ui/phase-14: rename planet end-to-end + order read-back

Wires the first end-to-end command through the full pipeline:
inspector rename action → local order draft → user.games.order
submit → optimistic overlay on map / inspector → server hydration
on cache miss via the new user.games.order.get message type.

Backend: GET /api/v1/user/games/{id}/orders forwards to engine
GET /api/v1/order. Gateway parses the engine PUT response into the
extended UserGamesOrderResponse FBS envelope and adds
executeUserGamesOrderGet for the read-back path. Frontend ports
ValidateTypeName to TS, lands the inline rename editor + Submit
button, and exposes a renderedReport context so consumers see the
overlay-applied snapshot.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/internal/engineclient/client.go

@@ -196,6 +196,46 @@ func (c *Client) PutOrders(ctx context.Context, baseURL string, payload json.Raw
 	return c.forwardPlayerWrite(ctx, baseURL, pathPlayerOrder, payload, "engine order")
 }
 
+// GetOrder calls `GET /api/v1/order?player=<raceName>&turn=<turn>` and
+// returns the engine response body verbatim. A `204 No Content` body
+// is signalled by `(nil, http.StatusNoContent, nil)` so callers can
+// surface "no stored order" without parsing the empty payload.
+// Other non-`200` statuses come back wrapped in `ErrEngineValidation`
+// (4xx) or `ErrEngineUnreachable` (everything else), matching the
+// existing player-write conventions.
+func (c *Client) GetOrder(ctx context.Context, baseURL, raceName string, turn int) (json.RawMessage, int, error) {
+	if err := validateBaseURL(baseURL); err != nil {
+		return nil, 0, err
+	}
+	if strings.TrimSpace(raceName) == "" {
+		return nil, 0, errors.New("engineclient order get: race name must not be empty")
+	}
+	if turn < 0 {
+		return nil, 0, fmt.Errorf("engineclient order get: turn must not be negative, got %d", turn)
+	}
+	values := url.Values{}
+	values.Set("player", raceName)
+	values.Set("turn", strconv.Itoa(turn))
+	target := baseURL + pathPlayerOrder + "?" + values.Encode()
+	body, status, doErr := c.doRequest(ctx, http.MethodGet, target, nil, c.probeTimeout)
+	if doErr != nil {
+		return nil, 0, fmt.Errorf("%w: engine order get: %w", ErrEngineUnreachable, doErr)
+	}
+	switch status {
+	case http.StatusOK:
+		if len(body) == 0 {
+			return nil, status, fmt.Errorf("%w: engine order get: empty response body", ErrEngineProtocolViolation)
+		}
+		return json.RawMessage(body), status, nil
+	case http.StatusNoContent:
+		return nil, status, nil
+	case http.StatusBadRequest, http.StatusConflict:
+		return json.RawMessage(body), status, fmt.Errorf("%w: engine order get: %s", ErrEngineValidation, summariseEngineError(body, status))
+	default:
+		return nil, status, fmt.Errorf("%w: engine order get: %s", ErrEngineUnreachable, summariseEngineError(body, status))
+	}
+}
+
 // GetReport calls `GET /api/v1/report?player=<raceName>&turn=<turn>`
 // and returns the engine response body verbatim.
 func (c *Client) GetReport(ctx context.Context, baseURL, raceName string, turn int) (json.RawMessage, error) {

