero-based position of the first item to return.
+	Offset int
+}
+
+// ParsePage decodes the raw transport values into a Page. Both arguments
+// are interpreted exactly as received from the request: the empty
+// rawSize string falls back to DefaultPageSize, and the empty rawToken
+// string represents an initial fetch starting at offset zero. Any
+// validation failure returns an error whose message starts with
+// "invalid " so the public-port writeErrorFromService helper translates
+// it into the OpenAPI-shaped invalid_request envelope.
+func ParsePage(rawSize, rawToken string) (Page, error) {
+	page := Page{Size: DefaultPageSize}
+	if rawSize != "" {
+		n, err := strconv.Atoi(rawSize)
+		if err != nil {
+			return Page{}, fmt.Errorf("invalid page_size: %s is not an integer", rawSize)
+		}
+		if n < 1 || n > MaxPageSize {
+			return Page{}, fmt.Errorf(
+				"invalid page_size: %d must be between 1 and %d",
+				n, MaxPageSize,
+			)
+		}
+		page.Size = n
+	}
+	if rawToken != "" {
+		decoded, err := base64.RawURLEncoding.DecodeString(rawToken)
+		if err != nil {
+			return Page{}, fmt.Errorf("invalid page_token: not a base64url value")
+		}
+		n, err := strconv.Atoi(string(decoded))
+		if err != nil {
+			return Page{}, fmt.Errorf("invalid page_token: payload is not an integer")
+		}
+		if n < 0 {
+			return Page{}, fmt.Errorf("invalid page_token: payload must not be negative")
+		}
+		page.Offset = n
+	}
+	return page, nil
+}
+
+// EncodeToken returns the opaque continuation token that callers pass
+// back as page_token on the next request to fetch the next page. The
+// encoding is RFC 4648 §5 base64url without padding so the value is safe
+// to embed in URLs without further escaping.
+func EncodeToken(offset int) string {
+	return base64.RawURLEncoding.EncodeToString([]byte(strconv.Itoa(offset)))
+}
+
+// Window computes the slice indices and next-page metadata for a
+// candidate slice of length n given page. start is clamped to [0, n]
+// and end to [start, min(n, start+page.Size)]; nextOffset is set to end
+// when more candidates remain after end, and zero otherwise. hasMore
+// reports whether the caller should emit a non-empty next_page_token.
+func Window(n int, page Page) (start, end, nextOffset int, hasMore bool) {
+	if n < 0 {
+		n = 0
+	}
+	size := page.Size
+	if size <= 0 {
+		size = DefaultPageSize
+	}
+	start = max(page.Offset, 0)
+	start = min(start, n)
+	end = min(start+size, n)
+	if end < n {
+		return start, end, end, true
+	}
+	return start, end, 0, false
+}

lobby/internal/service/shared/page_test.go

@@ -0,0 +1,125 @@
+package shared_test
+
+import (
+	"encoding/base64"
+	"strconv"
+	"testing"
+
+	"galaxy/lobby/internal/service/shared"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsePageDefaults(t *testing.T) {
+	t.Parallel()
+
+	page, err := shared.ParsePage("", "")
+	require.NoError(t, err)
+	require.Equal(t, shared.Page{Size: shared.DefaultPageSize, Offset: 0}, page)
+}
+
+func TestParsePageHonoursSize(t *testing.T) {
+	t.Parallel()
+
+	page, err := shared.ParsePage("75", "")
+	require.NoError(t, err)
+	require.Equal(t, shared.Page{Size: 75, Offset: 0}, page)
+}
+
+func TestParsePageHonoursToken(t *testing.T) {
+	t.Parallel()
+
+	token := shared.EncodeToken(150)
+	page, err := shared.ParsePage("", token)
+	require.NoError(t, err)
+	require.Equal(t, shared.Page{Size: shared.DefaultPageSize, Offset: 150}, page)
+}
+
+func TestParsePageRejectsBadSize(t *testing.T) {
+	t.Parallel()
+
+	cases := []string{"abc", "0", "-3", strconv.Itoa(shared.MaxPageSize + 1)}
+	for _, raw := range cases {
+		t.Run(raw, func(t *testing.T) {
+			t.Parallel()
+			_, err := shared.ParsePage(raw, "")
+			require.Error(t, err)
+			require.Contains(t, err.Error(), "invalid page_size")
+		})
+	}
+}
+
+func TestParsePageRejectsBadToken(t *testing.T) {
+	t.Parallel()
+
+	negative := base64.RawURLEncoding.EncodeToString([]byte("-1"))
+	notInt := base64.RawURLEncoding.EncodeToString([]byte("abc"))
+
+	cases := []string{"!!!", negative, notInt}
+	for _, raw := range cases {
+		t.Run(raw, func(t *testing.T) {
+			t.Parallel()
+			_, err := shared.ParsePage("", raw)
+			require.Error(t, err)
+			require.Contains(t, err.Error(), "invalid page_token")
+		})
+	}
+}
+
+func TestEncodeTokenRoundtrip(t *testing.T) {
+	t.Parallel()
+
+	token := shared.EncodeToken(42)
+	page, err := shared.ParsePage("", token)
+	require.NoError(t, err)
+	require.Equal(t, 42, page.Offset)
+}
+
+func TestWindowFirstPageWithMore(t *testing.T) {
+	t.Parallel()
+
+	start, end, nextOffset, hasMore := shared.Window(120, shared.Page{Size: 50})
+	require.Equal(t, 0, start)
+	require.Equal(t, 50, end)
+	require.Equal(t, 50, nextOffset)
+	require.True(t, hasMore)
+}
+
+func TestWindowMiddlePage(t *testing.T) {
+	t.Parallel()
+
+	start, end, nextOffset, hasMore := shared.Window(120, shared.Page{Size: 50, Offset: 50})
+	require.Equal(t, 50, start)
+	require.Equal(t, 100, end)
+	require.Equal(t, 100, nextOffset)
+	require.True(t, hasMore)
+}
+
+func TestWindowLastPageExact(t *testing.T) {
+	t.Parallel()
+
+	start, end, nextOffset, hasMore := shared.Window(100, shared.Page{Size: 50, Offset: 50})
+	require.Equal(t, 50, start)
+	require.Equal(t, 100, end)
+	require.Equal(t, 0, nextOffset)
+	require.False(t, hasMore)
+}
+
+func TestWindowOffsetPastEnd(t *testing.T) {
+	t.Parallel()
+
+	start, end, nextOffset, hasMore := shared.Window(10, shared.Page{Size: 50, Offset: 200})
+	require.Equal(t, 10, start)
+	require.Equal(t, 10, end)
+	require.Equal(t, 0, nextOffset)
+	require.False(t, hasMore)
+}
+
+func TestWindowZeroSizeFallsBackToDefault(t *testing.T) {
+	t.Parallel()
+
+	start, end, _, hasMore := shared.Window(120, shared.Page{Size: 0})
+	require.Equal(t, 0, start)
+	require.Equal(t, shared.DefaultPageSize, end)
+	require.True(t, hasMore)
+}

