Merge pull request 'dev-deploy: production mirror + full observability behind the /_gm gate' (#88) from feature/dev-prod-mirror into development

- ARCHITECTURE §17: the dev (production-mirror) collection stack
  (Prometheus / Loki / Tempo / promtail / node-exporter / cAdvisor) and
  the single /_gm Basic Auth gate fronting Grafana and the Mailpit UI.
- tools/dev-deploy/monitoring/README.md (new): services, what is
  collected, Grafana-behind-the-gate access, config delivery, tuning.
- tools/dev-deploy/README.md: an Observability section; the Mailpit UI
  under /_gm/mailpit/; Networking diagram and Files list updated.
- FUNCTIONAL §10.2.1 (+ ru mirror): the operator console nav links to
  Grafana and Mailpit under the same /_gm gate, one sign-in for all.

.gitea/actions/build-wasm/action.yml

@@ -0,0 +1,33 @@
+name: Build core.wasm
+description: >-
+  Install TinyGo (cached) and build ui/core to frontend/static/core.wasm
+  and wasm_exec.js via `make -C ui wasm`. The binaries are no longer
+  committed, so every workflow that builds or serves the frontend bundle
+  (ui-test, dev-deploy, prod-build) runs this first. Requires Go to be
+  set up by the caller — TinyGo shells out to the Go toolchain.
+
+runs:
+  using: composite
+  steps:
+    - name: Restore TinyGo cache
+      uses: actions/cache@v4
+      with:
+        path: ~/.cache/galaxy-tinygo
+        key: tinygo-0.41.1-linux-amd64
+
+    - name: Install TinyGo
+      shell: bash
+      run: |
+        set -euo pipefail
+        version="0.41.1"
+        root="$HOME/.cache/galaxy-tinygo/tinygo"
+        if [ ! -x "$root/bin/tinygo" ]; then
+          mkdir -p "$HOME/.cache/galaxy-tinygo"
+          curl -fsSL "https://github.com/tinygo-org/tinygo/releases/download/v${version}/tinygo${version}.linux-amd64.tar.gz" \
+            | tar -xz -C "$HOME/.cache/galaxy-tinygo"
+        fi
+        echo "$root/bin" >> "$GITHUB_PATH"
+
+    - name: Build core.wasm
+      shell: bash
+      run: make -C ui wasm

.gitea/workflows/deploy-prod.yaml

@@ -28,4 +28,4 @@ jobs:
           echo "  2. scp the .tar.gz bundles to the production host."
           echo "  3. ssh prod 'docker load -i ...' for backend / gateway / engine."
           echo "  4. ssh prod 'docker compose -f /opt/galaxy/docker-compose.yml up -d'."
-          echo "  5. Probe https://api.galaxy.com/healthz and roll back on failure."
+          echo "  5. Probe https://<public host>/healthz and roll back on failure."

.gitea/workflows/dev-deploy.yaml

@@ -24,6 +24,7 @@ on:
       - 'game/**'
       - 'pkg/**'
       - 'ui/**'
+      - 'site/**'
       - 'go.work'
       - 'go.work.sum'
       - 'tools/dev-deploy/**'
@@ -70,10 +71,17 @@ jobs:
         working-directory: ui
         run: pnpm install --frozen-lockfile
 
+      - name: Build core.wasm
+        uses: ./.gitea/actions/build-wasm
+
       - name: Build UI frontend
         working-directory: ui/frontend
         env:
-          VITE_GATEWAY_BASE_URL: https://api.galaxy.lan
+          # Single-origin deployment: an empty base URL means the
+          # gateway shares the document origin (REST at /api, Connect at
+          # /rpc). The game UI is served under the /game/ base path.
+          VITE_GATEWAY_BASE_URL: ""
+          BASE_PATH: /game
           # Surface the synthetic-report loader and similar dev-only
           # affordances in the long-lived dev bundle. The prod build
           # path (`prod-build.yaml`) leaves this flag unset so the
@@ -88,6 +96,14 @@ jobs:
           export VITE_GATEWAY_RESPONSE_PUBLIC_KEY="$(grep -E '^VITE_GATEWAY_RESPONSE_PUBLIC_KEY=' .env.development | cut -d= -f2)"
           pnpm build
 
+      - name: Install site dependencies
+        working-directory: site
+        run: pnpm install --frozen-lockfile
+
+      - name: Build project site
+        working-directory: site
+        run: pnpm build
+
       - name: Build galaxy-engine image
         working-directory: ${{ gitea.workspace }}
         run: |
@@ -109,6 +125,14 @@ jobs:
             -v "${{ gitea.workspace }}/ui/frontend/build:/src:ro" \
             alpine sh -c 'rm -rf /dst/* /dst/.??* 2>/dev/null; cp -a /src/. /dst/'
 
+      - name: Seed site volume
+        run: |
+          docker volume create galaxy-dev-site-dist >/dev/null
+          docker run --rm \
+            -v galaxy-dev-site-dist:/dst \
+            -v "${{ gitea.workspace }}/site/.vitepress/dist:/src:ro" \
+            alpine sh -c 'rm -rf /dst/* /dst/.??* 2>/dev/null; cp -a /src/. /dst/'
+
       - name: Seed geoip volume
         run: |
           # Copy the GeoIP test fixture into a named volume so the
@@ -124,14 +148,102 @@ jobs:
             -v "${{ gitea.workspace }}/pkg/geoip/test-data/test-data:/src:ro" \
             alpine sh -c 'cp /src/GeoIP2-Country-Test.mmdb /dst/geoip.mmdb'
 
+      - name: Seed mailpit relay config
+        env:
+          GALAXY_DEV_MAIL_RELAY_USERNAME: ${{ secrets.GALAXY_DEV_MAIL_RELAY_USERNAME }}
+          GALAXY_DEV_MAIL_RELAY_PASSWORD: ${{ secrets.GALAXY_DEV_MAIL_RELAY_PASSWORD }}
+        run: |
+          # Render the Mailpit relay upstream config from the template,
+          # substituting the Gmail App Password from a Gitea secret, then
+          # seed it into a named volume (same rationale as the geoip seed:
+          # a workspace bind-mount would vanish with the runner workspace).
+          # The secret never lands in git or a committed file; it is
+          # rendered to a tmpfile outside the repo and removed after. Gmail
+          # App Passwords are [a-z]{16}, so the `|` sed delimiter is safe.
+          # When the secret is unset the creds render empty and the compose
+          # default relay-match is non-routable, so the stack only captures.
+          rendered="$(mktemp)"
+          sed -e "s|\${GALAXY_DEV_MAIL_RELAY_USERNAME}|${GALAXY_DEV_MAIL_RELAY_USERNAME}|g" \
+              -e "s|\${GALAXY_DEV_MAIL_RELAY_PASSWORD}|${GALAXY_DEV_MAIL_RELAY_PASSWORD}|g" \
+              "${{ gitea.workspace }}/tools/dev-deploy/mailpit/relay.conf.tmpl" > "$rendered"
+          docker volume create galaxy-dev-mailpit-config >/dev/null
+          docker run --rm \
+            -v galaxy-dev-mailpit-config:/dst \
+            -v "$rendered:/src/relay.conf:ro" \
+            alpine sh -c 'cp /src/relay.conf /dst/relay.conf && chmod 600 /dst/relay.conf'
+          rm -f "$rendered"
+
+      - name: Recycle engine containers on image drift
+        run: |
+          # Compare the freshly-built `galaxy-engine:dev` SHA against
+          # every running `galaxy-game-*` container. The backend
+          # reconciler adopts pre-existing labelled engine containers
+          # without checking image drift, so a running game would
+          # otherwise keep serving the previous engine code until the
+          # container is recycled by hand. This step makes the recycle
+          # automatic but only when it is actually needed:
+          #
+          #   * BuildKit cache hit on the `Build galaxy-engine image`
+          #     step → `galaxy-engine:dev` keeps its previous SHA →
+          #     no drift → no-op (no engine source change to deploy).
+          #   * engine source change → fresh SHA → for each drifted
+          #     container we stop the backend, remove the container,
+          #     wipe its bind-mounted state directory (Engine.Init()
+          #     writes turn-0 over any pre-existing `turn-N` files —
+          #     silent state corruption otherwise), and cascade-delete
+          #     the lobby `games` row (the FKs in `00001_init.sql`
+          #     drop the matching `runtime_records`, `memberships`,
+          #     `player_mappings`, etc. in the same write).
+          #
+          # Backend is stopped first to keep the reconciler from
+          # racing the recycle (mid-stream adoption / restart). The
+          # subsequent `Bring up the stack` step restarts it.
+          set -u
+          new_sha=$(docker image inspect galaxy-engine:dev --format '{{.Id}}')
+          echo "fresh galaxy-engine:dev = $new_sha"
+
+          drift=()
+          for c in $(docker ps --filter "name=galaxy-game-" --format '{{.Names}}'); do
+            cur=$(docker inspect "$c" --format '{{.Image}}')
+            if [ "$cur" != "$new_sha" ]; then
+              drift+=("${c#galaxy-game-}")
+              echo "  drift: $c was on $cur"
+            else
+              echo "  match: $c"
+            fi
+          done
+          if [ ${#drift[@]} -eq 0 ]; then
+            echo "no drift detected — recycle skipped"
+          else
+            docker stop -t 30 galaxy-dev-backend >/dev/null 2>&1 || true
+            state_root="$HOME/.galaxy-dev/game-state"
+            for gid in "${drift[@]}"; do
+              echo "recycling $gid"
+              docker rm -f "galaxy-game-$gid" >/dev/null 2>&1 || true
+              # Wipe the per-game state dir as root inside a throwaway
+              # container so we can remove files left behind by the
+              # engine container even when its uid differs from the
+              # runner's.
+              docker run --rm -v "$state_root:/state" alpine \
+                sh -c "rm -rf -- /state/$gid"
+            done
+            ids_csv=$(printf "'%s'," "${drift[@]}")
+            ids_csv=${ids_csv%,}
+            docker exec galaxy-dev-postgres psql -v ON_ERROR_STOP=1 \
+              -U galaxy -d galaxy_backend \
+              -c "DELETE FROM backend.games WHERE game_id IN (${ids_csv});"
+          fi
+
       - name: Reap stray dev-deploy containers
         run: |
           # Remove any non-running compose-managed containers from
           # earlier deploys before `compose up`. Filter by the stack
           # label so we never touch unrelated workloads on the same
-          # daemon. Running containers (incl. engine instances backend
+          # daemon. Running engine containers spawned by backend with
-          # spawned itself with the same label) are left intact —
+          # the same label are left intact when their image SHA still
-          # those are reattached by the backend reconciler on boot.
+          # matches the freshly-built `galaxy-engine:dev` (handled by
+          # the preceding `Recycle engine containers on image drift`
+          # step); the reconciler reattaches them on backend boot.
           ids=$(docker ps -aq \
             --filter "label=galaxy.stack=dev-deploy" \
             --filter "status=exited" \
@@ -144,11 +256,24 @@ jobs:
 
       - name: Bring up the stack
         working-directory: tools/dev-deploy
+        env:
+          # Recipient regex Mailpit auto-relays to the owner's Gmail.
+          # Unset/empty → the compose default (non-routable) keeps the
+          # stack capture-only.
+          GALAXY_DEV_MAIL_RELAY_MATCH: ${{ vars.GALAXY_DEV_MAIL_RELAY_MATCH }}
+          # Grafana admin password; unset/empty -> compose default 'admin'.
+          GALAXY_DEV_GRAFANA_ADMIN_PASSWORD: ${{ secrets.GALAXY_DEV_GRAFANA_ADMIN_PASSWORD }}
         run: |
           # Resolve in the shell, not in YAML expressions — `env.HOME`
           # is empty at the workflow-evaluation stage.
           export GALAXY_DEV_GAME_STATE_DIR="$HOME/.galaxy-dev/game-state"
           mkdir -p "$GALAXY_DEV_GAME_STATE_DIR"
+          # Seed the monitoring config to a stable, reboot-surviving host
+          # path (compose binds \${GALAXY_DEV_MONITORING_DIR} read-only).
+          export GALAXY_DEV_MONITORING_DIR="$HOME/.galaxy-dev/monitoring"
+          rm -rf "$GALAXY_DEV_MONITORING_DIR"
+          mkdir -p "$GALAXY_DEV_MONITORING_DIR"
+          cp -r monitoring/. "$GALAXY_DEV_MONITORING_DIR/"
           docker compose up -d --wait --remove-orphans
 
       - name: Probe the stack
@@ -159,9 +284,12 @@ jobs:
           # `tls internal`) terminates and forwards into the edge
           # network. We accept the host's internal CA via -k because
           # the runner image has no reason to trust it.
-          curl -sk --max-time 10 https://api.galaxy.lan/healthz \
+          curl -sk --max-time 10 https://galaxy.lan/healthz \
             | tee /tmp/healthz
           test -s /tmp/healthz
           curl -sk --max-time 10 -o /dev/null -w '%{http_code}\n' \
-            https://www.galaxy.lan/ | tee /tmp/www_status
+            https://galaxy.lan/ | tee /tmp/site_status
-          grep -qE '^(200|304)$' /tmp/www_status
+          grep -qE '^(200|304)$' /tmp/site_status
+          curl -sk --max-time 10 -o /dev/null -w '%{http_code}\n' \
+            https://galaxy.lan/game/ | tee /tmp/game_status
+          grep -qE '^(200|304)$' /tmp/game_status

.gitea/workflows/fbs-codegen.yaml

@@ -0,0 +1,80 @@
+name: Tests · FBS codegen
+
+# Guards that the committed FlatBuffers bindings (Go under
+# pkg/schema/fbs/<schema>/ and TS under ui/frontend/src/proto/galaxy/fbs/)
+# are exactly what the pinned flatc produces from the .fbs schemas.
+# Catches both "changed a schema but forgot to regenerate" and
+# "regenerated with the wrong flatc version" (e.g. a distro's older
+# flatbuffers-compiler), which silently churns output and can flip
+# nullable-scalar wire defaults. Path-filtered so it only runs when the
+# schemas, the generated trees, the fbs Makefiles, or this workflow change.
+
+on:
+  push:
+    paths:
+      - 'pkg/schema/fbs/**'
+      - 'ui/frontend/src/proto/galaxy/fbs/**'
+      - 'ui/Makefile'
+      - '.gitea/workflows/fbs-codegen.yaml'
+  pull_request:
+    paths:
+      - 'pkg/schema/fbs/**'
+      - 'ui/frontend/src/proto/galaxy/fbs/**'
+      - 'ui/Makefile'
+      - '.gitea/workflows/fbs-codegen.yaml'
+
+concurrency:
+  group: fbs-codegen-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FLATC_VERSION: 25.9.23
+
+jobs:
+  codegen:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Cache flatc
+        id: cache-flatc
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/flatc-bin
+          key: flatc-${{ env.FLATC_VERSION }}-linux-g++13
+
+      - name: Install pinned flatc
+        if: steps.cache-flatc.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p "${{ runner.temp }}/flatc-bin"
+          curl -sSL -o /tmp/flatc.zip \
+            "https://github.com/google/flatbuffers/releases/download/v${FLATC_VERSION}/Linux.flatc.binary.g++-13.zip"
+          python3 -m zipfile -e /tmp/flatc.zip "${{ runner.temp }}/flatc-bin"
+          chmod +x "${{ runner.temp }}/flatc-bin/flatc"
+
+      - name: Add flatc to PATH
+        run: echo "${{ runner.temp }}/flatc-bin" >> "$GITHUB_PATH"
+
+      - name: Verify flatc version
+        run: flatc --version
+
+      - name: Regenerate Go + TS bindings
+        run: |
+          make -C pkg/schema/fbs fbs-go
+          make -C ui fbs-ts
+
+      - name: Assert no drift
+        run: |
+          if ! git diff --exit-code || [ -n "$(git status --porcelain)" ]; then
+            echo "::error::Committed FlatBuffers bindings differ from a flatc ${FLATC_VERSION} regeneration."
+            echo "Run 'make -C pkg/schema/fbs fbs-go' and 'make -C ui fbs-ts' with flatc ${FLATC_VERSION} and commit the result."
+            git status --porcelain
+            git --no-pager diff
+            exit 1
+          fi

.gitea/workflows/prod-build.yaml

@@ -16,6 +16,7 @@ on:
       - 'game/**'
       - 'pkg/**'
       - 'ui/**'
+      - 'site/**'
       - 'go.work'
       - 'go.work.sum'
       - '.gitea/workflows/prod-build.yaml'
@@ -87,10 +88,17 @@ jobs:
         working-directory: ui
         run: pnpm install --frozen-lockfile
 
+      - name: Build core.wasm
+        uses: ./.gitea/actions/build-wasm
+
       - name: Build UI bundle
         working-directory: ui/frontend
         env:
-          VITE_GATEWAY_BASE_URL: https://api.galaxy.com
+          # Single-origin deployment: an empty base URL means the
+          # gateway shares the document origin (REST at /api, Connect at
+          # /rpc). The game UI is served under the /game/ base path.
+          VITE_GATEWAY_BASE_URL: ""
+          BASE_PATH: /game
         run: |
           # Production response-signing public key is not in the repo
           # yet (the dev key in `tools/local-dev/keys/` is for dev
@@ -101,6 +109,14 @@ jobs:
           export VITE_GATEWAY_RESPONSE_PUBLIC_KEY="$(grep -E '^VITE_GATEWAY_RESPONSE_PUBLIC_KEY=' .env.development | cut -d= -f2)"
           pnpm build
 
+      - name: Install site dependencies
+        working-directory: site
+        run: pnpm install --frozen-lockfile
+
+      - name: Build project site
+        working-directory: site
+        run: pnpm build
+
       - name: Save images as artifact bundles
         run: |
           mkdir -p artifacts
@@ -112,6 +128,8 @@ jobs:
             | gzip >"artifacts/game-engine-${{ steps.tag.outputs.tag }}.tar.gz"
           tar -C ui/frontend -czf \
             "artifacts/ui-dist-${{ steps.tag.outputs.tag }}.tar.gz" build
+          tar -C site/.vitepress -czf \
+            "artifacts/site-dist-${{ steps.tag.outputs.tag }}.tar.gz" dist
 
       - name: Upload images
         uses: actions/upload-artifact@v4

.gitea/workflows/site-build.yaml

@@ -0,0 +1,47 @@
+name: Build · Site
+
+# Builds the VitePress project site so a broken site change fails its PR.
+# The dev-deploy / prod-build workflows build and ship the site
+# separately; this is the fast PR gate. No `!**/*.md` exclusion — the
+# site is Markdown, so content changes must be exercised too.
+
+on:
+  push:
+    paths:
+      - 'site/**'
+      - '.gitea/workflows/site-build.yaml'
+  pull_request:
+    paths:
+      - 'site/**'
+      - '.gitea/workflows/site-build.yaml'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.0.7
+          dest: ${{ runner.temp }}/setup-pnpm
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: site/pnpm-lock.yaml
+
+      - name: Install site dependencies
+        working-directory: site
+        run: pnpm install --frozen-lockfile
+
+      - name: Build project site
+        working-directory: site
+        run: pnpm build