backend/internal/engineclient/client_test.go

@@ -195,6 +195,68 @@ func TestClientReportsForwardsQuery(t *testing.T) {
 	}
 }
 
+func TestClientGetOrderForwardsQuery(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != pathPlayerOrder {
+			t.Fatalf("unexpected path: %s", r.URL.Path)
+		}
+		if r.Method != http.MethodGet {
+			t.Fatalf("unexpected method: %s", r.Method)
+		}
+		if r.URL.Query().Get("player") != "alpha" {
+			t.Fatalf("player = %q", r.URL.Query().Get("player"))
+		}
+		if r.URL.Query().Get("turn") != "3" {
+			t.Fatalf("turn = %q", r.URL.Query().Get("turn"))
+		}
+		_, _ = w.Write([]byte(`{"game_id":"abc","updatedAt":99,"cmd":[]}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	cli := newTestClient(t, srv)
+	body, status, err := cli.GetOrder(context.Background(), srv.URL, "alpha", 3)
+	if err != nil {
+		t.Fatalf("GetOrder: %v", err)
+	}
+	if status != http.StatusOK {
+		t.Fatalf("status = %d", status)
+	}
+	if !strings.Contains(string(body), `"updatedAt":99`) {
+		t.Fatalf("body = %s", body)
+	}
+}
+
+func TestClientGetOrderNoContent(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(srv.Close)
+
+	cli := newTestClient(t, srv)
+	body, status, err := cli.GetOrder(context.Background(), srv.URL, "alpha", 3)
+	if err != nil {
+		t.Fatalf("GetOrder: %v", err)
+	}
+	if status != http.StatusNoContent {
+		t.Fatalf("status = %d", status)
+	}
+	if body != nil {
+		t.Fatalf("expected nil body on 204, got %s", body)
+	}
+}
+
+func TestClientGetOrderRejectsBadInput(t *testing.T) {
+	cli := newTestClient(t, httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("server must not be hit on bad input")
+	})))
+	if _, _, err := cli.GetOrder(context.Background(), "http://example.com", "", 0); err == nil {
+		t.Fatal("expected error on empty race name")
+	}
+	if _, _, err := cli.GetOrder(context.Background(), "http://example.com", "alpha", -1); err == nil {
+		t.Fatal("expected error on negative turn")
+	}
+}
+
 func TestClientHealthzSuccess(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != pathHealthz {

backend/internal/server/contract_test.go

@@ -50,6 +50,14 @@ var pathParamStubs = map[string]string{
 	"turn": "42",
 }
 
+// queryParamStubs lists the deterministic substitutions used to fill
+// query-string parameters declared in `openapi.yaml`. Every required
+// query parameter must have an entry here; optional ones can stay
+// blank (the contract test omits them when no stub is registered).
+var queryParamStubs = map[string]string{
+	"turn": "42",
+}
+
 // requestBodyStubs lists the JSON request bodies the contract test sends for
 // each operationId. Operations missing from the map default to an empty
 // object `{}`, which is a valid placeholder thanks to `additionalProperties:
@@ -323,6 +331,9 @@ func buildRequest(t *testing.T, c contractOperation) *http.Request {
 	t.Helper()
 
 	target := substitutePathParams(t, c.path)
+	if query := buildQuery(t, c); query != "" {
+		target += "?" + query
+	}
 	url := "http://backend.internal" + target
 
 	body := bodyFor(t, c)
@@ -376,6 +387,31 @@ func bodyFor(t *testing.T, c contractOperation) requestBody {
 	}
 }
 
+func buildQuery(t *testing.T, c contractOperation) string {
+	t.Helper()
+	if c.op == nil {
+		return ""
+	}
+	values := make([]string, 0, len(c.op.Parameters))
+	for _, p := range c.op.Parameters {
+		if p == nil || p.Value == nil {
+			continue
+		}
+		if p.Value.In != "query" {
+			continue
+		}
+		stub, ok := queryParamStubs[p.Value.Name]
+		if !ok {
+			if p.Value.Required {
+				t.Fatalf("operation %q requires query parameter %q with no stub registered", c.operationID, p.Value.Name)
+			}
+			continue
+		}
+		values = append(values, p.Value.Name+"="+stub)
+	}
+	return strings.Join(values, "&")
+}
+
 func substitutePathParams(t *testing.T, templated string) string {
 	t.Helper()
 

backend/internal/server/handlers_user_games.go

@@ -136,6 +136,64 @@ func (h *UserGamesHandlers) Orders() gin.HandlerFunc {
 	}
 }
 