lobby/internal/service/shared/roster.go

@@ -0,0 +1,33 @@
+package shared
+
+import (
+	"context"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+)
+
+// CountActiveMemberships returns the number of memberships in
+// membership.StatusActive attached to gameID. It is used by the
+// application services (submitapplication, approveapplication) to
+// evaluate the max_players + start_gap_players roster cap and the
+// gap-window activation threshold without each service re-implementing
+// the same scan + filter.
+func CountActiveMemberships(
+	ctx context.Context,
+	store ports.MembershipStore,
+	gameID common.GameID,
+) (int, error) {
+	records, err := store.GetByGame(ctx, gameID)
+	if err != nil {
+		return 0, err
+	}
+	count := 0
+	for _, record := range records {
+		if record.Status == membership.StatusActive {
+			count++
+		}
+	}
+	return count, nil
+}

lobby/internal/service/shared/shared.go

@@ -0,0 +1,118 @@
+// Package shared defines cross-service primitives used by Game Lobby
+// application services: the Actor identity carried into every service
+// call, the authorization sentinel errors translated to the
+// `forbidden` HTTP code at the transport boundary, and the helpers
+// that derive one from a transport layer.
+package shared
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// ActorKind identifies the caller class of one Lobby service operation.
+type ActorKind string
+
+const (
+	// ActorKindAdmin reports that the caller is Admin Service routed through
+	// the internal trusted HTTP port. Admin callers are pre-authorized by the
+	// admin role check that Admin Service performs at the gateway boundary
+	// before forwarding the request.
+	ActorKindAdmin ActorKind = "admin"
+
+	// ActorKindUser reports that the caller is an authenticated platform user
+	// routed through Edge Gateway. User callers are identified by the
+	// `X-User-ID` header injected by Edge Gateway.
+	ActorKindUser ActorKind = "user"
+)
+
+// IsKnown reports whether kind belongs to the frozen actor-kind vocabulary.
+func (kind ActorKind) IsKnown() bool {
+	switch kind {
+	case ActorKindAdmin, ActorKindUser:
+		return true
+	default:
+		return false
+	}
+}
+
+// Actor identifies the caller of one Lobby service operation. User actors
+// carry a non-empty UserID; admin actors carry an empty UserID.
+type Actor struct {
+	// Kind reports the caller class.
+	Kind ActorKind
+
+	// UserID stores the platform user identifier for ActorKindUser callers.
+	// It must be empty for ActorKindAdmin callers.
+	UserID string
+}
+
+// NewAdminActor returns one Actor that identifies the trusted admin caller.
+func NewAdminActor() Actor {
+	return Actor{Kind: ActorKindAdmin}
+}
+
+// NewUserActor returns one Actor that identifies the user caller with userID.
+func NewUserActor(userID string) Actor {
+	return Actor{Kind: ActorKindUser, UserID: userID}
+}
+
+// IsAdmin reports whether actor is the trusted admin caller.
+func (actor Actor) IsAdmin() bool {
+	return actor.Kind == ActorKindAdmin
+}
+
+// IsUser reports whether actor is an authenticated platform user.
+func (actor Actor) IsUser() bool {
+	return actor.Kind == ActorKindUser
+}
+
+// Validate reports whether actor carries a structurally valid identity.
+// Admin actors must not carry a user identifier; user actors must carry a
+// non-empty trimmed user identifier.
+func (actor Actor) Validate() error {
+	if !actor.Kind.IsKnown() {
+		return fmt.Errorf("actor kind %q is unsupported", actor.Kind)
+	}
+	switch actor.Kind {
+	case ActorKindAdmin:
+		if strings.TrimSpace(actor.UserID) != "" {
+			return fmt.Errorf("admin actor must not carry a user id")
+		}
+	case ActorKindUser:
+		if strings.TrimSpace(actor.UserID) == "" {
+			return fmt.Errorf("user actor must carry a non-empty user id")
+		}
+		if strings.TrimSpace(actor.UserID) != actor.UserID {
+			return fmt.Errorf("user actor id must not contain surrounding whitespace")
+		}
+	}
+
+	return nil
+}
+
+// ErrForbidden reports that the caller is not authorized for the requested
+// operation on the requested resource. The transport layer translates it to
+// the HTTP `403 forbidden` error envelope.
+var ErrForbidden = errors.New("forbidden")
+
+// ErrEligibilityDenied reports that the User Service eligibility snapshot
+// rejected the acting user for the requested operation. It covers both
+// "user not found" (Exists=false) and any sanction or marker that
+// collapses the relevant `can_*` flag to false. The transport layer
+// translates it to the HTTP `422 eligibility_denied` envelope.
+var ErrEligibilityDenied = errors.New("eligibility denied")
+
+// ErrServiceUnavailable reports that an upstream synchronous dependency
+// (User Service, Game Master, etc.) is unreachable or violated its
+// contract. The transport layer translates it to the HTTP
+// `503 service_unavailable` envelope.
+var ErrServiceUnavailable = errors.New("service unavailable")
+
+// ErrSubjectNotFound reports that the operation references a subject
+// (a user, a pending race-name registration, etc.) that is not present
+// in the relevant store and is not naturally surfaced through one of
+// the domain `ErrNotFound` sentinels. The transport layer translates
+// it to the HTTP `404 subject_not_found` envelope.
+var ErrSubjectNotFound = errors.New("subject not found")

lobby/internal/service/shared/shared_test.go

@@ -0,0 +1,85 @@
+package shared
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestActorKindIsKnown(t *testing.T) {
+	t.Parallel()
+
+	require.True(t, ActorKindAdmin.IsKnown())
+	require.True(t, ActorKindUser.IsKnown())
+	require.False(t, ActorKind("").IsKnown())
+	require.False(t, ActorKind("other").IsKnown())
+}
+
+func TestNewActorConstructors(t *testing.T) {
+	t.Parallel()
+
+	admin := NewAdminActor()
+	require.True(t, admin.IsAdmin())
+	require.False(t, admin.IsUser())
+	require.Equal(t, "", admin.UserID)
+
+	user := NewUserActor("user-123")
+	require.True(t, user.IsUser())
+	require.False(t, user.IsAdmin())
+	require.Equal(t, "user-123", user.UserID)
+}
+
+func TestActorValidate(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		actor   Actor
+		wantErr string
+	}{
+		{name: "admin ok", actor: NewAdminActor()},
+		{name: "user ok", actor: NewUserActor("user-42")},
+		{name: "unknown kind", actor: Actor{Kind: "ghost"}, wantErr: "actor kind"},
+		{name: "admin with user id", actor: Actor{Kind: ActorKindAdmin, UserID: "user-1"}, wantErr: "admin actor must not carry"},
+		{name: "user without id", actor: Actor{Kind: ActorKindUser}, wantErr: "user actor must carry"},
+		{name: "user id with whitespace", actor: Actor{Kind: ActorKindUser, UserID: " user-1 "}, wantErr: "whitespace"},
+		{name: "user id empty trimmed", actor: Actor{Kind: ActorKindUser, UserID: "  "}, wantErr: "user actor must carry"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := tt.actor.Validate()
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			require.Contains(t, err.Error(), tt.wantErr)
+		})
+	}
+}
+
+func TestErrForbiddenIsStable(t *testing.T) {
+	t.Parallel()
+
+	wrapped := errors.New("forbidden: actor kind is admin; private games require user caller")
+	require.False(t, errors.Is(wrapped, ErrForbidden))
+
+	wrapped = errInvalid("forbidden: not owner")
+	require.True(t, errors.Is(wrapped, ErrForbidden))
+}
+
+func errInvalid(msg string) error {
+	return wrappedError{msg: msg, base: ErrForbidden}
+}
+
+type wrappedError struct {
+	msg  string
+	base error
+}
+
+func (err wrappedError) Error() string { return err.msg }
+func (err wrappedError) Unwrap() error { return err.base }