.gitea/workflows/ui-test.yaml

@@ -61,6 +61,15 @@ jobs:
         working-directory: ui
         run: pnpm install --frozen-lockfile
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.work
+          cache: true
+
+      - name: Build core.wasm
+        uses: ./.gitea/actions/build-wasm
+
       - name: Install Playwright browsers
         # `--with-deps` would shell out to `sudo apt-get install` for
         # the system .so libraries, which the host-mode runner cannot
@@ -89,6 +98,12 @@ jobs:
         working-directory: ui/frontend
         run: pnpm exec playwright test
 
+      - name: Run PWA tests
+        # Builds + previews the production bundle (the service worker only
+        # precaches a real build) and checks manifest / SW / offline.
+        working-directory: ui/frontend
+        run: pnpm test:pwa
+
       - name: Upload Playwright report on failure
         if: failure()
         uses: actions/upload-artifact@v4
@@ -104,3 +119,16 @@ jobs:
           name: playwright-traces
           path: ui/frontend/test-results/
           retention-days: 14
+
+      - name: Remove root-owned build artifacts
+        if: always()
+        # In host-mode the job runs as root, so vite (test:pwa),
+        # svelte-kit and Playwright write these outputs root-owned into
+        # the shared host workspace. The act_runner (non-root) then
+        # cannot remove them at teardown ("unlinkat ... permission
+        # denied"), which spuriously fails this or a sibling job that
+        # inherits the dirty workspace (observed on go-unit). Clean them
+        # here while the step still has root, after the uploads above.
+        run: |
+          rm -rf ui/frontend/build ui/frontend/.svelte-kit \
+                 ui/frontend/test-results ui/frontend/playwright-report

CLAUDE.md

@@ -16,6 +16,12 @@ This repository hosts the Galaxy Game project.
   mirrored into `docs/FUNCTIONAL_ru.md` in the same patch (translate
   the changed paragraphs only, do not re-translate the whole file).
   A full re-translation only happens on explicit owner request.
+- `site/ru/rules.md` — the player-facing game rules (ported from the
+  former `game/rules.txt`). **Russian is authoritative here**, inverting
+  the usual English-first rule: the game's rules and lore are
+  Russian-native, so `site/ru/rules.md` leads and the English
+  `site/rules.md` is its mirror. Mirror point edits the same way as
+  `docs/FUNCTIONAL.md`, but RU → EN.
 - `docs/TESTING.md` — testing layers (unit / integration), the
   integration runbook, and the principles every test must follow
   (no-op observability for testcontainers, `t.Fatal` on
@@ -44,7 +50,8 @@ Branches:
   is manual through `deploy-prod.yaml`.
 - `development` — long-lived dev integration branch. Every merge into
   it auto-deploys to the dev environment via `dev-deploy.yaml`
-  (reachable at `https://www.galaxy.lan` / `https://api.galaxy.lan`).
+  (single origin `https://galaxy.lan`: site at `/`, game at `/game/`,
+  gateway REST at `/api`).
 - `feature/*` — short-lived branches off `development`. Merged back
   via PR; only then do they reach the dev environment automatically.
 

backend/README.md

@@ -27,10 +27,16 @@ The implementation specification lives in `PLAN.md`.
 | ------------------ | ----------------------------------------------- | ------------------------------------- |
 | `/api/v1/public/*` | none                                            | Registration, code confirmation       |
 | `/api/v1/user/*`   | `X-User-ID` injected by gateway                 | Authenticated end users               |
-| `/api/v1/admin/*`  | HTTP Basic Auth against `admin_accounts`        | Platform administrators               |
+| `/api/v1/admin/*`  | HTTP Basic Auth against `admin_accounts`        | Platform administrators (JSON)        |
+| `/_gm`, `/_gm/*`   | HTTP Basic Auth against `admin_accounts`        | Operator console (server-rendered HTML)|
 | `/healthz`         | none                                            | Liveness probe                        |
 | `/readyz`          | none                                            | Readiness probe                       |
 
+The `/_gm` operator console is the human-facing surface for the admin
+operations; it reuses the admin Basic Auth verifier, renders with
+`html/template`, and is the only admin surface exposed publicly (through
+the gateway). See `docs/admin-console.md`.
+
 The full contract is documented in `openapi.yaml` and validated at
 runtime by the contract tests under `internal/server/`.
 
@@ -100,6 +106,7 @@ fast.
 | `BACKEND_GAME_STATE_ROOT`               | yes      | —                             | Host directory bind-mounted into engine containers.   |
 | `BACKEND_ADMIN_BOOTSTRAP_USER`          | no       | —                             | Initial admin username; idempotent insert.            |
 | `BACKEND_ADMIN_BOOTSTRAP_PASSWORD`      | no       | —                             | Initial admin password; required if user is set.      |
+| `BACKEND_ADMIN_CONSOLE_CSRF_KEY`        | no       | random per-process            | Secret keying the `/_gm` console CSRF token. Set a shared value across replicas; unset uses a per-process random key (forms reset on restart). |
 | `BACKEND_GEOIP_DB_PATH`                 | yes      | —                             | Filesystem path to GeoLite2 Country `.mmdb`.          |
 | `BACKEND_OTEL_TRACES_EXPORTER`          | no       | `otlp`                        | `none`, `otlp`, `stdout`.                             |
 | `BACKEND_OTEL_METRICS_EXPORTER`         | no       | `otlp`                        | `none`, `otlp`, `stdout`, `prometheus`.               |
@@ -257,11 +264,13 @@ introduce its own request/response types.
 
 Endpoints used:
 
-- `POST /api/v1/admin/init`
+- `POST /api/v1/admin/init` — the runtime worker passes the canonical
+  `game_id` (the same UUID that names the engine container and the
+  host bind-mount directory) in the request body so the engine's
+  `state.json` shares identity with the backend's `games.game_id`.
 - `GET  /api/v1/admin/status`
 - `PUT  /api/v1/admin/turn`
 - `POST /api/v1/admin/race/banish`
-- `PUT  /api/v1/command`
 - `PUT  /api/v1/order`
 - `GET  /api/v1/report`
 - `GET  /healthz`

backend/cmd/backend/main.go

@@ -22,10 +22,10 @@ import (
 	_ "time/tzdata"
 
 	"galaxy/backend/internal/admin"
+	"galaxy/backend/internal/adminconsole"
 	"galaxy/backend/internal/app"
 	"galaxy/backend/internal/auth"
 	"galaxy/backend/internal/config"
-	"galaxy/backend/internal/devsandbox"
 	"galaxy/backend/internal/diplomail"
 	"galaxy/backend/internal/diplomail/detector"
 	"galaxy/backend/internal/diplomail/translator"
@@ -37,6 +37,7 @@ import (
 	"galaxy/backend/internal/mail"
 	"galaxy/backend/internal/metricsapi"
 	"galaxy/backend/internal/notification"
+	"galaxy/backend/internal/opsstatus"
 	backendpostgres "galaxy/backend/internal/postgres"
 	"galaxy/backend/push"
 	"galaxy/backend/internal/runtime"
@@ -272,29 +273,18 @@ func run(ctx context.Context) (err error) {
 	)
 	runtimeGateway.svc = runtimeSvc
 
-	// Run a single reconciliation pass before the dev-sandbox
+	// Run a single reconciliation pass at startup so any runtime row
-	// bootstrap so any runtime row pointing at a vanished engine
+	// pointing at a vanished engine container (a host reboot wiped
-	// container (host reboot wiped /tmp/galaxy-game-state/<uuid>;
+	// /tmp/galaxy-game-state/<uuid>; `tools/local-dev`'s
-	// `tools/local-dev`'s `prune-broken-engines` target reaped the
+	// `prune-broken-engines` target reaped the husk) is cascaded
-	// husk) is already cascaded through `markRemoved` → lobby
+	// through `markRemoved` → lobby `cancelled` before the server
-	// `cancelled` by the time the bootstrap walks the sandbox list.
+	// starts serving requests. Failures are
-	// Without this pre-tick the bootstrap would reuse the
-	// soon-to-be-cancelled game and force the developer into a
-	// second `make up` cycle to land a healthy sandbox. Failures are
 	// non-fatal: the periodic ticker started later catches up, and
 	// the worst case degrades to the legacy two-cycle recovery.
 	if err := runtimeSvc.Reconciler().Tick(ctx); err != nil {
 		logger.Warn("pre-bootstrap reconciler tick failed", zap.Error(err))
 	}
 
-	if err := devsandbox.Bootstrap(ctx, devsandbox.Deps{
-		Users:          userSvc,
-		Lobby:          lobbySvc,
-		EngineVersions: engineVersionSvc,
-	}, cfg.DevSandbox, logger); err != nil {
-		return fmt.Errorf("dev sandbox bootstrap: %w", err)
-	}
-
 	notifStore := notification.NewStore(db)
 	notifSvc := notification.NewService(notification.Deps{
 		Store:    notifStore,
@@ -360,6 +350,32 @@ func run(ctx context.Context) (err error) {
 		return authCache.Ready() && userCache.Ready() && adminCache.Ready() && lobbyCache.Ready() && runtimeCache.Ready()
 	}
 
+	var consoleCSRF *adminconsole.CSRF
+	if cfg.AdminConsole.CSRFKey != "" {
+		consoleCSRF = adminconsole.NewCSRF([]byte(cfg.AdminConsole.CSRFKey))
+	} else {
+		consoleCSRF, err = adminconsole.NewRandomCSRF()
+		if err != nil {
+			return fmt.Errorf("init admin console CSRF: %w", err)
+		}
+		logger.Warn("admin console CSRF key not set; using a per-process random key (forms reset on restart, not valid across replicas)",
+			zap.String("env", "BACKEND_ADMIN_CONSOLE_CSRF_KEY"))
+	}
+	adminConsoleHandlers := backendserver.NewAdminConsoleHandlers(backendserver.AdminConsoleDeps{
+		CSRF:    consoleCSRF,
+		Monitor:        opsstatus.NewStore(db),
+		Ready:          ready,
+		Users:          userSvc,
+		Games:          lobbySvc,
+		Runtime:        runtimeSvc,
+		EngineVersions: engineVersionSvc,
+		Operators:      adminSvc,
+		Mail:           mailSvc,
+		Notifications:  notifSvc,
+		Diplomail:      diplomailSvc,
+		Logger:         logger,
+	})
+
 	handler, err := backendserver.NewRouter(backendserver.RouterDependencies{
 		Logger:                logger,
 		Telemetry:             telemetryRT,
@@ -388,6 +404,7 @@ func run(ctx context.Context) (err error) {
 		AdminGeo:              adminGeoHandlers,
 		UserGames:             userGamesHandlers,
 		UserMail:              userMailHandlers,
+		AdminConsole:          adminConsoleHandlers,
 	})
 	if err != nil {
 		return fmt.Errorf("build backend router: %w", err)
@@ -485,6 +502,17 @@ func (a *userEntitlementAdapter) GetMaxRegisteredRaceNames(ctx context.Context,
 	return snap.MaxRegisteredRaceNames, nil
 }
 
+func (a *userEntitlementAdapter) IsPaid(ctx context.Context, userID uuid.UUID) (bool, error) {
+	if a == nil || a.svc == nil {
+		return false, nil
+	}
+	snap, err := a.svc.GetEntitlementSnapshot(ctx, userID)
+	if err != nil {
+		return false, err
+	}
+	return snap.IsPaid, nil
+}
+
 // runtimeGatewayAdapter implements `lobby.RuntimeGateway` by
 // delegating to `*runtime.Service`. The svc pointer is patched after
 // the services are constructed — runtime depends on lobby

backend/docs/admin-console.md

@@ -0,0 +1,128 @@
+# Operator console (`/_gm`)
+
+The operator console is a server-rendered web UI for the platform's admin
+operations. It is the human-facing counterpart to the JSON admin API under
+`/api/v1/admin/*`: both call the same service layer, but the console renders
+HTML pages an operator drives in a browser, while the JSON API stays internal
+to the deployment for programmatic and test use.
+
+## Design choices
+
+- **Server-rendered, no client framework.** Pages are rendered with the
+  standard library's `html/template`. Navigation is by ordinary links and
+  query parameters; every state change is an HTML form `POST` answered with a
+  Post/Redirect/Get redirect. There is no build step, no JavaScript framework,
+  and no separate asset pipeline — a single embedded stylesheet under
+  `/_gm/assets/`.
+- **Reuses the existing admin auth.** The console mounts behind the same
+  `basicauth.Middleware(admin.Service)` verifier that gates `/api/v1/admin/*`,
+  so there is one credential store (`admin_accounts`, bcrypt-12) and no second
+  secret to manage.
+- **Lives in the backend.** The backend owns the admin domain and the data, so
+  rendering there lets the console call the service layer directly. The gateway
+  stays a thin proxy.
+
+## Request path
+
+```
+Browser ── /_gm/* ──► edge Caddy ──► gateway (public listener)
+   gateway: anti-abuse `admin` class (per-IP rate limit, body + method limits)
+            └─► reverse proxy ──► backend  /_gm/*
+   backend: basicauth.Middleware(admin.Service)
+            └─► CSRF guard (state-changing methods)
+                └─► console handler ──► admin service layer ──► html/template
+```
+
+The gateway preserves the inbound `Host` and relays the backend's `401` Basic
+Auth challenge unchanged, so the browser shows its native credential dialog.
+The gateway adds only the edge anti-abuse layer; authentication and every state
+change are enforced by the backend. The gateway answers `502` when the backend
+is unreachable. See the gateway README "Operator Console Proxy" section for the
+`admin` route-class env vars.
+
+## Components (package `internal/adminconsole`)
+
+The package is framework-agnostic (no gin) so it unit-tests in isolation:
+
+- `Renderer` — parses the embedded layout plus one content page per route and
+  renders a named page wrapped in the shared layout. Rendering goes through an
+  intermediate buffer, so a template failure never emits a partial document.
+- `CSRF` — issues and verifies the stateless anti-CSRF token: HMAC-SHA256 over
+  the authenticated username, keyed by `BACKEND_ADMIN_CONSOLE_CSRF_KEY`. When
+  the key is unset a per-process random key is used (secure, but forms reset on
+  restart and do not validate across replicas — set a shared key for
+  multi-replica deployments).
+- `Assets` — the embedded stylesheet filesystem served under `/_gm/assets/`.
+
+The gin glue (route group, Basic Auth, the CSRF guard middleware, the per-page
+handlers) lives in `internal/server/handlers_admin_console.go` and
+`internal/server/router.go` (`registerAdminConsoleRoutes`).
+
+## CSRF protection
+
+Because the console is sessionless (HTTP Basic Auth, whose credentials the
+browser replays automatically), state-changing requests are double-guarded:
+
+1. A stateless per-operator token (`_csrf` form field) that a cross-site page
+   cannot read or forge.
+2. A same-origin `Origin`/`Referer` check (when the browser sends one), which
+   relies on the gateway preserving the inbound `Host`.
+
+Safe methods (`GET`/`HEAD`/`OPTIONS`) pass without a token.
+
+## Monitoring
+
+The dashboard is the console landing page. It surfaces backend-visible
+operational state — service health, game-runtime status, and queue depths —
+read through the existing service and persistence layers. Richer cross-service
+metrics are out of scope for the console itself: the `/metrics` Prometheus
+exporters on `backend` and `gateway` are wired and enabled in the dev
+deployment so a future Prometheus + Grafana stack can scrape them without code
+changes.
+
+## Pages
+
+| Path                              | Method   | Purpose                                                        |
+| --------------------------------- | -------- | -------------------------------------------------------------- |
+| `/_gm`, `/_gm/`                   | GET      | Dashboard: health, runtime/mail/notification status, queues.   |
+| `/_gm/assets/*`                   | GET      | Embedded stylesheet.                                           |
+| `/_gm/users`                      | GET      | Paginated account list.                                        |
+| `/_gm/users/{id}`                 | GET      | Account detail: profile, entitlement, active sanctions.        |
+| `/_gm/users/{id}/block`           | POST     | Apply a permanent block (reason required).                     |
+| `/_gm/users/{id}/entitlement`     | POST     | Set the entitlement tier.                                      |
+| `/_gm/users/{id}/soft-delete`     | POST     | Soft-delete the account (cascades).                            |
+| `/_gm/games`                      | GET/POST | Paginated game list; POST creates a public game.               |
+| `/_gm/games/{id}`                 | GET      | Game detail with the runtime snapshot.                         |
+| `/_gm/games/{id}/force-start`     | POST     | Force-start the game.                                          |
+| `/_gm/games/{id}/force-stop`      | POST     | Force-stop the game.                                          |
+| `/_gm/games/{id}/ban-member`      | POST     | Ban a member (user id + reason).                               |
+| `/_gm/games/{id}/runtime/restart` | POST     | Restart the engine container.                                  |
+| `/_gm/games/{id}/runtime/patch`   | POST     | Patch the runtime to a target version.                         |
+| `/_gm/games/{id}/runtime/force-next-turn` | POST | Force the next turn now.                                  |
+| `/_gm/engine-versions`            | GET/POST | Version registry; POST registers a version.                    |
+| `/_gm/engine-versions/{ver}/disable` | POST  | Disable a registered version.                                  |
+| `/_gm/operators`                  | GET/POST | Admin-account list; POST creates an operator.                  |
+| `/_gm/operators/{user}/disable`   | POST     | Disable an operator.                                          |
+| `/_gm/operators/{user}/enable`    | POST     | Re-enable an operator.                                        |
+| `/_gm/operators/{user}/reset-password` | POST | Reset an operator's password.                                  |
+| `/_gm/mail`                       | GET      | Mail deliveries (paginated) + a dead-letter snapshot.          |
+| `/_gm/mail/deliveries/{id}`       | GET      | Delivery detail with its attempts.                             |
+| `/_gm/mail/deliveries/{id}/resend`| POST     | Re-enqueue a non-sent delivery.                                |
+| `/_gm/notifications`              | GET      | Notifications, dead-letters, and malformed intents overview.   |
+| `/_gm/broadcast`                  | GET/POST | Admin multi-game diplomatic broadcast.                         |
+
+Each page reuses the same service layer as the corresponding `/api/v1/admin/*`
+JSON endpoint; the console adds no business logic. Collection-mutating POSTs are
+mounted on the collection path (`POST /_gm/games`, `POST /_gm/engine-versions`)
+so a static action segment never collides with a path parameter in the gin
+router. Unblocking a user is not yet available because the JSON admin API
+exposes no remove-sanction endpoint.
+
+## Configuration
+
+| Variable                          | Where   | Notes                                                        |
+| --------------------------------- | ------- | ------------------------------------------------------------ |
+| `BACKEND_ADMIN_CONSOLE_CSRF_KEY`  | backend | CSRF token key; unset → per-process random key.              |
+| `BACKEND_ADMIN_BOOTSTRAP_USER`    | backend | Bootstrap operator account (shared with the JSON admin API). |
+| `BACKEND_ADMIN_BOOTSTRAP_PASSWORD`| backend | Bootstrap operator password.                                 |
+| `GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_ADMIN_*` | gateway | `admin` route-class rate-limit and body budgets.      |