+// GetOrders handles GET /api/v1/user/games/{game_id}/orders?turn=N.
+// Forwards to the engine's `GET /api/v1/order` with the player rebound
+// from the runtime mapping. The query parameter `turn` is required
+// and must be a non-negative integer; the engine itself enforces the
+// same rule, but rejecting up-front saves a network hop.
+//
+// On `204 No Content` the handler answers `204` so the gateway can
+// translate the FBS envelope to `found = false`. On `200` the
+// engine's body is forwarded verbatim — the gateway re-encodes the
+// JSON `UserGamesOrder` shape into FlatBuffers.
+func (h *UserGamesHandlers) GetOrders() gin.HandlerFunc {
+	if h == nil || h.runtime == nil || h.engine == nil {
+		return handlers.NotImplemented("userGamesGetOrders")
+	}
+	return func(c *gin.Context) {
+		gameID, ok := parseGameIDParam(c)
+		if !ok {
+			return
+		}
+		turnRaw := c.Query("turn")
+		if turnRaw == "" {
+			httperr.Abort(c, http.StatusBadRequest, httperr.CodeInvalidRequest, "turn is required")
+			return
+		}
+		turn, err := strconv.Atoi(turnRaw)
+		if err != nil || turn < 0 {
+			httperr.Abort(c, http.StatusBadRequest, httperr.CodeInvalidRequest, "turn must be a non-negative integer")
+			return
+		}
+		userID, ok := userid.FromContext(c.Request.Context())
+		if !ok {
+			httperr.Abort(c, http.StatusBadRequest, httperr.CodeInvalidRequest, "user id missing")
+			return
+		}
+		ctx := c.Request.Context()
+		mapping, err := h.runtime.ResolvePlayerMapping(ctx, gameID, userID)
+		if err != nil {
+			respondGameProxyError(c, h.logger, "user games get orders", ctx, err)
+			return
+		}
+		endpoint, err := h.runtime.EngineEndpoint(ctx, gameID)
+		if err != nil {
+			respondGameProxyError(c, h.logger, "user games get orders", ctx, err)
+			return
+		}
+		body, status, err := h.engine.GetOrder(ctx, endpoint, mapping.RaceName, turn)
+		if err != nil {
+			respondEngineProxyError(c, h.logger, "user games get orders", ctx, body, err)
+			return
+		}
+		if status == http.StatusNoContent {
+			c.Status(http.StatusNoContent)
+			return
+		}
+		c.Data(http.StatusOK, "application/json", body)
+	}
+}
+
 // Report handles GET /api/v1/user/games/{game_id}/reports/{turn}.
 func (h *UserGamesHandlers) Report() gin.HandlerFunc {
 	if h == nil || h.runtime == nil || h.engine == nil {

backend/internal/server/router.go

@@ -261,6 +261,7 @@ func registerUserRoutes(router *gin.Engine, instruments *metrics.Instruments, de
 	userGames := group.Group("/games")
 	userGames.POST("/:game_id/commands", deps.UserGames.Commands())
 	userGames.POST("/:game_id/orders", deps.UserGames.Orders())
+	userGames.GET("/:game_id/orders", deps.UserGames.GetOrders())
 	userGames.GET("/:game_id/reports/:turn", deps.UserGames.Report())
 
 	userSessions := group.Group("/sessions")

backend/openapi.yaml

@@ -1023,7 +1023,11 @@ paths:
               $ref: "#/components/schemas/EngineOrder"
       responses:
         "200":
-          description: Engine order validation result passed through.
+          description: |
+            Engine order validation result passed through. Body is the
+            engine's `UserGamesOrder` shape — game_id, updatedAt, and
+            the per-command `cmd[]` list with `cmdApplied` /
+            `cmdErrorCode` populated by the engine.
           content:
             application/json:
               schema:
@@ -1036,6 +1040,46 @@ paths:
           $ref: "#/components/responses/NotImplementedError"
         "500":
           $ref: "#/components/responses/InternalError"
+    get:
+      tags: [User]
+      operationId: userGamesGetOrders
+      summary: Read the player's stored order for a turn
+      description: |
+        Forwards `GET /api/v1/order` against the engine container.
+        The caller always knows the current turn from the lobby
+        record at game boot, so `turn` is required.
+      security:
+        - UserHeader: []
+      parameters:
+        - $ref: "#/components/parameters/XUserID"
+        - $ref: "#/components/parameters/GameID"
+        - name: turn
+          in: query
+          required: true
+          description: Turn number whose stored order to fetch. Non-negative.
+          schema:
+            type: integer
+            format: int32
+            minimum: 0
+      responses:
+        "200":
+          description: |
+            Engine returned the stored order for this player + turn.
+            Body is the engine's `UserGamesOrder` shape.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PassthroughObject"
+        "204":
+          description: No order has been stored for this player on this turn.
+        "400":
+          $ref: "#/components/responses/InvalidRequestError"
+        "404":
+          $ref: "#/components/responses/NotFoundError"
+        "501":
+          $ref: "#/components/responses/NotImplementedError"
+        "500":
+          $ref: "#/components/responses/InternalError"
   /api/v1/user/games/{game_id}/reports/{turn}:
     get:
       tags: [User]