lobby/internal/service/startgame/service.go

@@ -0,0 +1,187 @@
+// Package startgame implements the `lobby.game.start` message type. It
+// validates the actor authorization, transitions the game from
+// `ready_to_start` to `starting` via a CAS update, and publishes the
+// start job to Runtime Manager. The remainder of the start sequence
+// (Runtime Manager result + Game Master registration) lives in the
+// runtimejobresult worker.
+package startgame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+)
+
+// Service executes the start-game use case.
+type Service struct {
+	games          ports.GameStore
+	runtimeManager ports.RuntimeManager
+	clock          func() time.Time
+	logger         *slog.Logger
+	telemetry      *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games mediates the CAS status transition and the result read.
+	Games ports.GameStore
+
+	// RuntimeManager publishes the start job after the CAS succeeds.
+	RuntimeManager ports.RuntimeManager
+
+	// Clock supplies the wall-clock used for UpdatedAt. Defaults to
+	// time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.game.transitions` counter on each
+	// successful start. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new start game service: nil game store")
+	case deps.RuntimeManager == nil:
+		return nil, errors.New("new start game service: nil runtime manager")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:          deps.Games,
+		runtimeManager: deps.RuntimeManager,
+		clock:          clock,
+		logger:         logger.With("service", "lobby.startgame"),
+		telemetry:      deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to start one game.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the target game record.
+	GameID common.GameID
+}
+
+// Handle authorizes the actor, asserts the game is in `ready_to_start`,
+// transitions it to `starting`, and publishes the start job to Runtime
+// Manager. The CAS guarantees that two concurrent start commands cannot
+// both succeed.
+//
+// On Runtime Manager publish failure the game record stays in
+// `starting`; the caller is informed through the returned error. The
+// next start attempt will be rejected with game.ErrConflict because the
+// status is no longer `ready_to_start`. The runtimejobresult worker
+// resolves the situation when (or if) a job result later arrives;
+// otherwise an admin must intervene through tooling. This
+// trade-off is documented in the decision record.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("start game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("start game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("start game: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("start game: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("start game: %w", err)
+	}
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+	if record.Status != game.StatusReadyToStart {
+		return game.Game{}, fmt.Errorf(
+			"start game: status %q is not %q: %w",
+			record.Status, game.StatusReadyToStart, game.ErrConflict,
+		)
+	}
+
+	at := service.clock().UTC()
+	if err := service.games.UpdateStatus(ctx, ports.UpdateStatusInput{
+		GameID:       input.GameID,
+		ExpectedFrom: game.StatusReadyToStart,
+		To:           game.StatusStarting,
+		Trigger:      game.TriggerCommand,
+		At:           at,
+	}); err != nil {
+		return game.Game{}, fmt.Errorf("start game: %w", err)
+	}
+
+	service.telemetry.RecordGameTransition(ctx,
+		string(game.StatusReadyToStart),
+		string(game.StatusStarting),
+		string(game.TriggerCommand),
+	)
+
+	if err := service.runtimeManager.PublishStartJob(ctx, input.GameID.String()); err != nil {
+		// Status is already `starting` and the domain forbids a direct
+		// rollback to `ready_to_start`. We surface the publish error to
+		// the caller; the game stays in `starting` until either a
+		// runtime job result arrives (worker handles the outcome) or an
+		// admin intervenes manually.
+		service.logger.ErrorContext(ctx, "publish runtime start job",
+			"game_id", input.GameID.String(),
+			"err", err.Error(),
+		)
+		return game.Game{}, fmt.Errorf("start game: %w", errors.Join(shared.ErrServiceUnavailable, err))
+	}
+
+	updated, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("start game: %w", err)
+	}
+
+	logArgs := []any{
+		"game_id", updated.GameID.String(),
+		"from_status", string(game.StatusReadyToStart),
+		"to_status", string(updated.Status),
+		"trigger", string(game.TriggerCommand),
+		"actor_kind", string(input.Actor.Kind),
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "game start job published", logArgs...)
+	return updated, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to start game %q",
+		shared.ErrForbidden, record.GameID.String())
+}