backend/docs/flows.md

@@ -234,8 +234,8 @@ sequenceDiagram
 
     Workers->>Docker: pull / create / start engine container
     Docker-->>Workers: container id
-    Workers->>Engine: POST /api/v1/admin/init
+    Workers->>Engine: POST /api/v1/admin/init {gameId, races}
-    Engine-->>Workers: ok / error
+    Engine-->>Workers: StateResponse{id == gameId} / error
     Workers->>Runtime: write runtime_records (running or start_failed)
     Workers->>Lobby: OnRuntimeJobResult
 

backend/docs/runtime.md

@@ -141,7 +141,10 @@ boot).
   polls the engine `/healthz` until the listener is bound (Docker
   marks a container running as soon as the entrypoint starts; the
   Go binary inside takes a moment to bind its TCP port). Only after
-  `/healthz` succeeds does the worker call `/admin/init`.
+  `/healthz` succeeds does the worker call `/admin/init`, passing the
+  same `game_id` the backend uses to mount the engine's storage
+  directory; the engine echoes it back in `StateResponse.id`. The
+  engine rejects a mismatched gameId with `409 Conflict`.
 - **Runtime scheduler** (`internal/runtime.SchedulerComponent`) —
   `pkg/cronutil` schedule per running game; each tick invokes the
   engine `admin/turn`. Force-next-turn flips a one-shot skip flag in

backend/go.mod

@@ -7,6 +7,7 @@ require (
 	galaxy/model v0.0.0
 	galaxy/postgres v0.0.0
 	galaxy/util v0.0.0-00010101000000-000000000000
+	github.com/abadojack/whatlanggo v1.0.1
 	github.com/disciplinedware/go-confusables v0.1.1
 	github.com/getkin/kin-openapi v0.135.0
 	github.com/gin-gonic/gin v1.12.0
@@ -36,7 +37,6 @@ require (
 )
 
 require (
-	github.com/abadojack/whatlanggo v1.0.1 // indirect
 	github.com/oschwald/geoip2-golang/v2 v2.1.0 // indirect
 	github.com/oschwald/maxminddb-golang/v2 v2.1.1 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect

backend/internal/adminconsole/assets/console.css

@@ -0,0 +1,103 @@
+/* Admin console stylesheet. Deliberately small and dependency-free: the
+   console is an internal operator tool, not a public surface. */
+:root {
+  --bg: #11151c;
+  --panel: #1b2230;
+  --panel-hi: #232c3d;
+  --ink: #e6ebf2;
+  --ink-dim: #9aa7ba;
+  --line: #2c3850;
+  --accent: #5aa9ff;
+  --danger: #ff6b6b;
+  --ok: #4ecb8d;
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--ink);
+  font: 15px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+}
+a { color: var(--accent); text-decoration: none; }
+a:hover { text-decoration: underline; }
+.topbar {
+  display: flex;
+  align-items: center;
+  gap: 1.5rem;
+  padding: 0.6rem 1.2rem;
+  background: var(--panel);
+  border-bottom: 1px solid var(--line);
+}
+.topbar .brand { font-weight: 700; letter-spacing: 0.04em; }
+.topbar .mainnav { display: flex; gap: 1rem; flex: 1; }
+.topbar .mainnav a.active { color: var(--ink); border-bottom: 2px solid var(--accent); }
+.topbar .who { color: var(--ink-dim); }
+.content { padding: 1.5rem; max-width: 1100px; margin: 0 auto; }
+h1 { font-size: 1.4rem; margin: 0 0 0.4rem; }
+.lede { color: var(--ink-dim); margin-top: 0; }
+.cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 1rem; margin-top: 1.5rem; }
+.card {
+  display: block;
+  padding: 1rem 1.2rem;
+  background: var(--panel);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  color: var(--ink);
+}
+.card:hover { background: var(--panel-hi); text-decoration: none; }
+.card h2 { font-size: 1.05rem; margin: 0 0 0.3rem; color: var(--accent); }
+.card p { margin: 0; color: var(--ink-dim); font-size: 0.9rem; }
+
+.panel {
+  padding: 0.9rem 1.1rem;
+  background: var(--panel);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  margin-bottom: 1rem;
+}
+.panel h2 { font-size: 1rem; margin: 0 0 0.6rem; color: var(--ink); }
+.grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 1rem; margin-bottom: 1rem; }
+.grid .panel { margin-bottom: 0; }
+.kv { list-style: none; margin: 0; padding: 0; }
+.kv li { padding: 0.15rem 0; color: var(--ink-dim); }
+.counts { width: 100%; border-collapse: collapse; font-size: 0.9rem; }
+.counts td { padding: 0.2rem 0; border-bottom: 1px solid var(--line); color: var(--ink-dim); }
+.counts td.num { text-align: right; color: var(--ink); font-variant-numeric: tabular-nums; }
+.bignum { font-size: 1.6rem; margin: 0; color: var(--ink); }
+.note { color: var(--ink-dim); font-style: italic; margin: 0.2rem 0; }
+.errors { border-color: var(--danger); }
+.errors ul { margin: 0; padding-left: 1.1rem; color: var(--danger); }
+.ok { color: var(--ok); }
+.bad { color: var(--danger); }
+
+.list { width: 100%; border-collapse: collapse; font-size: 0.9rem; margin-bottom: 1rem; }
+.list th, .list td { text-align: left; padding: 0.35rem 0.6rem; border-bottom: 1px solid var(--line); }
+.list th { color: var(--ink-dim); font-weight: 600; }
+.list tr:hover td { background: var(--panel-hi); }
+.pager { display: flex; gap: 1rem; align-items: center; color: var(--ink-dim); }
+.form { display: flex; flex-wrap: wrap; gap: 0.6rem; align-items: end; margin-top: 0.8rem; }
+.form label { display: flex; flex-direction: column; gap: 0.2rem; font-size: 0.85rem; color: var(--ink-dim); }
+.form input, .form select {
+  background: var(--bg);
+  color: var(--ink);
+  border: 1px solid var(--line);
+  border-radius: 6px;
+  padding: 0.35rem 0.5rem;
+  font: inherit;
+}
+button {
+  background: var(--accent);
+  color: #06121f;
+  border: 0;
+  border-radius: 6px;
+  padding: 0.4rem 0.9rem;
+  font: inherit;
+  font-weight: 600;
+  cursor: pointer;
+}
+button:hover { filter: brightness(1.1); }
+button.danger { background: var(--danger); color: #1a0606; }
+code { background: var(--bg); padding: 0.05rem 0.3rem; border-radius: 4px; }
+.actions { display: flex; flex-wrap: wrap; gap: 0.6rem; margin: 0.8rem 0; }
+.actions form { margin: 0; }
+.subnav { color: var(--ink-dim); margin: -0.3rem 0 1rem; font-size: 0.9rem; }

backend/internal/adminconsole/csrf.go

@@ -0,0 +1,54 @@
+package adminconsole
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+)
+
+// CSRF issues and verifies the stateless anti-CSRF token used by the admin
+// console. The token is an HMAC-SHA256 over the authenticated operator's
+// username keyed by a process secret, so a cross-site request cannot forge it
+// without already being able to read an authenticated page. The console is
+// sessionless (HTTP Basic Auth), which makes a stateless, per-operator token
+// the natural fit.
+type CSRF struct {
+	key []byte
+}
+
+// NewCSRF returns a CSRF signer keyed by key. A shared key across backend
+// replicas lets a form rendered by one replica validate on another; callers
+// that pass a per-process random key (see NewRandomCSRF) accept that forms do
+// not survive a restart or span replicas.
+func NewCSRF(key []byte) *CSRF {
+	return &CSRF{key: key}
+}
+
+// NewRandomCSRF returns a CSRF signer keyed by a fresh 32-byte random secret.
+// It is the secure default when no shared key is configured.
+func NewRandomCSRF() (*CSRF, error) {
+	key := make([]byte, 32)
+	if _, err := rand.Read(key); err != nil {
+		return nil, fmt.Errorf("generate admin console CSRF key: %w", err)
+	}
+	return &CSRF{key: key}, nil
+}
+
+// Token returns the anti-CSRF token bound to username.
+func (c *CSRF) Token(username string) string {
+	mac := hmac.New(sha256.New, c.key)
+	mac.Write([]byte(username))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+// Verify reports whether token is the valid anti-CSRF token for username. The
+// comparison runs in constant time relative to the token bytes.
+func (c *CSRF) Verify(username, token string) bool {
+	if token == "" {
+		return false
+	}
+	expected := c.Token(username)
+	return hmac.Equal([]byte(token), []byte(expected))
+}

backend/internal/adminconsole/csrf_test.go

@@ -0,0 +1,42 @@
+package adminconsole
+
+import "testing"
+
+func TestCSRFTokenRoundTrip(t *testing.T) {
+	signer := NewCSRF([]byte("shared-secret"))
+	token := signer.Token("alice")
+
+	if !signer.Verify("alice", token) {
+		t.Fatal("valid token rejected")
+	}
+	if signer.Verify("bob", token) {
+		t.Fatal("token accepted for a different operator")
+	}
+	if signer.Verify("alice", "") {
+		t.Fatal("empty token accepted")
+	}
+	if signer.Verify("alice", token+"x") {
+		t.Fatal("tampered token accepted")
+	}
+}
+
+func TestCSRFKeySeparation(t *testing.T) {
+	a := NewCSRF([]byte("key-a"))
+	b := NewCSRF([]byte("key-b"))
+	if a.Token("operator") == b.Token("operator") {
+		t.Fatal("tokens collide across distinct keys")
+	}
+	if b.Verify("operator", a.Token("operator")) {
+		t.Fatal("token minted under one key verified under another")
+	}
+}
+
+func TestRandomCSRFRoundTrip(t *testing.T) {
+	signer, err := NewRandomCSRF()
+	if err != nil {
+		t.Fatalf("NewRandomCSRF: %v", err)
+	}
+	if !signer.Verify("operator", signer.Token("operator")) {
+		t.Fatal("random-key token failed to round-trip")
+	}
+}

backend/internal/adminconsole/dashboard.go

@@ -0,0 +1,24 @@
+package adminconsole
+
+// StatusCount pairs a status label with its current row count for the
+// dashboard's per-status tables. It is the view-layer counterpart of the
+// data gathered by the ops-status reader; the server handler maps between
+// them so this package stays free of database concerns.
+type StatusCount struct {
+	Status string
+	Count  int64
+}
+
+// DashboardData is the view model for the console landing page. MonitorAvailable
+// is false when no ops-status reader is wired, in which case the monitoring
+// panels are omitted. Errors carries non-fatal probe failures for display.
+type DashboardData struct {
+	MonitorAvailable      bool
+	BackendReady          bool
+	PostgresHealthy       bool
+	Runtimes              []StatusCount
+	MailDeliveries        []StatusCount
+	NotificationRoutes    []StatusCount
+	NotificationMalformed int64
+	Errors                []string
+}

backend/internal/adminconsole/doc.go

@@ -0,0 +1,18 @@
+// Package adminconsole renders the server-side operator console mounted by the
+// backend under the `/_gm` route group.
+//
+// The console is a multi-page, server-rendered surface built on the standard
+// library's html/template package: navigation is driven by request path and
+// query, state changes are submitted with HTML forms and answered with a
+// Post/Redirect/Get redirect. The package owns three concerns and nothing
+// transport-specific:
+//
+//   - Renderer composes the shared layout with one content page per route.
+//   - CSRF issues and verifies the stateless anti-CSRF token embedded in every
+//     state-changing form.
+//   - Assets exposes the embedded stylesheet served under `/_gm/assets/`.
+//
+// The gin glue (route registration, Basic Auth, the CSRF guard middleware, and
+// the per-page handlers) lives in package server; this package stays free of
+// the web framework so it can be unit-tested in isolation.
+package adminconsole

backend/internal/adminconsole/games.go

@@ -0,0 +1,67 @@
+package adminconsole
+
+// GameRow is one line in the games list table.
+type GameRow struct {
+	GameID       string
+	GameName     string
+	Visibility   string
+	Status       string
+	Owner        string
+	Players      string
+	TurnSchedule string
+	CreatedAt    string
+}
+
+// GamesListData is the view model for the paginated games list.
+type GamesListData struct {
+	Items    []GameRow
+	Page     int
+	PageSize int
+	Total    int
+	HasPrev  bool
+	HasNext  bool
+	PrevPage int
+	NextPage int
+}
+
+// GameDetailData is the view model for a single game, combining the lobby
+// record with the runtime snapshot and the available actions.
+type GameDetailData struct {
+	GameID              string
+	GameName            string
+	Description         string
+	Visibility          string
+	Status              string
+	Owner               string
+	MinPlayers          int32
+	MaxPlayers          int32
+	StartGapHours       int32
+	StartGapPlayers     int32
+	TurnSchedule        string
+	TargetEngineVersion string
+	EnrollmentEndsAt    string
+	CreatedAt           string
+	StartedAt           string
+	FinishedAt          string
+
+	HasRuntime           bool
+	RuntimeStatus        string
+	CurrentEngineVersion string
+	EngineHealth         string
+	CurrentTurn          int32
+	NextGenerationAt     string
+	Paused               bool
+}
+
+// EngineVersionRow is one line in the engine-version registry table.
+type EngineVersionRow struct {
+	Version   string
+	ImageRef  string
+	Enabled   bool
+	CreatedAt string
+}
+
+// EngineVersionsData is the view model for the engine-version registry page.
+type EngineVersionsData struct {
+	Items []EngineVersionRow
+}

backend/internal/adminconsole/mail.go

@@ -0,0 +1,86 @@
+package adminconsole
+
+// MailDeliveryRow is one line in the mail deliveries table.
+type MailDeliveryRow struct {
+	DeliveryID  string
+	Template    string
+	Status      string
+	Attempts    int32
+	NextAttempt string
+	Created     string
+}
+
+// MailDeadLetterRow is one line in the mail dead-letters table.
+type MailDeadLetterRow struct {
+	DeliveryID string
+	Reason     string
+	Archived   string
+}
+
+// MailData is the view model for the mail page: a paginated deliveries list
+// plus a snapshot of dead-letters.
+type MailData struct {
+	Deliveries  []MailDeliveryRow
+	DeadLetters []MailDeadLetterRow
+	Page        int
+	PageSize    int
+	Total       int64
+	HasPrev     bool
+	HasNext     bool
+	PrevPage    int
+	NextPage    int
+}
+
+// MailAttemptRow is one delivery attempt on the mail detail page.
+type MailAttemptRow struct {
+	AttemptNo int32
+	Outcome   string
+	Started   string
+	Finished  string
+	Error     string
+}
+
+// MailDeliveryDetail is the view model for a single delivery.
+type MailDeliveryDetail struct {
+	DeliveryID   string
+	Template     string
+	Status       string
+	Attempts     int32
+	NextAttempt  string
+	LastError    string
+	Created      string
+	Sent         string
+	DeadLettered string
+	CanResend    bool
+	AttemptRows  []MailAttemptRow
+}
+
+// NotificationRow is one line in the notifications table.
+type NotificationRow struct {
+	NotificationID string
+	Kind           string
+	UserID         string
+	Created        string
+}
+
+// NotificationDeadLetterRow is one line in the notification dead-letters table.
+type NotificationDeadLetterRow struct {
+	NotificationID string
+	RouteID        string
+	Reason         string
+	Archived       string
+}
+
+// MalformedRow is one line in the malformed-intents table.
+type MalformedRow struct {
+	ID       string
+	Reason   string
+	Received string
+}
+
+// NotificationsData is the view model for the notifications overview page.
+type NotificationsData struct {
+	Notifications []NotificationRow
+	DeadLetters   []NotificationDeadLetterRow
+	Malformed     []MalformedRow
+}

backend/internal/adminconsole/message.go

@@ -0,0 +1,11 @@
+package adminconsole
+
+// MessageData is the view model for the generic message page used to render
+// not-found, validation, and operation-failure notices. Class selects the CSS
+// styling (for example "bad" for errors); BackHref, when set, renders a link
+// back to a relevant page.
+type MessageData struct {
+	Message  string
+	Class    string
+	BackHref string
+}

backend/internal/adminconsole/operators.go

@@ -0,0 +1,14 @@
+package adminconsole
+
+// OperatorRow is one line in the operators (admin accounts) table.
+type OperatorRow struct {
+	Username   string
+	CreatedAt  string
+	LastUsedAt string
+	Disabled   bool
+}
+
+// OperatorsData is the view model for the operators page.
+type OperatorsData struct {
+	Items []OperatorRow
+}

backend/internal/adminconsole/render.go

@@ -0,0 +1,107 @@
+package adminconsole
+
+import (
+	"bytes"
+	"embed"
+	"fmt"
+	"html/template"
+	"io"
+	"io/fs"
+	"path"
+	"strings"
+)
+
+//go:embed templates
+var templatesFS embed.FS
+
+//go:embed assets
+var assetsFS embed.FS
+
+// Renderer holds the parsed admin console templates. It composes one template
+// set per content page, each combining the shared layout (defining the page
+// chrome and the "layout" entry template) with that page's "content" block, so
+// rendering a page is a single ExecuteTemplate call against the "layout" name.
+type Renderer struct {
+	pages map[string]*template.Template
+}
+
+// PageData is the view model passed to every admin console page. Title is the
+// document title; Username is the authenticated operator; CSRFToken is the
+// per-operator token embedded into state-changing forms; ActiveNav marks the
+// highlighted navigation entry; Data carries the page-specific payload.
+type PageData struct {
+	Title     string
+	Username  string
+	CSRFToken string
+	ActiveNav string
+	Data      any
+}
+
+// NewRenderer parses the embedded layout and every content page under
+// templates/pages, returning a Renderer ready to serve them. It fails when a
+// template cannot be parsed.
+func NewRenderer() (*Renderer, error) {
+	base, err := template.New("layout").ParseFS(templatesFS, "templates/layout.gohtml")
+	if err != nil {
+		return nil, fmt.Errorf("parse admin console layout: %w", err)
+	}
+
+	pageFiles, err := fs.Glob(templatesFS, "templates/pages/*.gohtml")
+	if err != nil {
+		return nil, fmt.Errorf("enumerate admin console pages: %w", err)
+	}
+	if len(pageFiles) == 0 {
+		return nil, fmt.Errorf("admin console: no page templates found under templates/pages")
+	}
+
+	pages := make(map[string]*template.Template, len(pageFiles))
+	for _, file := range pageFiles {
+		name := strings.TrimSuffix(path.Base(file), ".gohtml")
+		clone, err := base.Clone()
+		if err != nil {
+			return nil, fmt.Errorf("clone admin console layout for %q: %w", name, err)
+		}
+		if _, err := clone.ParseFS(templatesFS, file); err != nil {
+			return nil, fmt.Errorf("parse admin console page %q: %w", name, err)
+		}
+		pages[name] = clone
+	}
+
+	return &Renderer{pages: pages}, nil
+}
+
+// MustNewRenderer is like NewRenderer but panics on error. The templates are
+// embedded at build time, so a parse failure is a programmer error rather than
+// a runtime condition.
+func MustNewRenderer() *Renderer {
+	renderer, err := NewRenderer()
+	if err != nil {
+		panic(err)
+	}
+	return renderer
+}
+
+// Render writes the named page, wrapped in the shared layout, to w using data.
+// It returns an error when page is unknown or template execution fails; the
+// page is rendered into an intermediate buffer first so a mid-render failure
+// never emits a partial document to w.
+func (r *Renderer) Render(w io.Writer, page string, data PageData) error {
+	tmpl, ok := r.pages[page]
+	if !ok {
+		return fmt.Errorf("admin console: unknown page %q", page)
+	}
+
+	var buf bytes.Buffer
+	if err := tmpl.ExecuteTemplate(&buf, "layout", data); err != nil {
+		return fmt.Errorf("render admin console page %q: %w", page, err)
+	}
+
+	_, err := buf.WriteTo(w)
+	return err
+}
+
+// Assets returns the embedded static asset tree rooted at the assets directory,
+// suitable for serving under `/_gm/assets/`.
+func Assets() (fs.FS, error) {
+	return fs.Sub(assetsFS, "assets")
+}