lobby/internal/service/startgame/service_test.go

@@ -0,0 +1,209 @@
+package startgame_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/runtimemanagerstub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/service/startgame"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+func newReadyGame(t *testing.T, gameType game.GameType, ownerID string) (game.Game, time.Time) {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 12, 0, 0, 0, time.UTC)
+	record, err := game.New(game.NewGameInput{
+		GameID:              common.GameID("game-1"),
+		GameName:            "test game",
+		GameType:            gameType,
+		OwnerUserID:         ownerID,
+		MinPlayers:          4,
+		MaxPlayers:          8,
+		StartGapHours:       12,
+		StartGapPlayers:     2,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 18 * * *",
+		TargetEngineVersion: "v1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	record.Status = game.StatusReadyToStart
+	return record, now
+}
+
+type fixture struct {
+	games   *gamestub.Store
+	runtime *runtimemanagerstub.Publisher
+	service *startgame.Service
+	now     time.Time
+}
+
+func newFixture(t *testing.T, record game.Game, now time.Time) *fixture {
+	t.Helper()
+	games := gamestub.NewStore()
+	require.NoError(t, games.Save(context.Background(), record))
+	runtime := runtimemanagerstub.NewPublisher()
+	service, err := startgame.NewService(startgame.Dependencies{
+		Games:          games,
+		RuntimeManager: runtime,
+		Clock:          fixedClock(now.Add(time.Hour)),
+		Logger:         silentLogger(),
+	})
+	require.NoError(t, err)
+	return &fixture{games: games, runtime: runtime, service: service, now: now}
+}
+
+func TestNewServiceRejectsMissingDeps(t *testing.T) {
+	_, err := startgame.NewService(startgame.Dependencies{
+		RuntimeManager: runtimemanagerstub.NewPublisher(),
+	})
+	require.Error(t, err)
+
+	_, err = startgame.NewService(startgame.Dependencies{
+		Games: gamestub.NewStore(),
+	})
+	require.Error(t, err)
+}
+
+func TestStartGamePublicAdminHappyPath(t *testing.T) {
+	record, now := newReadyGame(t, game.GameTypePublic, "")
+	f := newFixture(t, record, now)
+
+	updated, err := f.service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusStarting, updated.Status)
+	assert.Equal(t, []string{record.GameID.String()}, f.runtime.StartJobs())
+	assert.Empty(t, f.runtime.StopJobs())
+}
+
+func TestStartGamePrivateOwnerHappyPath(t *testing.T) {
+	record, now := newReadyGame(t, game.GameTypePrivate, "user-owner")
+	f := newFixture(t, record, now)
+
+	updated, err := f.service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewUserActor("user-owner"),
+		GameID: record.GameID,
+	})
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusStarting, updated.Status)
+	assert.Equal(t, []string{record.GameID.String()}, f.runtime.StartJobs())
+}
+
+func TestStartGameRejectsNonOwnerUser(t *testing.T) {
+	record, now := newReadyGame(t, game.GameTypePrivate, "user-owner")
+	f := newFixture(t, record, now)
+
+	_, err := f.service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewUserActor("user-other"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+	assert.Empty(t, f.runtime.StartJobs(), "no start job published on forbidden")
+
+	stored, err := f.games.Get(context.Background(), record.GameID)
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusReadyToStart, stored.Status, "status must remain ready_to_start")
+}
+
+func TestStartGameRejectsPublicUserActor(t *testing.T) {
+	record, now := newReadyGame(t, game.GameTypePublic, "")
+	f := newFixture(t, record, now)
+
+	_, err := f.service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewUserActor("user-1"),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestStartGameRejectsWrongStatus(t *testing.T) {
+	record, now := newReadyGame(t, game.GameTypePublic, "")
+	record.Status = game.StatusEnrollmentOpen
+	f := newFixture(t, record, now)
+
+	_, err := f.service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+	assert.Empty(t, f.runtime.StartJobs())
+}
+
+func TestStartGameRejectsCASLossOnRecentTransition(t *testing.T) {
+	record, now := newReadyGame(t, game.GameTypePublic, "")
+	f := newFixture(t, record, now)
+
+	// Concurrent start: simulate someone moved status to starting.
+	require.NoError(t, f.games.UpdateStatus(context.Background(), ports.UpdateStatusInput{
+		GameID:       record.GameID,
+		ExpectedFrom: game.StatusReadyToStart,
+		To:           game.StatusStarting,
+		Trigger:      game.TriggerCommand,
+		At:           now.Add(time.Minute),
+	}))
+
+	_, err := f.service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+	assert.Empty(t, f.runtime.StartJobs())
+}
+
+func TestStartGamePublishFailureSurfacesUnavailable(t *testing.T) {
+	record, now := newReadyGame(t, game.GameTypePublic, "")
+	f := newFixture(t, record, now)
+	f.runtime.SetStartError(errors.New("redis down"))
+
+	_, err := f.service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: record.GameID,
+	})
+	require.Error(t, err)
+	assert.ErrorIs(t, err, shared.ErrServiceUnavailable)
+
+	stored, err := f.games.Get(context.Background(), record.GameID)
+	require.NoError(t, err)
+	assert.Equal(t, game.StatusStarting, stored.Status,
+		"status remains starting; runtime worker resolves orphan via job result")
+}
+
+func TestStartGameRejectsMissingRecord(t *testing.T) {
+	games := gamestub.NewStore()
+	runtime := runtimemanagerstub.NewPublisher()
+	service, err := startgame.NewService(startgame.Dependencies{
+		Games:          games,
+		RuntimeManager: runtime,
+		Clock:          fixedClock(time.Now().UTC()),
+		Logger:         silentLogger(),
+	})
+	require.NoError(t, err)
+
+	_, err = service.Handle(context.Background(), startgame.Input{
+		Actor:  shared.NewAdminActor(),
+		GameID: common.GameID("game-missing"),
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}

lobby/internal/service/submitapplication/service.go

@@ -0,0 +1,279 @@
+// Package submitapplication implements the `lobby.application.submit`
+// message type. It validates the request against the public-game
+// enrollment rules, calls UserService for eligibility, checks race name
+// availability through the Race Name Directory, persists the new
+// submitted application via ApplicationStore, and publishes the
+// `lobby.application.submitted` notification intent.
+package submitapplication
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/logging"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/telemetry"
+	"galaxy/notificationintent"
+)
+
+// Service executes the public-game application submission use case.
+type Service struct {
+	games        ports.GameStore
+	memberships  ports.MembershipStore
+	applications ports.ApplicationStore
+	users        ports.UserService
+	directory    ports.RaceNameDirectory
+	intents      ports.IntentPublisher
+	ids          ports.IDGenerator
+	clock        func() time.Time
+	logger       *slog.Logger
+	telemetry    *telemetry.Runtime
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games loads the target game record for enrollment validation.
+	Games ports.GameStore
+
+	// Memberships is consulted for the active-member roster count used
+	// to enforce the max_players + start_gap_players capacity guard.
+	Memberships ports.MembershipStore
+
+	// Applications persists the new submitted record.
+	Applications ports.ApplicationStore
+
+	// Users resolves the synchronous eligibility snapshot.
+	Users ports.UserService
+
+	// Directory checks race name availability.
+	Directory ports.RaceNameDirectory
+
+	// Intents publishes the lobby.application.submitted intent.
+	Intents ports.IntentPublisher
+
+	// IDs mints the new opaque application identifier.
+	IDs ports.IDGenerator
+
+	// Clock supplies the wall-clock used for CreatedAt and the
+	// notification's OccurredAt. Defaults to time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+
+	// Telemetry records the `lobby.application.outcomes` counter on each
+	// successful submission. Optional; nil disables metric emission.
+	Telemetry *telemetry.Runtime
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	switch {
+	case deps.Games == nil:
+		return nil, errors.New("new submit application service: nil game store")
+	case deps.Memberships == nil:
+		return nil, errors.New("new submit application service: nil membership store")
+	case deps.Applications == nil:
+		return nil, errors.New("new submit application service: nil application store")
+	case deps.Users == nil:
+		return nil, errors.New("new submit application service: nil user service")
+	case deps.Directory == nil:
+		return nil, errors.New("new submit application service: nil race name directory")
+	case deps.Intents == nil:
+		return nil, errors.New("new submit application service: nil intent publisher")
+	case deps.IDs == nil:
+		return nil, errors.New("new submit application service: nil id generator")
+	}
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Service{
+		games:        deps.Games,
+		memberships:  deps.Memberships,
+		applications: deps.Applications,
+		users:        deps.Users,
+		directory:    deps.Directory,
+		intents:      deps.Intents,
+		ids:          deps.IDs,
+		clock:        clock,
+		logger:       logger.With("service", "lobby.submitapplication"),
+		telemetry:    deps.Telemetry,
+	}, nil
+}
+
+// Input stores the arguments required to submit one application.
+type Input struct {
+	// Actor identifies the caller. Must be ActorKindUser.
+	Actor shared.Actor
+
+	// GameID identifies the target game.
+	GameID common.GameID
+
+	// RaceName stores the desired in-game name in original casing.
+	RaceName string
+}
+
+// Handle validates input, authorizes the actor, verifies eligibility and
+// race name availability, persists the new submitted application, and
+// publishes the lobby.application.submitted intent on success.
+func (service *Service) Handle(ctx context.Context, input Input) (application.Application, error) {
+	if service == nil {
+		return application.Application{}, errors.New("submit application: nil service")
+	}
+	if ctx == nil {
+		return application.Application{}, errors.New("submit application: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return application.Application{}, fmt.Errorf("submit application: actor: %w", err)
+	}
+	if !input.Actor.IsUser() {
+		return application.Application{}, fmt.Errorf(
+			"%w: only authenticated users may submit applications",
+			shared.ErrForbidden,
+		)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return application.Application{}, fmt.Errorf("submit application: %w", err)
+	}
+
+	gameRecord, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return application.Application{}, fmt.Errorf("submit application: %w", err)
+	}
+	if gameRecord.GameType != game.GameTypePublic {
+		return application.Application{}, fmt.Errorf(
+			"submit application: game %q is not public: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+	if gameRecord.Status != game.StatusEnrollmentOpen {
+		return application.Application{}, fmt.Errorf(
+			"submit application: game %q is not in enrollment_open: %w",
+			gameRecord.GameID, game.ErrConflict,
+		)
+	}
+
+	eligibility, err := service.users.GetEligibility(ctx, input.Actor.UserID)
+	if err != nil {
+		return application.Application{}, fmt.Errorf(
+			"submit application: %w: %w",
+			shared.ErrServiceUnavailable, err,
+		)
+	}
+	if !eligibility.Exists || !eligibility.CanJoinGame {
+		return application.Application{}, fmt.Errorf(
+			"%w: user is not eligible to join games",
+			shared.ErrEligibilityDenied,
+		)
+	}
+
+	if err := service.checkRosterCapacity(ctx, gameRecord); err != nil {
+		return application.Application{}, err
+	}
+
+	availability, err := service.directory.Check(ctx, input.RaceName, input.Actor.UserID)
+	if err != nil {
+		return application.Application{}, fmt.Errorf("submit application: %w", err)
+	}
+	if availability.Taken {
+		return application.Application{}, fmt.Errorf(
+			"submit application: race name held by another user: %w",
+			ports.ErrNameTaken,
+		)
+	}
+
+	applicationID, err := service.ids.NewApplicationID()
+	if err != nil {
+		return application.Application{}, fmt.Errorf("submit application: %w", err)
+	}
+
+	now := service.clock().UTC()
+	record, err := application.New(application.NewApplicationInput{
+		ApplicationID:   applicationID,
+		GameID:          input.GameID,
+		ApplicantUserID: input.Actor.UserID,
+		RaceName:        input.RaceName,
+		Now:             now,
+	})
+	if err != nil {
+		return application.Application{}, fmt.Errorf("submit application: %w", err)
+	}
+
+	if err := service.applications.Save(ctx, record); err != nil {
+		return application.Application{}, fmt.Errorf("submit application: %w", err)
+	}
+
+	intent, err := notificationintent.NewPublicLobbyApplicationSubmittedIntent(
+		notificationintent.Metadata{
+			IdempotencyKey: "lobby.application.submitted:" + record.ApplicationID.String(),
+			OccurredAt:     now,
+		},
+		notificationintent.LobbyApplicationSubmittedPayload{
+			GameID:          gameRecord.GameID.String(),
+			GameName:        gameRecord.GameName,
+			ApplicantUserID: record.ApplicantUserID,
+			ApplicantName:   record.RaceName,
+		},
+	)
+	if err != nil {
+		// Building the intent failed: this is a programmer error
+		// (mismatched payload contract), not a transport failure.
+		// Log and proceed — the application is already committed.
+		service.logger.ErrorContext(ctx, "build application submitted intent",
+			"application_id", record.ApplicationID.String(),
+			"err", err.Error(),
+		)
+	} else if _, publishErr := service.intents.Publish(ctx, intent); publishErr != nil {
+		// Notification degradation per README §Notification Contracts:
+		// do not roll back business state.
+		service.logger.WarnContext(ctx, "publish application submitted intent",
+			"application_id", record.ApplicationID.String(),
+			"err", publishErr.Error(),
+		)
+	}
+
+	service.telemetry.RecordApplicationOutcome(ctx, "submitted")
+
+	logArgs := []any{
+		"game_id", record.GameID.String(),
+		"game_type", string(gameRecord.GameType),
+		"game_status", string(gameRecord.Status),
+		"application_id", record.ApplicationID.String(),
+		"user_id", record.ApplicantUserID,
+		"race_name", record.RaceName,
+	}
+	logArgs = append(logArgs, logging.ContextAttrs(ctx)...)
+	service.logger.InfoContext(ctx, "application submitted", logArgs...)
+	return record, nil
+}
+
+// checkRosterCapacity counts active memberships for gameRecord and
+// returns game.ErrConflict when the roster has reached the gap-window
+// upper bound (max_players + start_gap_players).
+func (service *Service) checkRosterCapacity(ctx context.Context, gameRecord game.Game) error {
+	cap := gameRecord.MaxPlayers + gameRecord.StartGapPlayers
+	count, err := shared.CountActiveMemberships(ctx, service.memberships, gameRecord.GameID)
+	if err != nil {
+		return fmt.Errorf("submit application: %w", err)
+	}
+	if count >= cap {
+		return fmt.Errorf(
+			"submit application: roster full (%d active >= %d cap): %w",
+			count, cap, game.ErrConflict,
+		)
+	}
+	return nil
+}