backend/internal/adminconsole/render_test.go

@@ -0,0 +1,67 @@
+package adminconsole
+
+import (
+	"bytes"
+	"io/fs"
+	"strings"
+	"testing"
+)
+
+func TestRendererRendersDashboard(t *testing.T) {
+	renderer, err := NewRenderer()
+	if err != nil {
+		t.Fatalf("NewRenderer: %v", err)
+	}
+
+	var buf bytes.Buffer
+	err = renderer.Render(&buf, "dashboard", PageData{
+		Title:     "Dashboard",
+		Username:  "ops-bob",
+		ActiveNav: "dashboard",
+	})
+	if err != nil {
+		t.Fatalf("Render: %v", err)
+	}
+
+	out := buf.String()
+	for _, want := range []string{
+		"<!DOCTYPE html>",
+		"Dashboard",
+		"ops-bob",
+		`href="/_gm/users"`,
+		"/_gm/assets/console.css",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("rendered page missing %q\n--- page ---\n%s", want, out)
+		}
+	}
+}
+
+func TestRendererUnknownPage(t *testing.T) {
+	renderer := MustNewRenderer()
+	if err := renderer.Render(&bytes.Buffer{}, "does-not-exist", PageData{}); err == nil {
+		t.Fatal("expected an error rendering an unknown page")
+	}
+}
+
+func TestRendererEscapesUsername(t *testing.T) {
+	renderer := MustNewRenderer()
+
+	var buf bytes.Buffer
+	if err := renderer.Render(&buf, "dashboard", PageData{Username: "<script>evil</script>"}); err != nil {
+		t.Fatalf("Render: %v", err)
+	}
+	if strings.Contains(buf.String(), "<script>evil</script>") {
+		t.Error("username was not HTML-escaped in the rendered page")
+	}
+}
+
+func TestAssetsContainsStylesheet(t *testing.T) {
+	fsys, err := Assets()
+	if err != nil {
+		t.Fatalf("Assets: %v", err)
+	}
+	if _, err := fs.Stat(fsys, "console.css"); err != nil {
+		t.Fatalf("console.css missing from embedded assets: %v", err)
+	}
+}

backend/internal/adminconsole/templates/layout.gohtml

@@ -0,0 +1,30 @@
+{{define "layout" -}}
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<title>{{.Title}} · Galaxy GM</title>
+<link rel="stylesheet" href="/_gm/assets/console.css">
+</head>
+<body>
+<header class="topbar">
+  <span class="brand">Galaxy · GM</span>
+  <nav class="mainnav">
+    <a href="/_gm/"{{if eq .ActiveNav "dashboard"}} class="active"{{end}}>Dashboard</a>
+    <a href="/_gm/users"{{if eq .ActiveNav "users"}} class="active"{{end}}>Users</a>
+    <a href="/_gm/games"{{if eq .ActiveNav "games"}} class="active"{{end}}>Games</a>
+    <a href="/_gm/operators"{{if eq .ActiveNav "operators"}} class="active"{{end}}>Operators</a>
+    <a href="/_gm/mail"{{if eq .ActiveNav "mail"}} class="active"{{end}}>Mail</a>
+    <a href="/_gm/grafana/" target="_blank" rel="noopener">Grafana</a>
+    <a href="/_gm/mailpit/" target="_blank" rel="noopener">Mailpit</a>
+  </nav>
+  <span class="who">{{.Username}}</span>
+</header>
+<main class="content">
+{{template "content" .}}
+</main>
+</body>
+</html>
+{{- end}}

backend/internal/adminconsole/templates/pages/broadcast.gohtml

@@ -0,0 +1,21 @@
+{{define "content" -}}
+{{$csrf := .CSRFToken}}
+<h1>Broadcast</h1>
+<nav class="subnav"><a href="/_gm/mail">Deliveries</a> · <a href="/_gm/notifications">Notifications</a> · <a href="/_gm/broadcast">Broadcast</a></nav>
+<section class="panel">
+<h2>Admin broadcast</h2>
+<form method="post" action="/_gm/broadcast" class="form">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>Scope
+<select name="scope"><option value="all_running">all running games</option><option value="selected">selected games</option></select>
+</label>
+<label>Game IDs (comma-separated, for "selected") <input type="text" name="game_ids" placeholder="uuid,uuid"></label>
+<label>Recipients
+<select name="recipients"><option value="active">active members</option><option value="active_and_removed">active and removed</option><option value="all_members">all members</option></select>
+</label>
+<label>Subject <input type="text" name="subject"></label>
+<label>Body <input type="text" name="body" required></label>
+<button type="submit">Send broadcast</button>
+</form>
+</section>
+{{- end}}

backend/internal/adminconsole/templates/pages/dashboard.gohtml

@@ -0,0 +1,69 @@
+{{define "content" -}}
+<h1>Dashboard</h1>
+<p class="lede">Signed in as <strong>{{.Username}}</strong>.</p>
+{{with .Data}}
+<section class="panel">
+  <h2>Health</h2>
+  <ul class="kv">
+    <li>Backend ready: {{if .BackendReady}}<span class="ok">yes</span>{{else}}<span class="bad">no</span>{{end}}</li>
+    <li>Postgres: {{if .PostgresHealthy}}<span class="ok">healthy</span>{{else}}<span class="bad">unreachable</span>{{end}}</li>
+  </ul>
+</section>
+{{if .MonitorAvailable}}
+<div class="grid">
+  <section class="panel">
+    <h2>Game runtimes</h2>
+    {{template "statuscounts" .Runtimes}}
+  </section>
+  <section class="panel">
+    <h2>Mail deliveries</h2>
+    {{template "statuscounts" .MailDeliveries}}
+  </section>
+  <section class="panel">
+    <h2>Notification routes</h2>
+    {{template "statuscounts" .NotificationRoutes}}
+  </section>
+  <section class="panel">
+    <h2>Malformed notifications</h2>
+    <p class="bignum {{if gt .NotificationMalformed 0}}bad{{end}}">{{.NotificationMalformed}}</p>
+  </section>
+</div>
+{{if .Errors}}
+<section class="panel errors">
+  <h2>Collection errors</h2>
+  <ul>{{range .Errors}}<li>{{.}}</li>{{end}}</ul>
+</section>
+{{end}}
+{{else}}
+<p class="note">Monitoring is not wired in this deployment.</p>
+{{end}}
+{{end}}
+<section class="cards">
+  <a class="card" href="/_gm/users">
+    <h2>Users</h2>
+    <p>Accounts, sanctions, entitlements, soft-delete.</p>
+  </a>
+  <a class="card" href="/_gm/games">
+    <h2>Games &amp; runtimes</h2>
+    <p>Lobby state, engine versions, turn control.</p>
+  </a>
+  <a class="card" href="/_gm/operators">
+    <h2>Operators</h2>
+    <p>Admin accounts: create, disable, reset password.</p>
+  </a>
+  <a class="card" href="/_gm/mail">
+    <h2>Mail &amp; notifications</h2>
+    <p>Deliveries, dead-letters, broadcasts.</p>
+  </a>
+</section>
+{{- end}}
+
+{{define "statuscounts" -}}
+{{if .}}
+<table class="counts"><tbody>
+{{range .}}<tr><td>{{.Status}}</td><td class="num">{{.Count}}</td></tr>{{end}}
+</tbody></table>
+{{else}}
+<p class="note">none</p>
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/engine_versions.gohtml

@@ -0,0 +1,30 @@
+{{define "content" -}}
+{{$csrf := .CSRFToken}}
+<h1>Engine versions</h1>
+{{with .Data}}
+<table class="list">
+<thead><tr><th>Version</th><th>Image</th><th>Enabled</th><th>Created</th><th></th></tr></thead>
+<tbody>
+{{range .Items}}
+<tr>
+<td>{{.Version}}</td>
+<td><code>{{.ImageRef}}</code></td>
+<td>{{if .Enabled}}<span class="ok">yes</span>{{else}}<span class="bad">no</span>{{end}}</td>
+<td>{{.CreatedAt}}</td>
+<td>{{if .Enabled}}<form method="post" action="/_gm/engine-versions/{{.Version}}/disable" onsubmit="return confirm('Disable {{.Version}}?');"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit" class="danger">Disable</button></form>{{end}}</td>
+</tr>
+{{else}}<tr><td colspan="5"><span class="note">no engine versions</span></td></tr>{{end}}
+</tbody>
+</table>
+{{end}}
+<section class="panel">
+<h2>Register version</h2>
+<form method="post" action="/_gm/engine-versions" class="form">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>Version <input type="text" name="version" placeholder="semver e.g. 0.1.0" required></label>
+<label>Image ref <input type="text" name="image_ref" required></label>
+<label>Enabled <input type="checkbox" name="enabled" value="true" checked></label>
+<button type="submit">Register</button>
+</form>
+</section>
+{{- end}}

backend/internal/adminconsole/templates/pages/game_detail.gohtml

@@ -0,0 +1,65 @@
+{{define "content" -}}
+{{$csrf := .CSRFToken}}
+{{with .Data}}
+<p><a href="/_gm/games">&laquo; all games</a></p>
+<h1>{{if .GameName}}{{.GameName}}{{else}}(unnamed){{end}}</h1>
+
+<section class="panel">
+<h2>Game</h2>
+<ul class="kv">
+<li>Game ID: <code>{{.GameID}}</code></li>
+<li>Visibility: {{.Visibility}}</li>
+<li>Status: {{.Status}}</li>
+<li>Owner: {{.Owner}}</li>
+<li>Players: {{.MinPlayers}}–{{.MaxPlayers}}</li>
+<li>Start gap: {{.StartGapHours}}h / {{.StartGapPlayers}} players</li>
+<li>Turn schedule: {{.TurnSchedule}}</li>
+<li>Target engine: {{.TargetEngineVersion}}</li>
+<li>Enrollment ends: {{.EnrollmentEndsAt}}</li>
+<li>Created: {{.CreatedAt}}</li>
+<li>Started: {{if .StartedAt}}{{.StartedAt}}{{else}}—{{end}}</li>
+<li>Finished: {{if .FinishedAt}}{{.FinishedAt}}{{else}}—{{end}}</li>
+</ul>
+{{if .Description}}<p>{{.Description}}</p>{{end}}
+<div class="actions">
+<form method="post" action="/_gm/games/{{.GameID}}/force-start" onsubmit="return confirm('Force-start this game?');"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit">Force start</button></form>
+<form method="post" action="/_gm/games/{{.GameID}}/force-stop" onsubmit="return confirm('Force-stop this game?');"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit" class="danger">Force stop</button></form>
+</div>
+</section>
+
+<section class="panel">
+<h2>Runtime</h2>
+{{if .HasRuntime}}
+<ul class="kv">
+<li>Status: {{.RuntimeStatus}}</li>
+<li>Engine version: {{.CurrentEngineVersion}}</li>
+<li>Engine health: {{.EngineHealth}}</li>
+<li>Current turn: {{.CurrentTurn}}</li>
+<li>Next generation: {{if .NextGenerationAt}}{{.NextGenerationAt}}{{else}}—{{end}}</li>
+<li>Paused: {{if .Paused}}yes{{else}}no{{end}}</li>
+</ul>
+<div class="actions">
+<form method="post" action="/_gm/games/{{.GameID}}/runtime/restart" onsubmit="return confirm('Restart the engine container?');"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit">Restart</button></form>
+<form method="post" action="/_gm/games/{{.GameID}}/runtime/force-next-turn" onsubmit="return confirm('Force the next turn now?');"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit">Force next turn</button></form>
+</div>
+<form method="post" action="/_gm/games/{{.GameID}}/runtime/patch" class="form">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>Patch to version <input type="text" name="target_version" placeholder="e.g. 0.1.1" required></label>
+<button type="submit">Patch</button>
+</form>
+{{else}}
+<p class="note">No runtime record for this game yet.</p>
+{{end}}
+</section>
+
+<section class="panel">
+<h2>Ban member</h2>
+<form method="post" action="/_gm/games/{{.GameID}}/ban-member" class="form" onsubmit="return confirm('Ban this member from the game?');">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>User ID <input type="text" name="user_id" required></label>
+<label>Reason <input type="text" name="reason"></label>
+<button type="submit" class="danger">Ban member</button>
+</form>
+</section>
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/games.gohtml

@@ -0,0 +1,43 @@
+{{define "content" -}}
+{{$csrf := .CSRFToken}}
+<h1>Games</h1>
+{{with .Data}}
+<table class="list">
+<thead><tr><th>Name</th><th>Visibility</th><th>Status</th><th>Owner</th><th>Players</th><th>Schedule</th><th>Created</th></tr></thead>
+<tbody>
+{{range .Items}}
+<tr>
+<td><a href="/_gm/games/{{.GameID}}">{{if .GameName}}{{.GameName}}{{else}}(unnamed){{end}}</a></td>
+<td>{{.Visibility}}</td>
+<td>{{.Status}}</td>
+<td>{{.Owner}}</td>
+<td>{{.Players}}</td>
+<td>{{.TurnSchedule}}</td>
+<td>{{.CreatedAt}}</td>
+</tr>
+{{else}}<tr><td colspan="7"><span class="note">no games</span></td></tr>{{end}}
+</tbody>
+</table>
+<nav class="pager">
+{{if .HasPrev}}<a href="/_gm/games?page={{.PrevPage}}&amp;page_size={{.PageSize}}">&laquo; prev</a>{{end}}
+<span>page {{.Page}} · {{.Total}} total</span>
+{{if .HasNext}}<a href="/_gm/games?page={{.NextPage}}&amp;page_size={{.PageSize}}">next &raquo;</a>{{end}}
+</nav>
+{{end}}
+<section class="panel">
+<h2>Create public game</h2>
+<form method="post" action="/_gm/games" class="form">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>Name <input type="text" name="game_name" required></label>
+<label>Description <input type="text" name="description"></label>
+<label>Min players <input type="number" name="min_players" value="2" min="1"></label>
+<label>Max players <input type="number" name="max_players" value="8" min="1"></label>
+<label>Start gap hours <input type="number" name="start_gap_hours" value="0" min="0"></label>
+<label>Start gap players <input type="number" name="start_gap_players" value="0" min="0"></label>
+<label>Enrollment ends <input type="datetime-local" name="enrollment_ends_at" required></label>
+<label>Turn schedule <input type="text" name="turn_schedule" placeholder="e.g. @every 24h" required></label>
+<label>Engine version <input type="text" name="target_engine_version" placeholder="e.g. 0.1.0" required></label>
+<button type="submit">Create</button>
+</form>
+</section>
+{{- end}}

backend/internal/adminconsole/templates/pages/mail.gohtml

@@ -0,0 +1,32 @@
+{{define "content" -}}
+<h1>Mail</h1>
+<nav class="subnav"><a href="/_gm/mail">Deliveries</a> · <a href="/_gm/notifications">Notifications</a> · <a href="/_gm/broadcast">Broadcast</a></nav>
+{{with .Data}}
+<section class="panel">
+<h2>Deliveries</h2>
+<table class="list">
+<thead><tr><th>Delivery</th><th>Template</th><th>Status</th><th>Attempts</th><th>Next attempt</th><th>Created</th></tr></thead>
+<tbody>
+{{range .Deliveries}}
+<tr><td><a href="/_gm/mail/deliveries/{{.DeliveryID}}"><code>{{.DeliveryID}}</code></a></td><td>{{.Template}}</td><td>{{.Status}}</td><td>{{.Attempts}}</td><td>{{if .NextAttempt}}{{.NextAttempt}}{{else}}—{{end}}</td><td>{{.Created}}</td></tr>
+{{else}}<tr><td colspan="6"><span class="note">no deliveries</span></td></tr>{{end}}
+</tbody>
+</table>
+<nav class="pager">
+{{if .HasPrev}}<a href="/_gm/mail?page={{.PrevPage}}&amp;page_size={{.PageSize}}">&laquo; prev</a>{{end}}
+<span>page {{.Page}} · {{.Total}} total</span>
+{{if .HasNext}}<a href="/_gm/mail?page={{.NextPage}}&amp;page_size={{.PageSize}}">next &raquo;</a>{{end}}
+</nav>
+</section>
+<section class="panel">
+<h2>Dead-letters</h2>
+<table class="list">
+<thead><tr><th>Delivery</th><th>Reason</th><th>Archived</th></tr></thead>
+<tbody>
+{{range .DeadLetters}}<tr><td><a href="/_gm/mail/deliveries/{{.DeliveryID}}"><code>{{.DeliveryID}}</code></a></td><td>{{.Reason}}</td><td>{{.Archived}}</td></tr>
+{{else}}<tr><td colspan="3"><span class="note">no dead-letters</span></td></tr>{{end}}
+</tbody>
+</table>
+</section>
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/mail_delivery.gohtml

@@ -0,0 +1,33 @@
+{{define "content" -}}
+{{$csrf := .CSRFToken}}
+{{with .Data}}
+<p><a href="/_gm/mail">&laquo; mail</a></p>
+<h1>Delivery</h1>
+<section class="panel">
+<ul class="kv">
+<li>Delivery ID: <code>{{.DeliveryID}}</code></li>
+<li>Template: {{.Template}}</li>
+<li>Status: {{.Status}}</li>
+<li>Attempts: {{.Attempts}}</li>
+<li>Next attempt: {{if .NextAttempt}}{{.NextAttempt}}{{else}}—{{end}}</li>
+<li>Created: {{.Created}}</li>
+<li>Sent: {{if .Sent}}{{.Sent}}{{else}}—{{end}}</li>
+<li>Dead-lettered: {{if .DeadLettered}}{{.DeadLettered}}{{else}}—{{end}}</li>
+<li>Last error: {{if .LastError}}{{.LastError}}{{else}}—{{end}}</li>
+</ul>
+{{if .CanResend}}
+<form method="post" action="/_gm/mail/deliveries/{{.DeliveryID}}/resend" class="form" onsubmit="return confirm('Resend this delivery?');"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit">Resend</button></form>
+{{else}}<p class="note">Already sent — resend is not available.</p>{{end}}
+</section>
+<section class="panel">
+<h2>Attempts</h2>
+<table class="list">
+<thead><tr><th>#</th><th>Outcome</th><th>Started</th><th>Finished</th><th>Error</th></tr></thead>
+<tbody>
+{{range .AttemptRows}}<tr><td>{{.AttemptNo}}</td><td>{{.Outcome}}</td><td>{{.Started}}</td><td>{{if .Finished}}{{.Finished}}{{else}}—{{end}}</td><td>{{.Error}}</td></tr>
+{{else}}<tr><td colspan="5"><span class="note">no attempts</span></td></tr>{{end}}
+</tbody>
+</table>
+</section>
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/message.gohtml

@@ -0,0 +1,7 @@
+{{define "content" -}}
+<h1>{{.Title}}</h1>
+{{with .Data}}
+<p class="{{.Class}}">{{.Message}}</p>
+{{if .BackHref}}<p><a href="{{.BackHref}}">&laquo; back</a></p>{{end}}
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/notifications.gohtml

@@ -0,0 +1,27 @@
+{{define "content" -}}
+<h1>Notifications</h1>
+<nav class="subnav"><a href="/_gm/mail">Deliveries</a> · <a href="/_gm/notifications">Notifications</a> · <a href="/_gm/broadcast">Broadcast</a></nav>
+{{with .Data}}
+<section class="panel">
+<h2>Recent notifications</h2>
+<table class="list"><thead><tr><th>ID</th><th>Kind</th><th>User</th><th>Created</th></tr></thead><tbody>
+{{range .Notifications}}<tr><td><code>{{.NotificationID}}</code></td><td>{{.Kind}}</td><td>{{.UserID}}</td><td>{{.Created}}</td></tr>
+{{else}}<tr><td colspan="4"><span class="note">none</span></td></tr>{{end}}
+</tbody></table>
+</section>
+<section class="panel">
+<h2>Dead-letters</h2>
+<table class="list"><thead><tr><th>Notification</th><th>Route</th><th>Reason</th><th>Archived</th></tr></thead><tbody>
+{{range .DeadLetters}}<tr><td><code>{{.NotificationID}}</code></td><td><code>{{.RouteID}}</code></td><td>{{.Reason}}</td><td>{{.Archived}}</td></tr>
+{{else}}<tr><td colspan="4"><span class="note">none</span></td></tr>{{end}}
+</tbody></table>
+</section>
+<section class="panel">
+<h2>Malformed intents</h2>
+<table class="list"><thead><tr><th>ID</th><th>Reason</th><th>Received</th></tr></thead><tbody>
+{{range .Malformed}}<tr><td><code>{{.ID}}</code></td><td>{{.Reason}}</td><td>{{.Received}}</td></tr>
+{{else}}<tr><td colspan="3"><span class="note">none</span></td></tr>{{end}}
+</tbody></table>
+</section>
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/operators.gohtml

@@ -0,0 +1,38 @@
+{{define "content" -}}
+{{$csrf := .CSRFToken}}
+<h1>Operators</h1>
+{{with .Data}}
+<table class="list">
+<thead><tr><th>Username</th><th>Status</th><th>Created</th><th>Last used</th><th>Actions</th></tr></thead>
+<tbody>
+{{range .Items}}
+<tr>
+<td>{{.Username}}</td>
+<td>{{if .Disabled}}<span class="bad">disabled</span>{{else}}<span class="ok">active</span>{{end}}</td>
+<td>{{.CreatedAt}}</td>
+<td>{{if .LastUsedAt}}{{.LastUsedAt}}{{else}}—{{end}}</td>
+<td>
+<div class="actions">
+{{if .Disabled}}
+<form method="post" action="/_gm/operators/{{.Username}}/enable"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit">Enable</button></form>
+{{else}}
+<form method="post" action="/_gm/operators/{{.Username}}/disable" onsubmit="return confirm('Disable {{.Username}}?');"><input type="hidden" name="_csrf" value="{{$csrf}}"><button type="submit" class="danger">Disable</button></form>
+{{end}}
+<form method="post" action="/_gm/operators/{{.Username}}/reset-password" class="form"><input type="hidden" name="_csrf" value="{{$csrf}}"><input type="password" name="password" placeholder="new password" required><button type="submit">Reset</button></form>
+</div>
+</td>
+</tr>
+{{else}}<tr><td colspan="5"><span class="note">no operators</span></td></tr>{{end}}
+</tbody>
+</table>
+{{end}}
+<section class="panel">
+<h2>Create operator</h2>
+<form method="post" action="/_gm/operators" class="form">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>Username <input type="text" name="username" required></label>
+<label>Password <input type="password" name="password" required></label>
+<button type="submit">Create</button>
+</form>
+</section>
+{{- end}}

backend/internal/adminconsole/templates/pages/user_detail.gohtml

@@ -0,0 +1,68 @@
+{{define "content" -}}
+{{$csrf := .CSRFToken}}
+{{with .Data}}
+<p><a href="/_gm/users">&laquo; all users</a></p>
+<h1>{{.Email}}</h1>
+{{if .Deleted}}<p class="bad">This account is soft-deleted.</p>{{end}}
+
+<section class="panel">
+<h2>Account</h2>
+<ul class="kv">
+<li>User ID: <code>{{.UserID}}</code></li>
+<li>User name: {{.UserName}}</li>
+<li>Display name: {{.DisplayName}}</li>
+<li>Preferred language: {{.PreferredLanguage}}</li>
+<li>Time zone: {{.TimeZone}}</li>
+<li>Declared country: {{.DeclaredCountry}}</li>
+<li>Status: {{if .Blocked}}<span class="bad">blocked</span>{{else}}<span class="ok">active</span>{{end}}</li>
+<li>Created: {{.CreatedAt}}</li>
+<li>Updated: {{.UpdatedAt}}</li>
+</ul>
+</section>
+
+<section class="panel">
+<h2>Entitlement</h2>
+<ul class="kv">
+<li>Tier: <strong>{{.Tier}}</strong> ({{if .IsPaid}}paid{{else}}free{{end}})</li>
+<li>Source: {{.EntitlementSource}}</li>
+<li>Reason: {{.EntitlementReason}}</li>
+<li>Ends: {{if .EntitlementEnds}}{{.EntitlementEnds}}{{else}}—{{end}}</li>
+</ul>
+<form method="post" action="/_gm/users/{{.UserID}}/entitlement" class="form">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>Tier
+<select name="tier">{{range .Tiers}}<option value="{{.}}">{{.}}</option>{{end}}</select>
+</label>
+<label>Source <input type="text" name="source" value="admin"></label>
+<label>Reason <input type="text" name="reason_code" placeholder="optional"></label>
+<button type="submit">Update entitlement</button>
+</form>
+</section>
+
+<section class="panel">
+<h2>Active sanctions</h2>
+{{if .Sanctions}}
+<table class="counts"><tbody>
+{{range .Sanctions}}<tr><td>{{.SanctionCode}}</td><td>{{.Scope}}</td><td>{{.ReasonCode}}</td><td>{{.AppliedAt}}</td></tr>{{end}}
+</tbody></table>
+{{else}}<p class="note">none</p>{{end}}
+{{if .Blocked}}
+<p class="note">User is permanently blocked. Unblock is not available in the current admin API.</p>
+{{else}}
+<form method="post" action="/_gm/users/{{.UserID}}/block" class="form" onsubmit="return confirm('Permanently block this user?');">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<label>Reason <input type="text" name="reason_code" required></label>
+<button type="submit" class="danger">Permanently block</button>
+</form>
+{{end}}
+</section>
+
+<section class="panel">
+<h2>Danger zone</h2>
+<form method="post" action="/_gm/users/{{.UserID}}/soft-delete" class="form" onsubmit="return confirm('Soft-delete this account? This cascades to sessions, memberships, and owned games.');">
+<input type="hidden" name="_csrf" value="{{$csrf}}">
+<button type="submit" class="danger">Soft-delete account</button>
+</form>
+</section>
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/users.gohtml

@@ -0,0 +1,27 @@
+{{define "content" -}}
+<h1>Users</h1>
+{{with .Data}}
+<table class="list">
+<thead><tr><th>Email</th><th>User name</th><th>Display</th><th>Tier</th><th>Status</th><th>Created</th></tr></thead>
+<tbody>
+{{range .Items}}
+<tr>
+<td><a href="/_gm/users/{{.UserID}}">{{.Email}}</a></td>
+<td>{{.UserName}}</td>
+<td>{{.DisplayName}}</td>
+<td>{{.Tier}}</td>
+<td>{{if .Deleted}}<span class="bad">deleted</span>{{else if .Blocked}}<span class="bad">blocked</span>{{else}}<span class="ok">active</span>{{end}}</td>
+<td>{{.CreatedAt}}</td>
+</tr>
+{{else}}
+<tr><td colspan="6"><span class="note">no users</span></td></tr>
+{{end}}
+</tbody>
+</table>
+<nav class="pager">
+{{if .HasPrev}}<a href="/_gm/users?page={{.PrevPage}}&amp;page_size={{.PageSize}}">&laquo; prev</a>{{end}}
+<span>page {{.Page}} · {{.Total}} total</span>
+{{if .HasNext}}<a href="/_gm/users?page={{.NextPage}}&amp;page_size={{.PageSize}}">next &raquo;</a>{{end}}
+</nav>
+{{end}}
+{{- end}}

backend/internal/adminconsole/users.go

@@ -0,0 +1,61 @@
+package adminconsole
+
+// UserRow is one line in the users list table.
+type UserRow struct {
+	UserID      string
+	Email       string
+	UserName    string
+	DisplayName string
+	Tier        string
+	Blocked     bool
+	Deleted     bool
+	CreatedAt   string
+}
+
+// UsersListData is the view model for the paginated users list.
+type UsersListData struct {
+	Items    []UserRow
+	Page     int
+	PageSize int
+	Total    int
+	HasPrev  bool
+	HasNext  bool
+	PrevPage int
+	NextPage int
+}
+
+// SanctionView is one active sanction shown on the user detail page.
+type SanctionView struct {
+	SanctionCode string
+	Scope        string
+	ReasonCode   string
+	AppliedAt    string
+	ExpiresAt    string
+}
+
+// UserDetailData is the view model for a single user's detail page,
+// combining the account aggregate with the form option lists.
+type UserDetailData struct {
+	UserID            string
+	Email             string
+	UserName          string
+	DisplayName       string
+	PreferredLanguage string
+	TimeZone          string
+	DeclaredCountry   string
+	Blocked           bool
+	Deleted           bool
+	CreatedAt         string
+	UpdatedAt         string
+
+	Tier              string
+	IsPaid            bool
+	EntitlementSource string
+	EntitlementReason string
+	EntitlementEnds   string
+
+	Sanctions []SanctionView
+
+	// Tiers lists the selectable entitlement tiers for the form.
+	Tiers []string
+}

backend/internal/config/config.go

@@ -55,6 +55,8 @@ const (
 	envAdminBootstrapUser = "BACKEND_ADMIN_BOOTSTRAP_USER"
 	envAdminBootstrapPassword = "BACKEND_ADMIN_BOOTSTRAP_PASSWORD"
 
+	envAdminConsoleCSRFKey = "BACKEND_ADMIN_CONSOLE_CSRF_KEY"
+
 	envGeoIPDBPath = "BACKEND_GEOIP_DB_PATH"
 
 	envOTelTracesExporter = "BACKEND_OTEL_TRACES_EXPORTER"
@@ -103,11 +105,6 @@ const (
 	envDiplomailTranslatorTimeout = "BACKEND_DIPLOMAIL_TRANSLATOR_TIMEOUT"
 	envDiplomailTranslatorMaxAttempts = "BACKEND_DIPLOMAIL_TRANSLATOR_MAX_ATTEMPTS"
 	envDiplomailWorkerInterval = "BACKEND_DIPLOMAIL_WORKER_INTERVAL"
-
-	envDevSandboxEmail = "BACKEND_DEV_SANDBOX_EMAIL"
-	envDevSandboxEngineImage = "BACKEND_DEV_SANDBOX_ENGINE_IMAGE"
-	envDevSandboxEngineVersion = "BACKEND_DEV_SANDBOX_ENGINE_VERSION"
-	envDevSandboxPlayerCount = "BACKEND_DEV_SANDBOX_PLAYER_COUNT"
 )
 
 // Default values applied when an environment variable is absent.
@@ -176,9 +173,6 @@ const (
 	defaultDiplomailTranslatorTimeout = 10 * time.Second
 	defaultDiplomailTranslatorMaxAttempts = 5
 	defaultDiplomailWorkerInterval = 2 * time.Second
-
-	defaultDevSandboxEngineVersion = "0.1.0"
-	defaultDevSandboxPlayerCount = 20
 )
 
 // Allowed values for the closed-set string options.
@@ -208,6 +202,7 @@ type Config struct {
 	Docker DockerConfig
 	Game GameConfig
 	Admin AdminBootstrapConfig
+	AdminConsole AdminConsoleConfig
 	GeoIP GeoIPConfig
 	Telemetry TelemetryConfig
 	Auth AuthConfig
@@ -216,29 +211,12 @@ type Config struct {
 	Runtime RuntimeConfig
 	Notification NotificationConfig
 	Diplomail DiplomailConfig
-	DevSandbox DevSandboxConfig
 
 	// FreshnessWindow mirrors the gateway freshness window and is used by the
 	// push server to bound the cursor TTL.
 	FreshnessWindow time.Duration
 }
 
-// DevSandboxConfig configures the boot-time bootstrap implemented in
-// `backend/internal/devsandbox`. When Email is empty the bootstrap
-// is a no-op, which is the production posture. When Email is set —
-// from `BACKEND_DEV_SANDBOX_EMAIL` in the `tools/local-dev` stack —
-// the bootstrap idempotently provisions a real user, the configured
-// number of dummy participants, a private "Dev Sandbox" game, the
-// matching memberships, and drives the lifecycle to `running`. The
-// engine image and engine version refer to a row that the bootstrap
-// also seeds in `engine_versions`.
-type DevSandboxConfig struct {
-	Email string
-	EngineImage string
-	EngineVersion string
-	PlayerCount int
-}
-
 // LoggingConfig stores the parameters used by the structured logger.
 type LoggingConfig struct {
 	// Level is the zap level name (e.g. "debug", "info", "warn", "error").
@@ -308,6 +286,15 @@ type AdminBootstrapConfig struct {
 	Password string
 }
 
+// AdminConsoleConfig configures the server-rendered operator console.
+// CSRFKey is the secret keying the console's stateless anti-CSRF token.
+// When empty the console falls back to a per-process random key, which is
+// secure but means forms do not survive a restart and do not validate across
+// replicas; set a shared key when running more than one backend instance.
+type AdminConsoleConfig struct {
+	CSRFKey string
+}
+
 // GeoIPConfig configures the GeoLite2 country database used by geo lookups.
 type GeoIPConfig struct {
 	DBPath string
@@ -560,10 +547,6 @@ func DefaultConfig() Config {
 			TranslatorMaxAttempts: defaultDiplomailTranslatorMaxAttempts,
 			WorkerInterval: defaultDiplomailWorkerInterval,
 		},
-		DevSandbox: DevSandboxConfig{
-			EngineVersion: defaultDevSandboxEngineVersion,
-			PlayerCount: defaultDevSandboxPlayerCount,
-		},
 		Runtime: RuntimeConfig{
 			WorkerPoolSize: defaultRuntimeWorkerPoolSize,
 			JobQueueSize: defaultRuntimeJobQueueSize,
@@ -644,6 +627,8 @@ func LoadFromEnv() (Config, error) {
 	cfg.Admin.User = loadString(envAdminBootstrapUser, cfg.Admin.User)
 	cfg.Admin.Password = loadString(envAdminBootstrapPassword, cfg.Admin.Password)
 
+	cfg.AdminConsole.CSRFKey = loadString(envAdminConsoleCSRFKey, cfg.AdminConsole.CSRFKey)
+
 	cfg.GeoIP.DBPath = loadString(envGeoIPDBPath, cfg.GeoIP.DBPath)
 
 	cfg.Telemetry.TracesExporter = strings.ToLower(loadString(envOTelTracesExporter, cfg.Telemetry.TracesExporter))
@@ -741,13 +726,6 @@ func LoadFromEnv() (Config, error) {
 		return Config{}, err
 	}
 
-	cfg.DevSandbox.Email = strings.TrimSpace(loadString(envDevSandboxEmail, cfg.DevSandbox.Email))
-	cfg.DevSandbox.EngineImage = strings.TrimSpace(loadString(envDevSandboxEngineImage, cfg.DevSandbox.EngineImage))
-	cfg.DevSandbox.EngineVersion = strings.TrimSpace(loadString(envDevSandboxEngineVersion, cfg.DevSandbox.EngineVersion))
-	if cfg.DevSandbox.PlayerCount, err = loadInt(envDevSandboxPlayerCount, cfg.DevSandbox.PlayerCount); err != nil {
-		return Config{}, err
-	}
-
 	if err := cfg.Validate(); err != nil {
 		return Config{}, err
 	}
@@ -959,21 +937,6 @@ func (c Config) Validate() error {
 		}
 	}
 