lobby/internal/service/submitapplication/service_test.go

@@ -0,0 +1,335 @@
+package submitapplication_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/applicationstub"
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/adapters/intentpubstub"
+	"galaxy/lobby/internal/adapters/membershipstub"
+	"galaxy/lobby/internal/adapters/racenamestub"
+	"galaxy/lobby/internal/adapters/userservicestub"
+	"galaxy/lobby/internal/domain/application"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/domain/membership"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/service/submitapplication"
+	"galaxy/notificationintent"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	defaultRaceName = "SolarPilot"
+	otherRaceName   = "VoidRunner"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+type fixedIDs struct {
+	applicationID common.ApplicationID
+	membershipID  common.MembershipID
+}
+
+func (f fixedIDs) NewGameID() (common.GameID, error) { return "", errors.New("not used") }
+func (f fixedIDs) NewApplicationID() (common.ApplicationID, error) {
+	return f.applicationID, nil
+}
+func (f fixedIDs) NewInviteID() (common.InviteID, error) {
+	return "", errors.New("not used")
+}
+func (f fixedIDs) NewMembershipID() (common.MembershipID, error) {
+	return f.membershipID, nil
+}
+
+type fixture struct {
+	now              time.Time
+	games            *gamestub.Store
+	memberships      *membershipstub.Store
+	applications     *applicationstub.Store
+	directory        *racenamestub.Directory
+	users            *userservicestub.Service
+	intents          *intentpubstub.Publisher
+	ids              fixedIDs
+	openPublicGameID common.GameID
+	defaultUserID    string
+}
+
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	now := time.Date(2026, 4, 25, 10, 0, 0, 0, time.UTC)
+	dir, err := racenamestub.NewDirectory(racenamestub.WithClock(fixedClock(now)))
+	require.NoError(t, err)
+	users := userservicestub.NewService()
+	users.SetEligibility("user-1", ports.Eligibility{Exists: true, CanLogin: true, CanJoinGame: true})
+	games := gamestub.NewStore()
+	memberships := membershipstub.NewStore()
+	applications := applicationstub.NewStore()
+
+	gameRecord, err := game.New(game.NewGameInput{
+		GameID:              "game-public",
+		GameName:            "Galactic Open",
+		GameType:            game.GameTypePublic,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	gameRecord.Status = game.StatusEnrollmentOpen
+	require.NoError(t, games.Save(context.Background(), gameRecord))
+
+	return &fixture{
+		now:              now,
+		games:            games,
+		memberships:      memberships,
+		applications:     applications,
+		directory:        dir,
+		users:            users,
+		intents:          intentpubstub.NewPublisher(),
+		ids:              fixedIDs{applicationID: "application-fixed", membershipID: "membership-fixed"},
+		openPublicGameID: gameRecord.GameID,
+		defaultUserID:    "user-1",
+	}
+}
+
+func newService(t *testing.T, f *fixture) *submitapplication.Service {
+	t.Helper()
+	svc, err := submitapplication.NewService(submitapplication.Dependencies{
+		Games:        f.games,
+		Memberships:  f.memberships,
+		Applications: f.applications,
+		Users:        f.users,
+		Directory:    f.directory,
+		Intents:      f.intents,
+		IDs:          f.ids,
+		Clock:        fixedClock(f.now),
+		Logger:       silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func defaultInput(f *fixture) submitapplication.Input {
+	return submitapplication.Input{
+		Actor:    shared.NewUserActor(f.defaultUserID),
+		GameID:   f.openPublicGameID,
+		RaceName: defaultRaceName,
+	}
+}
+
+func TestHandleHappyPath(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), defaultInput(f))
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusSubmitted, got.Status)
+	assert.Equal(t, common.ApplicationID("application-fixed"), got.ApplicationID)
+	assert.Equal(t, defaultRaceName, got.RaceName)
+
+	intents := f.intents.Published()
+	require.Len(t, intents, 1)
+	assert.Equal(t, notificationintent.NotificationTypeLobbyApplicationSubmitted, intents[0].NotificationType)
+	assert.Equal(t, notificationintent.AudienceKindAdminEmail, intents[0].AudienceKind)
+}
+
+func TestHandleAdminActorForbidden(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	svc := newService(t, f)
+
+	input := defaultInput(f)
+	input.Actor = shared.NewAdminActor()
+
+	_, err := svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleGameNotFound(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	svc := newService(t, f)
+
+	input := defaultInput(f)
+	input.GameID = "game-missing"
+
+	_, err := svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestHandleNonPublicGameConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	now := f.now
+	private, err := game.New(game.NewGameInput{
+		GameID:              "game-private",
+		GameName:            "Private Match",
+		GameType:            game.GameTypePrivate,
+		OwnerUserID:         "user-9",
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       2,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	private.Status = game.StatusEnrollmentOpen
+	require.NoError(t, f.games.Save(context.Background(), private))
+
+	svc := newService(t, f)
+	input := defaultInput(f)
+	input.GameID = private.GameID
+
+	_, err = svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleWrongStatusConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	// Force status back to draft.
+	rec, err := f.games.Get(context.Background(), f.openPublicGameID)
+	require.NoError(t, err)
+	rec.Status = game.StatusDraft
+	require.NoError(t, f.games.Save(context.Background(), rec))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleUserMissingEligibilityDenied(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	// Default-missing returns Exists=false.
+	svc := newService(t, f)
+	input := defaultInput(f)
+	input.Actor = shared.NewUserActor("user-unknown")
+
+	_, err := svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, shared.ErrEligibilityDenied)
+}
+
+func TestHandleCanJoinGameFalseEligibilityDenied(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.users.SetEligibility("user-blocked", ports.Eligibility{Exists: true, CanLogin: true, CanJoinGame: false})
+	svc := newService(t, f)
+	input := defaultInput(f)
+	input.Actor = shared.NewUserActor("user-blocked")
+
+	_, err := svc.Handle(context.Background(), input)
+	require.ErrorIs(t, err, shared.ErrEligibilityDenied)
+}
+
+func TestHandleUserServiceUnavailable(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.users.SetFailure(f.defaultUserID, ports.ErrUserServiceUnavailable)
+	svc := newService(t, f)
+
+	_, err := svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, shared.ErrServiceUnavailable)
+	require.ErrorIs(t, err, ports.ErrUserServiceUnavailable)
+}
+
+func TestHandleRosterFullConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	// Capacity = max_players(4) + start_gap_players(1) = 5; seed 5 active members.
+	for i := range 5 {
+		member, err := membership.New(membership.NewMembershipInput{
+			MembershipID: common.MembershipID("membership-seed-" + string(rune('a'+i))),
+			GameID:       f.openPublicGameID,
+			UserID:       "seed-user-" + string(rune('a'+i)),
+			RaceName:     "Seed " + string(rune('A'+i)),
+			CanonicalKey: "seed" + string(rune('a'+i)),
+			Now:          f.now,
+		})
+		require.NoError(t, err)
+		require.NoError(t, f.memberships.Save(context.Background(), member))
+	}
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleRaceNameTakenByOtherUser(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	require.NoError(t, f.directory.Reserve(context.Background(), "game-other", "user-2", defaultRaceName))
+
+	svc := newService(t, f)
+	_, err := svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, ports.ErrNameTaken)
+}
+
+func TestHandleInvalidRaceName(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	svc := newService(t, f)
+	input := defaultInput(f)
+	input.RaceName = "   " // empty after trim — ports.ErrInvalidName
+
+	_, err := svc.Handle(context.Background(), input)
+	require.Error(t, err)
+	require.True(t, errors.Is(err, ports.ErrInvalidName))
+}
+
+func TestHandleDuplicateActiveApplicationConflict(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	// Pre-existing submitted application by the same user for the same game.
+	existing, err := application.New(application.NewApplicationInput{
+		ApplicationID:   "application-existing",
+		GameID:          f.openPublicGameID,
+		ApplicantUserID: f.defaultUserID,
+		RaceName:        otherRaceName,
+		Now:             f.now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, f.applications.Save(context.Background(), existing))
+
+	svc := newService(t, f)
+	_, err = svc.Handle(context.Background(), defaultInput(f))
+	require.ErrorIs(t, err, application.ErrConflict)
+}
+
+func TestHandlePublishFailureDoesNotRollback(t *testing.T) {
+	t.Parallel()
+	f := newFixture(t)
+	f.intents.SetError(errors.New("publish failed"))
+	svc := newService(t, f)
+
+	got, err := svc.Handle(context.Background(), defaultInput(f))
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusSubmitted, got.Status)
+
+	stored, err := f.applications.Get(context.Background(), got.ApplicationID)
+	require.NoError(t, err)
+	assert.Equal(t, application.StatusSubmitted, stored.Status)
+}