-	if email := strings.TrimSpace(c.DevSandbox.Email); email != "" {
-		if _, err := netmail.ParseAddress(email); err != nil {
-			return fmt.Errorf("%s must be a valid RFC 5322 address: %w", envDevSandboxEmail, err)
-		}
-		if strings.TrimSpace(c.DevSandbox.EngineImage) == "" {
-			return fmt.Errorf("%s must not be empty when %s is set", envDevSandboxEngineImage, envDevSandboxEmail)
-		}
-		if strings.TrimSpace(c.DevSandbox.EngineVersion) == "" {
-			return fmt.Errorf("%s must not be empty when %s is set", envDevSandboxEngineVersion, envDevSandboxEmail)
-		}
-		if c.DevSandbox.PlayerCount <= 0 {
-			return fmt.Errorf("%s must be positive when %s is set", envDevSandboxPlayerCount, envDevSandboxEmail)
-		}
-	}
-
 	return nil
 }
 

backend/internal/devsandbox/bootstrap.go

@@ -1,287 +0,0 @@
-// Package devsandbox provisions a ready-to-play game on backend boot
-// for the `tools/local-dev` stack.
-//
-// Bootstrap is invoked from `backend/cmd/backend/main.go` after the
-// admin bootstrap and before the HTTP listener starts. It reads
-// `cfg.DevSandbox`; when `Email` is empty (the production posture)
-// the function logs "skipped" and returns nil. When set, it
-// idempotently:
-//
-//   1. registers the configured engine version and image;
-//   2. find-or-creates the real dev user with the configured email;
-//   3. find-or-creates `cfg.PlayerCount - 1` deterministic dummy
-//      users so the engine's minimum-players constraint is met;
-//   4. find-or-creates a private "Dev Sandbox" game owned by the
-//      real user with min/max_players = cfg.PlayerCount and a
-//      year-out turn schedule (effectively frozen at turn 1);
-//   5. inserts memberships for all participants bypassing the
-//      application/approval flow;
-//   6. drives the lifecycle to `running` (or as far as possible if
-//      the runtime is busy).
-//
-// The function is a no-op on subsequent boots once the game is
-// running; partial states from earlier crashes are recovered.
-package devsandbox
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"galaxy/backend/internal/config"
-	"galaxy/backend/internal/lobby"
-	"galaxy/backend/internal/runtime"
-
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-)
-
-// SandboxGameName is the display name used to identify the
-// auto-provisioned game on subsequent reboots. The combination of
-// game_name and owner_user_id is unique enough in practice — only
-// the dev sandbox bootstrap creates a game owned by the configured
-// real user with this exact name.
-const SandboxGameName = "Dev Sandbox"
-
-// SandboxTurnSchedule keeps the game on turn 1 by scheduling the
-// next turn a year out. The runtime scheduler still parses this and
-// will tick once a year — long enough to never interfere with
-// solo UI development.
-const SandboxTurnSchedule = "0 0 1 1 *"
-
-// UserEnsurer matches `auth.UserEnsurer`. We define a local
-// interface to avoid importing the auth package and circular
-// dependencies — the production wiring passes the same `*user.Service`
-// instance used by auth.
-type UserEnsurer interface {
-	EnsureByEmail(ctx context.Context, email, preferredLanguage, timeZone, declaredCountry string) (uuid.UUID, error)
-}
-
-// Deps aggregates the collaborators Bootstrap needs.
-type Deps struct {
-	Users          UserEnsurer
-	Lobby          *lobby.Service
-	EngineVersions *runtime.EngineVersionService
-}
-
-// Bootstrap runs the seven-step provisioning flow described on the
-// package doc comment. Errors are returned to the caller; the boot
-// path in `cmd/backend/main.go` aborts startup if Bootstrap fails so
-// a misconfigured dev environment surfaces immediately rather than
-// silently leaving the lobby empty.
-func Bootstrap(ctx context.Context, deps Deps, cfg config.DevSandboxConfig, logger *zap.Logger) error {
-	if logger == nil {
-		logger = zap.NewNop()
-	}
-	logger = logger.Named("dev_sandbox")
-
-	if cfg.Email == "" {
-		logger.Info("skipped (no email)")
-		return nil
-	}
-	if deps.Users == nil || deps.Lobby == nil || deps.EngineVersions == nil {
-		return errors.New("dev_sandbox: deps.Users, deps.Lobby and deps.EngineVersions are required")
-	}
-	if cfg.PlayerCount <= 0 {
-		return fmt.Errorf("dev_sandbox: PlayerCount must be positive, got %d", cfg.PlayerCount)
-	}
-
-	if err := ensureEngineVersion(ctx, deps.EngineVersions, cfg, logger); err != nil {
-		return err
-	}
-
-	realID, err := deps.Users.EnsureByEmail(ctx, cfg.Email, "en", "UTC", "")
-	if err != nil {
-		return fmt.Errorf("dev_sandbox: ensure real user: %w", err)
-	}
-
-	dummyIDs := make([]uuid.UUID, 0, cfg.PlayerCount-1)
-	for i := 1; i < cfg.PlayerCount; i++ {
-		email := fmt.Sprintf("dev-dummy-%02d@local.test", i)
-		id, err := deps.Users.EnsureByEmail(ctx, email, "en", "UTC", "")
-		if err != nil {
-			return fmt.Errorf("dev_sandbox: ensure dummy %d: %w", i, err)
-		}
-		dummyIDs = append(dummyIDs, id)
-	}
-
-	if err := purgeTerminalSandboxGames(ctx, deps.Lobby, realID, logger); err != nil {
-		return err
-	}
-
-	game, err := findOrCreateSandboxGame(ctx, deps.Lobby, realID, cfg)
-	if err != nil {
-		return err
-	}
-
-	game, err = ensureMembershipsAndDrive(ctx, deps.Lobby, game, realID, dummyIDs, logger)
-	if err != nil {
-		return err
-	}
-
-	logger.Info("bootstrap complete",
-		zap.String("user_id", realID.String()),
-		zap.String("game_id", game.GameID.String()),
-		zap.String("status", game.Status),
-	)
-	return nil
-}
-
-func ensureEngineVersion(ctx context.Context, svc *runtime.EngineVersionService, cfg config.DevSandboxConfig, logger *zap.Logger) error {
-	_, err := svc.Register(ctx, runtime.RegisterInput{
-		Version:  cfg.EngineVersion,
-		ImageRef: cfg.EngineImage,
-	})
-	switch {
-	case err == nil:
-		logger.Info("engine version registered",
-			zap.String("version", cfg.EngineVersion),
-			zap.String("image", cfg.EngineImage),
-		)
-		return nil
-	case errors.Is(err, runtime.ErrEngineVersionTaken):
-		logger.Debug("engine version already registered",
-			zap.String("version", cfg.EngineVersion),
-		)
-		return nil
-	default:
-		return fmt.Errorf("dev_sandbox: register engine version: %w", err)
-	}
-}
-
-// terminalSandboxStatus reports whether a sandbox game has reached a
-// state from which it can no longer be driven back to running. We
-// treat such games as "absent" so the next bootstrap creates a fresh
-// one rather than handing the developer a dead lobby tile.
-func terminalSandboxStatus(status string) bool {
-	switch status {
-	case lobby.GameStatusCancelled, lobby.GameStatusFinished, lobby.GameStatusStartFailed:
-		return true
-	}
-	return false
-}
-
-// purgeTerminalSandboxGames deletes every previous "Dev Sandbox" game
-// the dev user owns that has reached a terminal state
-// (cancelled / finished / start_failed). The cascade declared in
-// `00001_init.sql` removes the matching memberships, applications,
-// invites, runtime records, and player mappings in the same write,
-// so the developer's lobby never piles up dead tiles between
-// `make rebuild` cycles. Non-terminal games are left untouched —
-// a `running` sandbox from a previous boot is the happy path.
-func purgeTerminalSandboxGames(ctx context.Context, svc *lobby.Service, ownerID uuid.UUID, logger *zap.Logger) error {
-	games, err := svc.ListMyGames(ctx, ownerID)
-	if err != nil {
-		return fmt.Errorf("dev_sandbox: list my games: %w", err)
-	}
-	for _, g := range games {
-		if g.GameName != SandboxGameName || g.OwnerUserID == nil || *g.OwnerUserID != ownerID {
-			continue
-		}
-		if !terminalSandboxStatus(g.Status) {
-			continue
-		}
-		if err := svc.DeleteGame(ctx, g.GameID); err != nil {
-			return fmt.Errorf("dev_sandbox: delete terminal sandbox %s: %w", g.GameID, err)
-		}
-		logger.Info("purged terminal sandbox game",
-			zap.String("game_id", g.GameID.String()),
-			zap.String("status", g.Status),
-		)
-	}
-	return nil
-}
-
-func findOrCreateSandboxGame(ctx context.Context, svc *lobby.Service, ownerID uuid.UUID, cfg config.DevSandboxConfig) (lobby.GameRecord, error) {
-	games, err := svc.ListMyGames(ctx, ownerID)
-	if err != nil {
-		return lobby.GameRecord{}, fmt.Errorf("dev_sandbox: list my games: %w", err)
-	}
-	for _, g := range games {
-		if g.GameName != SandboxGameName || g.OwnerUserID == nil || *g.OwnerUserID != ownerID {
-			continue
-		}
-		// `purgeTerminalSandboxGames` ran before us, so any sandbox
-		// game still in the list is either a live one we should
-		// reuse or a transient state we can drive forward.
-		return g, nil
-	}
-	rec, err := svc.CreateGame(ctx, lobby.CreateGameInput{
-		OwnerUserID:         &ownerID,
-		Visibility:          lobby.VisibilityPrivate,
-		GameName:            SandboxGameName,
-		Description:         "Auto-provisioned by backend/internal/devsandbox for solo UI development.",
-		MinPlayers:          int32(cfg.PlayerCount),
-		MaxPlayers:          int32(cfg.PlayerCount),
-		StartGapHours:       0,
-		StartGapPlayers:     0,
-		EnrollmentEndsAt:    time.Now().Add(365 * 24 * time.Hour),
-		TurnSchedule:        SandboxTurnSchedule,
-		TargetEngineVersion: cfg.EngineVersion,
-	})
-	if err != nil {
-		return lobby.GameRecord{}, fmt.Errorf("dev_sandbox: create game: %w", err)
-	}
-	return rec, nil
-}
-
-func ensureMembershipsAndDrive(ctx context.Context, svc *lobby.Service, game lobby.GameRecord, realID uuid.UUID, dummyIDs []uuid.UUID, logger *zap.Logger) (lobby.GameRecord, error) {
-	caller := realID
-	if game.Status == lobby.GameStatusDraft {
-		next, err := svc.OpenEnrollment(ctx, &caller, false, game.GameID)
-		if err != nil {
-			return game, fmt.Errorf("dev_sandbox: open enrollment: %w", err)
-		}
-		game = next
-	}
-
-	if game.Status == lobby.GameStatusEnrollmentOpen {
-		users := append([]uuid.UUID{realID}, dummyIDs...)
-		for i, uid := range users {
-			raceName := fmt.Sprintf("Sandbox-%02d", i+1)
-			if _, err := svc.InsertMembershipDirect(ctx, lobby.InsertMembershipDirectInput{
-				GameID:   game.GameID,
-				UserID:   uid,
-				RaceName: raceName,
-			}); err != nil {
-				return game, fmt.Errorf("dev_sandbox: insert membership %d: %w", i+1, err)
-			}
-		}
-		logger.Info("memberships ensured",
-			zap.Int("count", len(users)),
-			zap.String("game_id", game.GameID.String()),
-		)
-		next, err := svc.ReadyToStart(ctx, &caller, false, game.GameID)
-		if err != nil {
-			return game, fmt.Errorf("dev_sandbox: ready to start: %w", err)
-		}
-		game = next
-	}
-
-	if game.Status == lobby.GameStatusReadyToStart {
-		next, err := svc.Start(ctx, &caller, false, game.GameID)
-		if err != nil {
-			return game, fmt.Errorf("dev_sandbox: start: %w", err)
-		}
-		game = next
-	}
-
-	if game.Status == lobby.GameStatusStartFailed {
-		next, err := svc.RetryStart(ctx, &caller, false, game.GameID)
-		if err != nil {
-			logger.Warn("retry start failed", zap.Error(err))
-			return game, nil
-		}
-		game = next
-		if game.Status == lobby.GameStatusReadyToStart {
-			next, err := svc.Start(ctx, &caller, false, game.GameID)
-			if err != nil {
-				return game, fmt.Errorf("dev_sandbox: start after retry: %w", err)
-			}
-			game = next
-		}
-	}
-
-	return game, nil
-}

backend/internal/devsandbox/bootstrap_test.go

@@ -1,106 +0,0 @@
-package devsandbox
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"galaxy/backend/internal/config"
-
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-)
-
-// TestBootstrapSkippedWhenEmailEmpty exercises the no-op branch: with
-// the production posture (Email == "") Bootstrap must return without
-// touching any dependency. The fact that Users/Lobby/EngineVersions
-// are nil here doubles as a check that the early-return runs first.
-func TestBootstrapSkippedWhenEmailEmpty(t *testing.T) {
-	err := Bootstrap(
-		context.Background(),
-		Deps{},
-		config.DevSandboxConfig{},
-		zap.NewNop(),
-	)
-	if err != nil {
-		t.Fatalf("expected nil error on empty email, got: %v", err)
-	}
-}
-
-// TestBootstrapRejectsZeroPlayerCount confirms the validation
-// short-circuits the flow before any DB call when PlayerCount is
-// non-positive but Email is set. The error path is fast and never
-// dereferences the (still-nil) Users/Lobby deps.
-func TestBootstrapRejectsZeroPlayerCount(t *testing.T) {
-	err := Bootstrap(
-		context.Background(),
-		Deps{Users: stubEnsurer{}, Lobby: nil, EngineVersions: nil},
-		config.DevSandboxConfig{
-			Email:         "dev@local.test",
-			EngineImage:   "galaxy-engine:local-dev",
-			EngineVersion: "0.0.0-local-dev",
-			PlayerCount:   0,
-		},
-		zap.NewNop(),
-	)
-	if err == nil {
-		t.Fatal("expected error on zero PlayerCount, got nil")
-	}
-}
-
-// TestBootstrapRejectsMissingDeps checks that a misconfigured wiring
-// (Email set but one of the required services nil) fails fast rather
-// than panicking when the bootstrap reaches its first service call.
-func TestBootstrapRejectsMissingDeps(t *testing.T) {
-	err := Bootstrap(
-		context.Background(),
-		Deps{Users: stubEnsurer{}, Lobby: nil, EngineVersions: nil},
-		config.DevSandboxConfig{
-			Email:         "dev@local.test",
-			EngineImage:   "galaxy-engine:local-dev",
-			EngineVersion: "0.0.0-local-dev",
-			PlayerCount:   20,
-		},
-		zap.NewNop(),
-	)
-	if err == nil {
-		t.Fatal("expected error on missing deps, got nil")
-	}
-	if !errors.Is(err, errMissingDepsSentinel) && err.Error() == "" {
-		// The exact wording is not part of the contract; this branch
-		// only asserts the error is non-nil and human-readable.
-		t.Fatalf("error has empty message: %v", err)
-	}
-}
-
-// errMissingDepsSentinel exists so the assertion above can compile;
-// the real error is constructed via errors.New inside Bootstrap and
-// is intentionally not exported. The test only needs to confirm the
-// returned error has a message.
-var errMissingDepsSentinel = errors.New("sentinel")
-
-// TestTerminalSandboxStatus pins the contract that decides whether a
-// previously created sandbox game gets purged on the next boot.
-// Terminal states are deleted (cascade-style) so the developer's
-// lobby never piles up dead tiles between `make rebuild` cycles.
-func TestTerminalSandboxStatus(t *testing.T) {
-	terminal := []string{"cancelled", "finished", "start_failed"}
-	live := []string{"draft", "enrollment_open", "ready_to_start", "starting", "running", "paused"}
-
-	for _, status := range terminal {
-		if !terminalSandboxStatus(status) {
-			t.Errorf("expected %q to be terminal", status)
-		}
-	}
-	for _, status := range live {
-		if terminalSandboxStatus(status) {
-			t.Errorf("expected %q to be non-terminal", status)
-		}
-	}
-}
-
-type stubEnsurer struct{}
-
-func (stubEnsurer) EnsureByEmail(_ context.Context, _, _, _, _ string) (uuid.UUID, error) {
-	return uuid.UUID{}, nil
-}

backend/internal/engineclient/client.go

@@ -23,7 +23,6 @@ const (
 	pathAdminStatus     = "/api/v1/admin/status"
 	pathAdminTurn       = "/api/v1/admin/turn"
 	pathAdminRaceBanish = "/api/v1/admin/race/banish"
-	pathPlayerCommand   = "/api/v1/command"
 	pathPlayerOrder     = "/api/v1/order"
 	pathPlayerReport    = "/api/v1/report"
 	pathPlayerBattle    = "/api/v1/battle"
@@ -183,16 +182,10 @@ func (c *Client) BanishRace(ctx context.Context, baseURL, raceName string) error
 	}
 }
 
-// ExecuteCommands calls `PUT /api/v1/command` with payload forwarded
+// PutOrders calls `PUT /api/v1/order` with the payload forwarded
 // verbatim. The engine response body is returned verbatim; on 4xx the
-// body is returned alongside ErrEngineValidation so callers can
+// body is returned alongside ErrEngineValidation so callers can forward
-// forward the per-command error.
+// the per-command error.
-func (c *Client) ExecuteCommands(ctx context.Context, baseURL string, payload json.RawMessage) (json.RawMessage, error) {
-	return c.forwardPlayerWrite(ctx, baseURL, pathPlayerCommand, payload, "engine command")
-}
-
-// PutOrders calls `PUT /api/v1/order` with the same forwarding
-// semantics as ExecuteCommands.
 func (c *Client) PutOrders(ctx context.Context, baseURL string, payload json.RawMessage) (json.RawMessage, error) {
 	return c.forwardPlayerWrite(ctx, baseURL, pathPlayerOrder, payload, "engine order")
 }

backend/internal/engineclient/client_test.go

@@ -26,6 +26,7 @@ func newTestClient(t *testing.T, srv *httptest.Server) *Client {
 
 func TestClientInitSuccess(t *testing.T) {
 	wantID := uuid.New()
+	var gotReq rest.InitRequest
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != pathAdminInit {
 			t.Fatalf("unexpected path: %s", r.URL.Path)
@@ -33,13 +34,16 @@ func TestClientInitSuccess(t *testing.T) {
 		if r.Method != http.MethodPost {
 			t.Fatalf("unexpected method: %s", r.Method)
 		}
+		if err := json.NewDecoder(r.Body).Decode(&gotReq); err != nil {
+			t.Fatalf("decode request: %v", err)
+		}
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(rest.StateResponse{ID: wantID, Turn: 1, Players: []rest.PlayerState{{ID: uuid.New(), RaceName: "alpha"}}})
 	}))
 	t.Cleanup(srv.Close)
 
 	cli := newTestClient(t, srv)
-	got, err := cli.Init(context.Background(), srv.URL, rest.InitRequest{Races: []rest.InitRace{{RaceName: "alpha"}}})
+	got, err := cli.Init(context.Background(), srv.URL, rest.InitRequest{GameID: wantID, Races: []rest.InitRace{{RaceName: "alpha"}}})
 	if err != nil {
 		t.Fatalf("Init returned error: %v", err)
 	}
@@ -49,6 +53,9 @@ func TestClientInitSuccess(t *testing.T) {
 	if got.Turn != 1 {
 		t.Fatalf("Turn = %d, want 1", got.Turn)
 	}
+	if gotReq.GameID != wantID {
+		t.Fatalf("request gameId = %s, want %s", gotReq.GameID, wantID)
+	}
 }
 
 func TestClientInitValidationError(t *testing.T) {
@@ -149,27 +156,6 @@ func TestClientBanishRace(t *testing.T) {
 	}
 }
 
-func TestClientCommandsForwardsBody(t *testing.T) {
-	want := json.RawMessage(`{"actor":"alpha","cmd":[{"@type":"raceQuit"}]}`)
-	gotResp := json.RawMessage(`{"applied":true}`)
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != pathPlayerCommand || r.Method != http.MethodPut {
-			t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
-		}
-		_, _ = w.Write(gotResp)
-	}))
-	t.Cleanup(srv.Close)
-
-	cli := newTestClient(t, srv)
-	resp, err := cli.ExecuteCommands(context.Background(), srv.URL, want)
-	if err != nil {
-		t.Fatalf("ExecuteCommands: %v", err)
-	}
-	if string(resp) != string(gotResp) {
-		t.Fatalf("response = %s, want %s", string(resp), string(gotResp))
-	}
-}
-
 func TestClientReportsForwardsQuery(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != pathPlayerReport {

backend/internal/lobby/deps.go

@@ -9,14 +9,21 @@ import (
 
 // EntitlementProvider is the read-only view the lobby needs over the
 // user-domain entitlement snapshot. The canonical implementation is
-// `*user.Service` exposing `GetEntitlement(ctx, userID)`; tests substitute
+// `*user.Service` exposing `GetEntitlementSnapshot(ctx, userID)`; tests
-// a fake.
+// substitute a fake.
 //
-// `MaxRegisteredRaceNames` is the only field consumed by when
+// `GetMaxRegisteredRaceNames` is consumed at race-name registration time
-// the caller attempts to register a `pending_registration` row the lobby
+// — when the caller attempts to register a `pending_registration` row the
-// counts already-`registered` rows for that user against this limit.
+// lobby counts already-`registered` rows for that user against this limit.
+//
+// `IsPaid` is consumed by the user-facing private-game creation gate at
+// the HTTP handler level (`POST /api/v1/user/lobby/games`): free-tier
+// callers are rejected with `403 forbidden` before the lobby Service is
+// invoked. Admin-driven public-game creation
+// (`POST /api/v1/admin/games`) bypasses the gate.
 type EntitlementProvider interface {
 	GetMaxRegisteredRaceNames(ctx context.Context, userID uuid.UUID) (int32, error)
+	IsPaid(ctx context.Context, userID uuid.UUID) (bool, error)
 }
 
 // RuntimeGateway is the outbound surface the lobby uses to ask the runtime

backend/internal/lobby/games.go

@@ -274,11 +274,10 @@ func (s *Service) ListFinishedGamesBefore(ctx context.Context, cutoff time.Time)
 // `ON DELETE CASCADE` constraints declared in `00001_init.sql`.
 // Idempotent: returns nil when no game matches.
 //
-// Phase 14 introduces this method for the dev-sandbox bootstrap so a
+// `DeleteGame` is destructive — a hard delete that bypasses the
-// terminal "Dev Sandbox" tile from a previous local-dev session can
+// cascade-notification machinery — so production callers stay on the
-// be scrubbed before a fresh game spawns. Production callers must
+// regular cancel / finish lifecycle. It is exercised by the lobby
-// stay on the regular cancel / finish lifecycle — `DeleteGame` is
+// integration tests.
-// destructive and bypasses the cascade-notification machinery.
 func (s *Service) DeleteGame(ctx context.Context, gameID uuid.UUID) error {
 	if err := s.deps.Store.DeleteGame(ctx, gameID); err != nil {
 		return err

backend/internal/lobby/lobby.go

@@ -20,6 +20,7 @@
 package lobby
 
 import (
+	"context"
 	"crypto/rand"
 	"encoding/hex"
 	"errors"
@@ -28,6 +29,7 @@ import (
 
 	"galaxy/backend/internal/config"
 
+	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5/pgconn"
 	"go.uber.org/zap"
 )
@@ -207,6 +209,17 @@ func (s *Service) Config() config.LobbyConfig {
 	return s.deps.Config
 }
 
+// IsPaid reports whether userID currently sits on a paid tier. Thin
+// pass-through over EntitlementProvider used by the HTTP handler that
+// fronts user-driven private-game creation; admin-driven public-game
+// creation does not consult this gate.
+func (s *Service) IsPaid(ctx context.Context, userID uuid.UUID) (bool, error) {
+	if s == nil || s.deps.Entitlement == nil {
+		return false, fmt.Errorf("lobby: entitlement provider not configured")
+	}
+	return s.deps.Entitlement.IsPaid(ctx, userID)
+}
+
 // generateInviteCode produces an `inviteCodeBytes`-byte hex code used
 // for code-based invites. The function uses `crypto/rand`; a failure to
 // read entropy is propagated to the caller.

backend/internal/lobby/lobby_e2e_test.go

@@ -103,6 +103,10 @@ func (s stubEntitlement) GetMaxRegisteredRaceNames(_ context.Context, _ uuid.UUI
 	return s.max, nil
 }
 
+func (s stubEntitlement) IsPaid(_ context.Context, _ uuid.UUID) (bool, error) {
+	return true, nil
+}
+
 func newServiceForTest(t *testing.T, db *sql.DB, now func() time.Time, max int32) *lobby.Service {
 	t.Helper()
 	store := lobby.NewStore(db)
@@ -244,8 +248,8 @@ func TestEndToEndPrivateGameFlow(t *testing.T) {
 	}
 }
 
-// TestDeleteGameCascadesEverything pins the contract the dev-sandbox
+// TestDeleteGameCascadesEverything pins the DeleteGame contract:
-// bootstrap relies on: removing a game wipes every referencing row
+// removing a game wipes every referencing row
 // (memberships, applications, invites, runtime_records,
 // player_mappings) in a single SQL statement. Before this is wired
 // the developer's lobby pile up cancelled tiles between

backend/internal/lobby/membership_direct.go

@@ -20,9 +20,9 @@ type InsertMembershipDirectInput struct {
 // writes as ApproveApplication: the per-game race-name reservation
 // row plus the membership row, and refreshes the in-memory caches.
 //
-// The method is intended for boot-time provisioning by
+// The method is intended for trusted boot-time provisioning and
-// `backend/internal/devsandbox` and similar trusted callers. It is
+// integration tests; it is not exposed through any HTTP handler. The
-// not exposed through any HTTP handler. The caller must guarantee
+// caller must guarantee
 // game.Status == GameStatusEnrollmentOpen — the function returns
 // ErrConflict otherwise — and that the race-name policy and
 // canonical-key invariants are honoured (the implementation reuses
@@ -30,9 +30,8 @@ type InsertMembershipDirectInput struct {
 // or unsuitable name still fails).
 //
 // Idempotency: if a membership for (GameID, UserID) already exists
-// the function returns the existing row without modifying state.
+// the function returns the existing row without modifying state, so
-// This makes the helper safe to call on every backend boot from
+// the helper is safe to call repeatedly.
-// devsandbox.Bootstrap.
 func (s *Service) InsertMembershipDirect(ctx context.Context, in InsertMembershipDirectInput) (Membership, error) {
 	displayName, err := ValidateDisplayName(in.RaceName)
 	if err != nil {

backend/internal/lobby/store.go

@@ -236,9 +236,8 @@ func (s *Store) ListMyGames(ctx context.Context, userID uuid.UUID) ([]GameRecord
 // referencing table (memberships / applications / invites /
 // runtime_records / player_mappings — all declared with ON DELETE
 // CASCADE in `00001_init.sql`). Idempotent: returns nil when no row
-// matches. Used by the dev-sandbox bootstrap to scrub terminal
+// matches. A hard delete for trusted callers and integration tests;
-// games on every backend boot so the developer's lobby never piles
+// production lifecycle uses cancel / finish.
-// up cancelled tiles.
 func (s *Store) DeleteGame(ctx context.Context, gameID uuid.UUID) error {
 	g := table.Games
 	stmt := g.DELETE().WHERE(g.GameID.EQ(postgres.UUID(gameID)))

backend/internal/opsstatus/opsstatus.go

@@ -0,0 +1,139 @@
+// Package opsstatus reads point-in-time operational signals from Postgres for
+// the admin console dashboard: database reachability, per-status counts of game
+// runtimes, mail deliveries, and notification routes, plus the malformed
+// notification-intent count.
+//
+// It is a read-only projection built entirely through the go-jet query builder
+// against the generated table bindings; it owns no business logic and mutates
+// nothing. Richer, historical metrics are out of scope — those belong to the
+// Prometheus exporters wired on `backend` and `gateway`.
+package opsstatus
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+
+	"galaxy/backend/internal/postgres/jet/backend/table"
+
+	"github.com/go-jet/jet/v2/postgres"
+)
+
+// defaultCollectTimeout bounds a single Collect call so a slow or wedged
+// database cannot hang the dashboard request.
+const defaultCollectTimeout = 3 * time.Second
+
+// StatusCount pairs a status value with the number of rows currently in it.
+type StatusCount struct {
+	Status string
+	Count  int64
+}
+
+// Snapshot is a point-in-time view of the operational signals rendered on the
+// dashboard. Errors collects per-query failures so a single failing probe
+// degrades to a visible note rather than failing the whole page.
+type Snapshot struct {
+	PostgresHealthy       bool
+	Runtimes              []StatusCount
+	MailDeliveries        []StatusCount
+	NotificationRoutes    []StatusCount
+	NotificationMalformed int64
+	Errors                []string
+}
+
+// Reader collects an operational Snapshot. The admin console depends on this
+// interface so the dashboard can be tested without a database.
+type Reader interface {
+	Collect(ctx context.Context) Snapshot
+}
+
+// Store is the Postgres-backed Reader.
+type Store struct {
+	db      *sql.DB
+	timeout time.Duration
+}
+
+// NewStore constructs a Store reading from db.
+func NewStore(db *sql.DB) *Store {
+	return &Store{db: db, timeout: defaultCollectTimeout}
+}
+
+// Collect gathers the dashboard signals within a bounded timeout. It never
+// returns an error: a failed probe is recorded in Snapshot.Errors and the
+// remaining probes still run, except that a failed Postgres ping short-circuits
+// the rest (the dependent queries would only fail the same way).
+func (s *Store) Collect(ctx context.Context) Snapshot {
+	ctx, cancel := context.WithTimeout(ctx, s.timeout)
+	defer cancel()
+
+	var snap Snapshot
+
+	if err := s.db.PingContext(ctx); err != nil {
+		snap.Errors = append(snap.Errors, fmt.Sprintf("postgres ping: %v", err))
+		return snap
+	}
+	snap.PostgresHealthy = true
+
+	if counts, err := s.statusCounts(ctx, table.RuntimeRecords.Status, table.RuntimeRecords); err != nil {
+		snap.Errors = append(snap.Errors, fmt.Sprintf("runtime status counts: %v", err))
+	} else {
+		snap.Runtimes = counts
+	}
+
+	if counts, err := s.statusCounts(ctx, table.MailDeliveries.Status, table.MailDeliveries); err != nil {
+		snap.Errors = append(snap.Errors, fmt.Sprintf("mail delivery counts: %v", err))
+	} else {
+		snap.MailDeliveries = counts
+	}
+
+	if counts, err := s.statusCounts(ctx, table.NotificationRoutes.Status, table.NotificationRoutes); err != nil {
+		snap.Errors = append(snap.Errors, fmt.Sprintf("notification route counts: %v", err))
+	} else {
+		snap.NotificationRoutes = counts
+	}
+
+	if n, err := s.countAll(ctx, table.NotificationMalformedIntents); err != nil {
+		snap.Errors = append(snap.Errors, fmt.Sprintf("malformed notification count: %v", err))
+	} else {
+		snap.NotificationMalformed = n
+	}
+
+	return snap
+}
+
+// statusCounts runs `SELECT status, COUNT(*) FROM <from> GROUP BY status`
+// through jet and returns the rows ordered by status.
+func (s *Store) statusCounts(ctx context.Context, status postgres.ColumnString, from postgres.ReadableTable) ([]StatusCount, error) {
+	stmt := postgres.SELECT(
+		status.AS("status_count.status"),
+		postgres.COUNT(postgres.STAR).AS("status_count.count"),
+	).FROM(from).GROUP_BY(status).ORDER_BY(status.ASC())
+
+	var rows []struct {
+		Status string `alias:"status_count.status"`
+		Count  int64  `alias:"status_count.count"`
+	}
+	if err := stmt.QueryContext(ctx, s.db, &rows); err != nil {
+		return nil, err
+	}
+
+	out := make([]StatusCount, len(rows))
+	for i, row := range rows {
+		out[i] = StatusCount{Status: row.Status, Count: row.Count}
+	}
+	return out, nil
+}
+
+// countAll runs `SELECT COUNT(*) FROM <from>` through jet.
+func (s *Store) countAll(ctx context.Context, from postgres.ReadableTable) (int64, error) {
+	stmt := postgres.SELECT(postgres.COUNT(postgres.STAR).AS("count")).FROM(from)
+
+	var row struct {
+		Count int64 `alias:"count"`
+	}
+	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
+		return 0, err
+	}
+	return row.Count, nil
+}

backend/internal/opsstatus/opsstatus_test.go

@@ -0,0 +1,155 @@
+package opsstatus_test
+
+import (
+	"context"
+	"database/sql"
+	"net/url"
+	"testing"
+	"time"
+
+	"galaxy/backend/internal/mail"
+	"galaxy/backend/internal/opsstatus"
+	backendpg "galaxy/backend/internal/postgres"
+	pgshared "galaxy/postgres"
+
+	"github.com/google/uuid"
+	testcontainers "github.com/testcontainers/testcontainers-go"
+	tcpostgres "github.com/testcontainers/testcontainers-go/modules/postgres"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	pgImage    = "postgres:16-alpine"
+	pgUser     = "galaxy"
+	pgPassword = "galaxy"
+	pgDatabase = "galaxy_backend"
+	pgSchema   = "backend"
+	pgStartup  = 90 * time.Second
+	pgOpTO     = 10 * time.Second
+)
+
+// startPostgres mirrors the per-package scaffolding used by the other store
+// tests: spin up Postgres, apply migrations, return *sql.DB.
+func startPostgres(t *testing.T) *sql.DB {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	t.Cleanup(cancel)
+
+	pgContainer, err := tcpostgres.Run(ctx, pgImage,
+		tcpostgres.WithDatabase(pgDatabase),
+		tcpostgres.WithUsername(pgUser),
+		tcpostgres.WithPassword(pgPassword),
+		testcontainers.WithWaitStrategy(
+			wait.ForLog("database system is ready to accept connections").
+				WithOccurrence(2).
+				WithStartupTimeout(pgStartup),
+		),
+	)
+	if err != nil {
+		t.Skipf("postgres testcontainer unavailable, skipping: %v", err)
+	}
+	t.Cleanup(func() {
+		if termErr := testcontainers.TerminateContainer(pgContainer); termErr != nil {
+			t.Errorf("terminate postgres container: %v", termErr)
+		}
+	})
+
+	baseDSN, err := pgContainer.ConnectionString(ctx, "sslmode=disable")
+	if err != nil {
+		t.Fatalf("connection string: %v", err)
+	}
+	scopedDSN, err := dsnWithSearchPath(baseDSN, pgSchema)
+	if err != nil {
+		t.Fatalf("scope dsn: %v", err)
+	}
+
+	cfg := pgshared.DefaultConfig()
+	cfg.PrimaryDSN = scopedDSN
+	cfg.OperationTimeout = pgOpTO
+
+	db, err := pgshared.OpenPrimary(ctx, cfg, backendpg.NoObservabilityOptions()...)
+	if err != nil {
+		t.Fatalf("open primary: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	if err := pgshared.Ping(ctx, db, cfg.OperationTimeout); err != nil {
+		t.Fatalf("ping: %v", err)
+	}
+	if err := backendpg.ApplyMigrations(ctx, db); err != nil {
+		t.Fatalf("apply migrations: %v", err)
+	}
+	return db
+}
+
+func dsnWithSearchPath(baseDSN, schema string) (string, error) {
+	parsed, err := url.Parse(baseDSN)
+	if err != nil {
+		return "", err
+	}
+	values := parsed.Query()
+	values.Set("search_path", schema)
+	if values.Get("sslmode") == "" {
+		values.Set("sslmode", "disable")
+	}
+	parsed.RawQuery = values.Encode()
+	return parsed.String(), nil
+}
+
+func TestStoreCollect(t *testing.T) {
+	db := startPostgres(t)
+	store := opsstatus.NewStore(db)
+	ctx := context.Background()
+
+	// Empty schema: queries must execute cleanly with zero counts.
+	empty := store.Collect(ctx)
+	if !empty.PostgresHealthy {
+		t.Fatal("PostgresHealthy must be true against a reachable database")
+	}
+	if len(empty.Errors) != 0 {
+		t.Fatalf("unexpected collection errors: %v", empty.Errors)
+	}
+	if got := totalCount(empty.MailDeliveries); got != 0 {
+		t.Fatalf("mail deliveries total = %d, want 0", got)
+	}
+	if len(empty.Runtimes) != 0 || len(empty.NotificationRoutes) != 0 {
+		t.Fatalf("expected empty status slices, got runtimes=%v routes=%v", empty.Runtimes, empty.NotificationRoutes)
+	}
+	if empty.NotificationMalformed != 0 {
+		t.Fatalf("malformed notifications = %d, want 0", empty.NotificationMalformed)
+	}
+
+	// Enqueue one mail delivery and confirm the GROUP BY count reflects it.
+	mailStore := mail.NewStore(db)
+	inserted, err := mailStore.InsertEnqueue(ctx, mail.EnqueueArgs{
+		DeliveryID:     uuid.New(),
+		TemplateID:     mail.TemplateLoginCode,
+		IdempotencyKey: uuid.NewString(),
+		Recipients:     []string{"ops@example.test"},
+		ContentType:    "text/plain",
+		Subject:        "hello",
+		Body:           []byte("hi"),
+	})
+	if err != nil {
+		t.Fatalf("insert mail delivery: %v", err)
+	}
+	if !inserted {
+		t.Fatal("expected the delivery to be inserted")
+	}
+
+	after := store.Collect(ctx)
+	if len(after.Errors) != 0 {
+		t.Fatalf("unexpected collection errors after insert: %v", after.Errors)
+	}
+	if got := totalCount(after.MailDeliveries); got != 1 {
+		t.Fatalf("mail deliveries total after insert = %d, want 1 (statuses: %v)", got, after.MailDeliveries)
+	}
+}
+
+func totalCount(counts []opsstatus.StatusCount) int64 {
+	var total int64
+	for _, c := range counts {
+		total += c.Count
+	}
+	return total
+}

backend/internal/postgres/pool.go

@@ -10,7 +10,10 @@ package postgres
 import (
 	"context"
 	"database/sql"
+	"database/sql/driver"
+	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"galaxy/backend/internal/config"
@@ -67,13 +70,29 @@ func Open(ctx context.Context, cfg config.PostgresConfig, runtime *telemetry.Run
 // backend table lives here.
 const schemaName = "backend"
 