lobby/internal/service/updategame/service.go

@@ -0,0 +1,235 @@
+// Package updategame implements the `lobby.game.update` message type. It
+// applies partial edits to a game record under the following rules:
+//
+//   - in status `draft`: any field from the request schema is mutable;
+//   - in status `enrollment_open`: only `description` is mutable;
+//   - in every other status: no field is mutable and the call returns
+//     game.ErrConflict.
+//
+// Authorization is admin OR (user + private game + matching OwnerUserID).
+// Non-owners receive shared.ErrForbidden.
+package updategame
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+)
+
+// Service executes the update-game use case.
+type Service struct {
+	games  ports.GameStore
+	clock  func() time.Time
+	logger *slog.Logger
+}
+
+// Dependencies groups the collaborators used by Service.
+type Dependencies struct {
+	// Games persists the updated record.
+	Games ports.GameStore
+
+	// Clock supplies the wall-clock used for UpdatedAt. Defaults to
+	// time.Now when nil.
+	Clock func() time.Time
+
+	// Logger records structured service-level events. Defaults to
+	// slog.Default when nil.
+	Logger *slog.Logger
+}
+
+// NewService constructs one Service with deps.
+func NewService(deps Dependencies) (*Service, error) {
+	if deps.Games == nil {
+		return nil, errors.New("new update game service: nil game store")
+	}
+
+	clock := deps.Clock
+	if clock == nil {
+		clock = time.Now
+	}
+	logger := deps.Logger
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	return &Service{
+		games:  deps.Games,
+		clock:  clock,
+		logger: logger.With("service", "lobby.updategame"),
+	}, nil
+}
+
+// Input stores the arguments required to update one game record. Every
+// mutable field is represented by a pointer so callers can distinguish
+// "absent" from the zero value.
+type Input struct {
+	// Actor identifies the caller.
+	Actor shared.Actor
+
+	// GameID identifies the record to update.
+	GameID common.GameID
+
+	// GameName updates the human-readable game name when non-nil.
+	GameName *string
+
+	// Description updates the human-readable description when non-nil.
+	Description *string
+
+	// MinPlayers updates the minimum approved participant count when
+	// non-nil.
+	MinPlayers *int
+
+	// MaxPlayers updates the target roster size when non-nil.
+	MaxPlayers *int
+
+	// StartGapHours updates the gap window length in hours when non-nil.
+	StartGapHours *int
+
+	// StartGapPlayers updates the gap window additional participant count
+	// when non-nil.
+	StartGapPlayers *int
+
+	// EnrollmentEndsAt updates the enrollment deadline when non-nil.
+	EnrollmentEndsAt *time.Time
+
+	// TurnSchedule updates the cron expression when non-nil.
+	TurnSchedule *string
+
+	// TargetEngineVersion updates the engine semver when non-nil.
+	TargetEngineVersion *string
+}
+
+// HasNonDescriptionFields reports whether input carries any mutation other
+// than Description.
+func (input Input) HasNonDescriptionFields() bool {
+	return input.GameName != nil ||
+		input.MinPlayers != nil ||
+		input.MaxPlayers != nil ||
+		input.StartGapHours != nil ||
+		input.StartGapPlayers != nil ||
+		input.EnrollmentEndsAt != nil ||
+		input.TurnSchedule != nil ||
+		input.TargetEngineVersion != nil
+}
+
+// Handle validates, authorizes, and applies the partial update. It returns
+// the persisted record on success.
+func (service *Service) Handle(ctx context.Context, input Input) (game.Game, error) {
+	if service == nil {
+		return game.Game{}, errors.New("update game: nil service")
+	}
+	if ctx == nil {
+		return game.Game{}, errors.New("update game: nil context")
+	}
+	if err := input.Actor.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("update game: actor: %w", err)
+	}
+	if err := input.GameID.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("update game: %w", err)
+	}
+
+	record, err := service.games.Get(ctx, input.GameID)
+	if err != nil {
+		return game.Game{}, fmt.Errorf("update game: %w", err)
+	}
+
+	if err := authorize(input.Actor, record); err != nil {
+		return game.Game{}, err
+	}
+
+	if err := enforceStatusGate(record.Status, input); err != nil {
+		return game.Game{}, err
+	}
+
+	applyPatch(&record, input, service.clock().UTC())
+
+	if err := record.Validate(); err != nil {
+		return game.Game{}, fmt.Errorf("update game: %w", err)
+	}
+
+	if err := service.games.Save(ctx, record); err != nil {
+		return game.Game{}, fmt.Errorf("update game: %w", err)
+	}
+
+	service.logger.InfoContext(ctx, "game updated",
+		"game_id", record.GameID.String(),
+		"status", string(record.Status),
+		"actor_kind", string(input.Actor.Kind),
+	)
+
+	return record, nil
+}
+
+// authorize enforces admin OR private-owner access to the record.
+func authorize(actor shared.Actor, record game.Game) error {
+	if actor.IsAdmin() {
+		return nil
+	}
+	if record.GameType == game.GameTypePrivate && actor.UserID == record.OwnerUserID {
+		return nil
+	}
+	return fmt.Errorf("%w: actor is not authorized to update game %q",
+		shared.ErrForbidden, record.GameID.String())
+}
+
+// enforceStatusGate returns game.ErrConflict when the request attempts a
+// field mutation disallowed by the current status.
+func enforceStatusGate(status game.Status, input Input) error {
+	switch status {
+	case game.StatusDraft:
+		return nil
+	case game.StatusEnrollmentOpen:
+		if input.HasNonDescriptionFields() {
+			return fmt.Errorf(
+				"update game: only description is editable in status %q: %w",
+				status, game.ErrConflict,
+			)
+		}
+		return nil
+	default:
+		return fmt.Errorf(
+			"update game: status %q does not accept field updates: %w",
+			status, game.ErrConflict,
+		)
+	}
+}
+
+// applyPatch overwrites non-nil fields from input onto record. Callers must
+// re-validate the result before persisting.
+func applyPatch(record *game.Game, input Input, now time.Time) {
+	if input.GameName != nil {
+		record.GameName = *input.GameName
+	}
+	if input.Description != nil {
+		record.Description = *input.Description
+	}
+	if input.MinPlayers != nil {
+		record.MinPlayers = *input.MinPlayers
+	}
+	if input.MaxPlayers != nil {
+		record.MaxPlayers = *input.MaxPlayers
+	}
+	if input.StartGapHours != nil {
+		record.StartGapHours = *input.StartGapHours
+	}
+	if input.StartGapPlayers != nil {
+		record.StartGapPlayers = *input.StartGapPlayers
+	}
+	if input.EnrollmentEndsAt != nil {
+		record.EnrollmentEndsAt = input.EnrollmentEndsAt.UTC()
+	}
+	if input.TurnSchedule != nil {
+		record.TurnSchedule = *input.TurnSchedule
+	}
+	if input.TargetEngineVersion != nil {
+		record.TargetEngineVersion = *input.TargetEngineVersion
+	}
+	record.UpdatedAt = now
+}

lobby/internal/service/updategame/service_test.go

@@ -0,0 +1,307 @@
+package updategame_test
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"testing"
+	"time"
+
+	"galaxy/lobby/internal/adapters/gamestub"
+	"galaxy/lobby/internal/domain/common"
+	"galaxy/lobby/internal/domain/game"
+	"galaxy/lobby/internal/ports"
+	"galaxy/lobby/internal/service/shared"
+	"galaxy/lobby/internal/service/updategame"
+
+	"github.com/stretchr/testify/require"
+)
+
+func silentLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func fixedClock(at time.Time) func() time.Time {
+	return func() time.Time { return at }
+}
+
+// seedDraftGame stores a draft record with sensible defaults for tests and
+// returns the persisted record.
+func seedDraftGame(
+	t *testing.T,
+	store *gamestub.Store,
+	id common.GameID,
+	gameType game.GameType,
+	ownerUserID string,
+	now time.Time,
+) game.Game {
+	t.Helper()
+
+	record, err := game.New(game.NewGameInput{
+		GameID:              id,
+		GameName:            "Seed Game",
+		GameType:            gameType,
+		OwnerUserID:         ownerUserID,
+		MinPlayers:          2,
+		MaxPlayers:          4,
+		StartGapHours:       4,
+		StartGapPlayers:     1,
+		EnrollmentEndsAt:    now.Add(24 * time.Hour),
+		TurnSchedule:        "0 */6 * * *",
+		TargetEngineVersion: "1.0.0",
+		Now:                 now,
+	})
+	require.NoError(t, err)
+	require.NoError(t, store.Save(context.Background(), record))
+
+	return record
+}
+
+func newService(t *testing.T, store ports.GameStore, clock func() time.Time) *updategame.Service {
+	t.Helper()
+
+	svc, err := updategame.NewService(updategame.Dependencies{
+		Games:  store,
+		Clock:  clock,
+		Logger: silentLogger(),
+	})
+	require.NoError(t, err)
+	return svc
+}
+
+func TestHandleAdminFullEditInDraft(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-a", game.GameTypePublic, "", now)
+
+	later := now.Add(30 * time.Minute)
+	service := newService(t, store, fixedClock(later))
+
+	updated, err := service.Handle(context.Background(), updategame.Input{
+		Actor:               shared.NewAdminActor(),
+		GameID:              "game-a",
+		GameName:            new("Spring Cup"),
+		Description:         new("Warm-up round"),
+		MinPlayers:          new(3),
+		MaxPlayers:          new(6),
+		StartGapHours:       new(2),
+		StartGapPlayers:     new(2),
+		TurnSchedule:        new("0 9 * * *"),
+		TargetEngineVersion: new("1.1.0"),
+	})
+	require.NoError(t, err)
+	require.Equal(t, "Spring Cup", updated.GameName)
+	require.Equal(t, "Warm-up round", updated.Description)
+	require.Equal(t, 3, updated.MinPlayers)
+	require.Equal(t, 6, updated.MaxPlayers)
+	require.Equal(t, 2, updated.StartGapHours)
+	require.Equal(t, 2, updated.StartGapPlayers)
+	require.Equal(t, "0 9 * * *", updated.TurnSchedule)
+	require.Equal(t, "1.1.0", updated.TargetEngineVersion)
+	require.Equal(t, later.UTC(), updated.UpdatedAt)
+}
+
+func TestHandleOwnerEditInDraft(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-private", game.GameTypePrivate, "user-1", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.NewUserActor("user-1"),
+		GameID:      "game-private",
+		Description: new("Private scrim"),
+	})
+	require.NoError(t, err)
+	require.Equal(t, "Private scrim", updated.Description)
+}
+
+func TestHandleNonOwnerForbidden(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-private", game.GameTypePrivate, "user-1", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.NewUserActor("user-2"),
+		GameID:      "game-private",
+		Description: new("drive-by"),
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleUserCannotEditPublicGame(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-public", game.GameTypePublic, "", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.NewUserActor("user-1"),
+		GameID:      "game-public",
+		Description: new("drive-by"),
+	})
+	require.ErrorIs(t, err, shared.ErrForbidden)
+}
+
+func TestHandleEnrollmentOpenDescriptionOnly(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedDraftGame(t, store, "game-open", game.GameTypePublic, "", now)
+
+	// Force status to enrollment_open via UpdateStatus.
+	require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateStatusInput{
+		GameID:       record.GameID,
+		ExpectedFrom: game.StatusDraft,
+		To:           game.StatusEnrollmentOpen,
+		Trigger:      game.TriggerCommand,
+		At:           now.Add(5 * time.Minute),
+	}))
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	updated, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.NewAdminActor(),
+		GameID:      record.GameID,
+		Description: new("Updated while enrollment is open"),
+	})
+	require.NoError(t, err)
+	require.Equal(t, "Updated while enrollment is open", updated.Description)
+	require.Equal(t, game.StatusEnrollmentOpen, updated.Status)
+}
+
+func TestHandleEnrollmentOpenNonDescriptionRejected(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedDraftGame(t, store, "game-open", game.GameTypePublic, "", now)
+
+	require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateStatusInput{
+		GameID:       record.GameID,
+		ExpectedFrom: game.StatusDraft,
+		To:           game.StatusEnrollmentOpen,
+		Trigger:      game.TriggerCommand,
+		At:           now.Add(5 * time.Minute),
+	}))
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:      shared.NewAdminActor(),
+		GameID:     record.GameID,
+		MinPlayers: new(5),
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleTerminalStatusRejected(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	record := seedDraftGame(t, store, "game-cancel", game.GameTypePublic, "", now)
+
+	require.NoError(t, store.UpdateStatus(context.Background(), ports.UpdateStatusInput{
+		GameID:       record.GameID,
+		ExpectedFrom: game.StatusDraft,
+		To:           game.StatusCancelled,
+		Trigger:      game.TriggerCommand,
+		At:           now.Add(10 * time.Minute),
+	}))
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.NewAdminActor(),
+		GameID:      record.GameID,
+		Description: new("ignored"),
+	})
+	require.ErrorIs(t, err, game.ErrConflict)
+}
+
+func TestHandleNotFound(t *testing.T) {
+	t.Parallel()
+
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.NewAdminActor(),
+		GameID:      "game-missing",
+		Description: new("nope"),
+	})
+	require.ErrorIs(t, err, game.ErrNotFound)
+}
+
+func TestHandleValidationFailurePropagates(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	seedDraftGame(t, store, "game-a", game.GameTypePublic, "", now)
+
+	service := newService(t, store, fixedClock(now.Add(time.Hour)))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:      shared.NewAdminActor(),
+		GameID:     "game-a",
+		MinPlayers: new(10),
+		MaxPlayers: new(5),
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "max players")
+}
+
+func TestHandleInvalidActorReturnsError(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(now))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.Actor{Kind: shared.ActorKindUser}, // missing user id
+		GameID:      "game-a",
+		Description: new("x"),
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "actor")
+}
+
+func TestHandleInvalidGameID(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 4, 24, 10, 0, 0, 0, time.UTC)
+	store := gamestub.NewStore()
+	service := newService(t, store, fixedClock(now))
+
+	_, err := service.Handle(context.Background(), updategame.Input{
+		Actor:       shared.NewAdminActor(),
+		GameID:      "bad",
+		Description: new("x"),
+	})
+	require.Error(t, err)
+}
+
+func TestInputHasNonDescriptionFields(t *testing.T) {
+	t.Parallel()
+
+	require.False(t, updategame.Input{}.HasNonDescriptionFields())
+	require.False(t, updategame.Input{Description: new("x")}.HasNonDescriptionFields())
+	require.True(t, updategame.Input{GameName: new("x")}.HasNonDescriptionFields())
+	require.True(t, updategame.Input{MinPlayers: new(1)}.HasNonDescriptionFields())
+}