+// migrationRetryAttempts and migrationRetryBackoff bound the transient-error
+// retry around ApplyMigrations. A freshly started Postgres — notably a test
+// container — can reset a pooled connection moments after it reports ready,
+// which surfaces as `driver: bad connection` mid-migration; a handful of quick
+// retries rides over that without masking real failures.
+const (
+	migrationRetryAttempts = 5
+	migrationRetryBackoff  = 250 * time.Millisecond
+)
+
 // ApplyMigrations runs every pending Up migration embedded in the backend
 // binary against db. The schema is created upfront so goose's bookkeeping
 // table (`goose_db_version`, scoped to the DSN `search_path = backend`)
 // has somewhere to land before the first migration runs; migration
 // `00001_init.sql` re-asserts the schema with `IF NOT EXISTS`, so the
 // double-create is idempotent.
+//
+// The apply is retried on transient connection errors (see retryOnTransient).
+// Both steps are idempotent — `CREATE SCHEMA IF NOT EXISTS` and goose's
+// version tracking — so a retry after a dropped connection re-runs cleanly and
+// resumes from the last committed migration.
 func ApplyMigrations(ctx context.Context, db *sql.DB) error {
+	return retryOnTransient(ctx, migrationRetryAttempts, migrationRetryBackoff, func() error {
 		if _, err := db.ExecContext(ctx, "CREATE SCHEMA IF NOT EXISTS "+schemaName); err != nil {
 			return fmt.Errorf("ensure backend schema: %w", err)
 		}
@@ -81,4 +100,54 @@ func ApplyMigrations(ctx context.Context, db *sql.DB) error {
 			return fmt.Errorf("apply backend migrations: %w", err)
 		}
 		return nil
+	})
+}
+
+// retryOnTransient runs op up to attempts times, retrying only when op fails
+// with a transient connection error (see isTransientConnError) — a dropped,
+// reset, or refused connection, as opposed to a deterministic SQL error. It
+// waits backoff between attempts and stops early if ctx is cancelled. A
+// non-transient error, or the error from the final attempt, is returned as-is.
+func retryOnTransient(ctx context.Context, attempts int, backoff time.Duration, op func() error) error {
+	var err error
+	for attempt := 1; attempt <= attempts; attempt++ {
+		if err = op(); err == nil {
+			return nil
+		}
+		if attempt == attempts || !isTransientConnError(err) {
+			return err
+		}
+		select {
+		case <-ctx.Done():
+			return errors.Join(err, ctx.Err())
+		case <-time.After(backoff):
+		}
+	}
+	return err
+}
+
+// isTransientConnError reports whether err is a transient connection-level
+// failure worth retrying. It matches database/sql's driver.ErrBadConn and the
+// connection-failure messages Postgres drivers surface, while leaving
+// deterministic SQL errors (syntax, constraint violations) to fail fast.
+func isTransientConnError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, driver.ErrBadConn) {
+		return true
+	}
+	msg := strings.ToLower(err.Error())
+	for _, s := range []string{
+		"bad connection",
+		"connection refused",
+		"connection reset",
+		"broken pipe",
+		"server closed the connection",
+	} {
+		if strings.Contains(msg, s) {
+			return true
+		}
+	}
+	return false
 }

backend/internal/postgres/pool_test.go

@@ -0,0 +1,103 @@
+package postgres
+
+import (
+	"context"
+	"database/sql/driver"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsTransientConnError(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"driver.ErrBadConn", driver.ErrBadConn, true},
+		{"wrapped ErrBadConn", fmt.Errorf("run migrations: %w", driver.ErrBadConn), true},
+		// The exact shape observed flaking CI: goose surfaces the driver
+		// error as a plain string, so errors.Is can't see ErrBadConn.
+		{"bad connection string", errors.New(`apply backend migrations: run migrations: ERROR 00001_init.sql: CREATE TABLE race_names: driver: bad connection`), true},
+		{"connection refused", errors.New("dial tcp 127.0.0.1:5432: connect: connection refused"), true},
+		{"connection reset", errors.New("read tcp: connection reset by peer"), true},
+		{"broken pipe", errors.New("write tcp: broken pipe"), true},
+		{"server closed", errors.New("pq: server closed the connection unexpectedly"), true},
+		{"syntax error is not transient", errors.New(`pq: syntax error at or near "TABL"`), false},
+		{"constraint violation is not transient", errors.New("pq: duplicate key value violates unique constraint"), false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			assert.Equal(t, tt.want, isTransientConnError(tt.err))
+		})
+	}
+}
+
+func TestRetryOnTransientSucceedsAfterTransientFailures(t *testing.T) {
+	t.Parallel()
+
+	calls := 0
+	err := retryOnTransient(context.Background(), 5, time.Millisecond, func() error {
+		calls++
+		if calls < 3 {
+			return fmt.Errorf("attempt %d: %w", calls, driver.ErrBadConn)
+		}
+		return nil
+	})
+
+	require.NoError(t, err)
+	assert.Equal(t, 3, calls, "should retry until the transient error clears")
+}
+
+func TestRetryOnTransientStopsOnNonTransient(t *testing.T) {
+	t.Parallel()
+
+	sentinel := errors.New(`pq: syntax error at or near "TABL"`)
+	calls := 0
+	err := retryOnTransient(context.Background(), 5, time.Millisecond, func() error {
+		calls++
+		return sentinel
+	})
+
+	require.ErrorIs(t, err, sentinel)
+	assert.Equal(t, 1, calls, "a deterministic SQL error must not be retried")
+}
+
+func TestRetryOnTransientExhaustsAttempts(t *testing.T) {
+	t.Parallel()
+
+	calls := 0
+	err := retryOnTransient(context.Background(), 3, time.Millisecond, func() error {
+		calls++
+		return driver.ErrBadConn
+	})
+
+	require.ErrorIs(t, err, driver.ErrBadConn)
+	assert.Equal(t, 3, calls, "must stop after the attempt budget is spent")
+}
+
+func TestRetryOnTransientRespectsContextCancellation(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	calls := 0
+	err := retryOnTransient(ctx, 5, time.Hour, func() error {
+		calls++
+		return driver.ErrBadConn
+	})
+
+	require.ErrorIs(t, err, context.Canceled)
+	require.ErrorIs(t, err, driver.ErrBadConn, "the underlying transient error is preserved")
+	assert.Equal(t, 1, calls, "cancellation during backoff stops further attempts")
+}

backend/internal/runtime/errors.go

@@ -52,7 +52,7 @@ var (
 	ErrTurnAlreadyClosed = errors.New("runtime: turn already closed")
 
 	// ErrGamePaused reports that the game is not in a state that
-	// accepts user-games commands or orders: the runtime row
+	// accepts user-games orders: the runtime row
 	// carries `paused = true`, or the runtime status lands on any
 	// terminal value (`engine_unreachable`, `generation_failed`,
 	// `stopped`, `finished`, `removed`), or the game has not yet

backend/internal/runtime/service.go

@@ -258,10 +258,10 @@ func (s *Service) ResolvePlayerMapping(ctx context.Context, gameID, userID uuid.
 }
 
 // CheckOrdersAccept verifies that the runtime is in a state that
-// accepts user-games commands and orders. It is called by the user
+// accepts user-games orders. It is called by the user game-proxy
-// game-proxy handlers (`Commands`, `Orders`) before forwarding to
+// handler (`Orders`) before forwarding to engine, so the backend's
-// engine, so the backend's turn-cutoff and pause guards run before
+// turn-cutoff and pause guards run before network traffic leaves the
-// network traffic leaves the host. The decision itself lives in the
+// host. The decision itself lives in the
 // pure helper `OrdersAcceptStatus` so it can be unit-tested without
 // constructing a full Service.
 //
@@ -276,7 +276,7 @@ func (s *Service) CheckOrdersAccept(ctx context.Context, gameID uuid.UUID) error
 }
 
 // OrdersAcceptStatus inspects a runtime record and returns the
-// matching sentinel for the user-games order/command pre-check:
+// matching sentinel for the user-games order pre-check:
 //
 //   - `runtime_status = generation_in_progress` → `ErrTurnAlreadyClosed`.
 //     The cron-driven `Scheduler.tick` has flipped the row before
@@ -607,7 +607,7 @@ func (s *Service) runStart(ctx context.Context, op OperationLog) error {
 		return err
 	}
 
-	initResp, err := s.deps.Engine.Init(ctx, runResult.EngineEndpoint, rest.InitRequest{Races: races})
+	initResp, err := s.deps.Engine.Init(ctx, runResult.EngineEndpoint, rest.InitRequest{GameID: gameID, Races: races})
 	if err != nil {
 		s.deps.Logger.Warn("engine init failed",
 			zap.String("game_id", gameID.String()),

backend/internal/runtime/service_e2e_test.go

@@ -203,6 +203,13 @@ func TestServiceStartGameEndToEnd(t *testing.T) {
 		case "/healthz":
 			w.WriteHeader(http.StatusOK)
 		case "/api/v1/admin/init":
+			var got rest.InitRequest
+			if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
+				t.Errorf("decode init request: %v", err)
+			}
+			if got.GameID != gameID {
+				t.Errorf("init request gameId = %s, want %s", got.GameID, gameID)
+			}
 			_ = json.NewEncoder(w).Encode(rest.StateResponse{ID: gameID, Turn: 0, Players: []rest.PlayerState{{RaceName: "Alpha", Planets: 3, Population: 10}}})
 		case "/api/v1/admin/status":
 			_ = json.NewEncoder(w).Encode(rest.StateResponse{ID: gameID, Turn: 1, Players: []rest.PlayerState{{RaceName: "Alpha", Planets: 5, Population: 12}}})

backend/internal/server/handlers_admin_console.go

@@ -0,0 +1,235 @@
+package server
+
+import (
+	"bytes"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/opsstatus"
+	"galaxy/backend/internal/server/httperr"
+	"galaxy/backend/internal/server/middleware/basicauth"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+// AdminConsoleHandlers renders the server-side operator console mounted under
+// the `/_gm` route group. It wraps the framework-agnostic
+// adminconsole.Renderer and CSRF signer with the gin glue: the per-page
+// handlers, the embedded static-asset handler, and the CSRF guard middleware
+// applied to state-changing requests. Authentication is provided by the shared
+// admin Basic Auth middleware mounted on the group, so this type assumes the
+// caller has already been verified.
+type AdminConsoleHandlers struct {
+	renderer *adminconsole.Renderer
+	csrf     *adminconsole.CSRF
+	assets   http.Handler
+	monitor        opsstatus.Reader
+	ready          func() bool
+	users          UserAdmin
+	games          GameAdmin
+	runtime        RuntimeAdmin
+	engineVersions EngineVersionAdmin
+	operators      OperatorAdmin
+	mail           MailAdmin
+	notifications  NotificationAdmin
+	diplomail      DiplomailAdmin
+	logger         *zap.Logger
+}
+
+// AdminConsoleDeps bundles the collaborators for the operator console. Every
+// field is optional: a nil Renderer or CSRF falls back to the embedded default
+// templates and a per-process random key; a nil Monitor renders the dashboard
+// without the monitoring panels; a nil Ready reports backend readiness as not
+// ready; a nil Logger falls back to zap.NewNop.
+type AdminConsoleDeps struct {
+	Renderer *adminconsole.Renderer
+	CSRF     *adminconsole.CSRF
+	Monitor        opsstatus.Reader
+	Ready          func() bool
+	Users          UserAdmin
+	Games          GameAdmin
+	Runtime        RuntimeAdmin
+	EngineVersions EngineVersionAdmin
+	Operators      OperatorAdmin
+	Mail           MailAdmin
+	Notifications  NotificationAdmin
+	Diplomail      DiplomailAdmin
+	Logger         *zap.Logger
+}
+
+// NewAdminConsoleHandlers constructs the console handler set from deps. It
+// panics only on conditions that are unrecoverable at startup (template parse
+// failure or crypto/rand failure), both of which indicate a broken build or
+// host rather than a runtime input.
+func NewAdminConsoleHandlers(deps AdminConsoleDeps) *AdminConsoleHandlers {
+	logger := deps.Logger
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+	renderer := deps.Renderer
+	if renderer == nil {
+		renderer = adminconsole.MustNewRenderer()
+	}
+	csrf := deps.CSRF
+	if csrf == nil {
+		generated, err := adminconsole.NewRandomCSRF()
+		if err != nil {
+			panic(err)
+		}
+		csrf = generated
+	}
+
+	assetsFS, err := adminconsole.Assets()
+	if err != nil {
+		panic(err)
+	}
+
+	return &AdminConsoleHandlers{
+		renderer: renderer,
+		csrf:     csrf,
+		assets:   http.StripPrefix("/_gm/assets/", http.FileServer(http.FS(assetsFS))),
+		monitor:        deps.Monitor,
+		ready:          deps.Ready,
+		users:          deps.Users,
+		games:          deps.Games,
+		runtime:        deps.Runtime,
+		engineVersions: deps.EngineVersions,
+		operators:      deps.Operators,
+		mail:           deps.Mail,
+		notifications:  deps.Notifications,
+		diplomail:      deps.Diplomail,
+		logger:         logger.Named("http.admin.console"),
+	}
+}
+
+// Dashboard renders the console landing page (GET /_gm and GET /_gm/),
+// including the monitoring panels when an ops-status reader is wired.
+func (h *AdminConsoleHandlers) Dashboard() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		data := adminconsole.DashboardData{}
+		if h.ready != nil {
+			data.BackendReady = h.ready()
+		}
+		if h.monitor != nil {
+			data.MonitorAvailable = true
+			snapshot := h.monitor.Collect(c.Request.Context())
+			data.PostgresHealthy = snapshot.PostgresHealthy
+			data.Runtimes = toViewCounts(snapshot.Runtimes)
+			data.MailDeliveries = toViewCounts(snapshot.MailDeliveries)
+			data.NotificationRoutes = toViewCounts(snapshot.NotificationRoutes)
+			data.NotificationMalformed = snapshot.NotificationMalformed
+			data.Errors = snapshot.Errors
+		}
+		h.render(c, http.StatusOK, "dashboard", "dashboard", "Dashboard", data)
+	}
+}
+
+// toViewCounts maps ops-status counts to the console's view-layer counts.
+func toViewCounts(in []opsstatus.StatusCount) []adminconsole.StatusCount {
+	if len(in) == 0 {
+		return nil
+	}
+	out := make([]adminconsole.StatusCount, len(in))
+	for i, sc := range in {
+		out[i] = adminconsole.StatusCount{Status: sc.Status, Count: sc.Count}
+	}
+	return out
+}
+
+// Asset serves the embedded console static assets under `/_gm/assets/`.
+func (h *AdminConsoleHandlers) Asset() gin.HandlerFunc {
+	return gin.WrapH(h.assets)
+}
+
+// RequireCSRF returns middleware guarding state-changing requests against
+// cross-site request forgery. Safe methods pass through untouched. For unsafe
+// methods it requires both a same-origin Origin/Referer header (when the
+// browser sends one) and a valid per-operator token in the `_csrf` form field;
+// either check failing yields 403.
+func (h *AdminConsoleHandlers) RequireCSRF() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if isSafeHTTPMethod(c.Request.Method) {
+			c.Next()
+			return
+		}
+		if !sameOriginRequest(c.Request) {
+			httperr.Abort(c, http.StatusForbidden, httperr.CodeForbidden, "cross-origin request rejected")
+			return
+		}
+		username, _ := basicauth.UsernameFromContext(c.Request.Context())
+		if !h.csrf.Verify(username, c.PostForm("_csrf")) {
+			httperr.Abort(c, http.StatusForbidden, httperr.CodeForbidden, "invalid or missing CSRF token")
+			return
+		}
+		c.Next()
+	}
+}
+
+// render composes the data common to every console page (operator name, CSRF
+// token, active navigation entry) and writes the named page. It renders into an
+// intermediate buffer so a template failure surfaces as a clean 500 without
+// emitting a partial document.
+func (h *AdminConsoleHandlers) render(c *gin.Context, status int, page, activeNav, title string, data any) {
+	username, _ := basicauth.UsernameFromContext(c.Request.Context())
+
+	var buf bytes.Buffer
+	err := h.renderer.Render(&buf, page, adminconsole.PageData{
+		Title:     title,
+		Username:  username,
+		CSRFToken: h.csrf.Token(username),
+		ActiveNav: activeNav,
+		Data:      data,
+	})
+	if err != nil {
+		h.logger.Error("render admin console page", zap.String("page", page), zap.Error(err))
+		httperr.Abort(c, http.StatusInternalServerError, httperr.CodeInternalError, "failed to render page")
+		return
+	}
+
+	c.Data(status, "text/html; charset=utf-8", buf.Bytes())
+}
+
+// renderMessage renders the generic message page (not-found, validation, or
+// operation-failure notices). class selects the CSS styling and backHref, when
+// non-empty, adds a back link.
+func (h *AdminConsoleHandlers) renderMessage(c *gin.Context, status int, activeNav, title, message, class, backHref string) {
+	h.render(c, status, "message", activeNav, title, adminconsole.MessageData{
+		Message:  message,
+		Class:    class,
+		BackHref: backHref,
+	})
+}
+
+// isSafeHTTPMethod reports whether method is a read-only HTTP method that the
+// CSRF guard may let through without a token.
+func isSafeHTTPMethod(method string) bool {
+	switch method {
+	case http.MethodGet, http.MethodHead, http.MethodOptions:
+		return true
+	default:
+		return false
+	}
+}
+
+// sameOriginRequest reports whether the request's Origin (or, failing that,
+// Referer) names the same host as the request itself. A request that carries
+// neither header is treated as same-origin, leaving the CSRF token as the sole
+// guard; a malformed or cross-host value is rejected. This relies on the
+// gateway reverse proxy preserving the inbound Host header.
+func sameOriginRequest(r *http.Request) bool {
+	source := r.Header.Get("Origin")
+	if source == "" {
+		source = r.Header.Get("Referer")
+	}
+	if source == "" {
+		return true
+	}
+	parsed, err := url.Parse(source)
+	if err != nil || parsed.Host == "" {
+		return false
+	}
+	return strings.EqualFold(parsed.Host, r.Host)
+}

backend/internal/server/handlers_admin_console_games.go

@@ -0,0 +1,423 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/lobby"
+	"galaxy/backend/internal/runtime"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+// GameAdmin is the subset of the lobby service the console uses for games.
+type GameAdmin interface {
+	ListAdminGames(ctx context.Context, page, pageSize int) (lobby.GamePage, error)
+	GetGame(ctx context.Context, gameID uuid.UUID) (lobby.GameRecord, error)
+	CreateGame(ctx context.Context, input lobby.CreateGameInput) (lobby.GameRecord, error)
+	AdminForceStart(ctx context.Context, gameID uuid.UUID) (lobby.GameRecord, error)
+	AdminForceStop(ctx context.Context, gameID uuid.UUID) (lobby.GameRecord, error)
+	AdminBanMember(ctx context.Context, gameID, userID uuid.UUID, reason string) (lobby.Membership, error)
+}
+
+// RuntimeAdmin is the subset of the runtime service the console uses.
+type RuntimeAdmin interface {
+	GetRuntime(ctx context.Context, gameID uuid.UUID) (runtime.RuntimeRecord, error)
+	AdminRestart(ctx context.Context, gameID uuid.UUID) (runtime.OperationLog, error)
+	AdminPatch(ctx context.Context, gameID uuid.UUID, targetVersion string) (runtime.OperationLog, error)
+	AdminForceNextTurn(ctx context.Context, gameID uuid.UUID) (runtime.OperationLog, error)
+}
+
+// EngineVersionAdmin is the subset of the engine-version service the console uses.
+type EngineVersionAdmin interface {
+	List(ctx context.Context) ([]runtime.EngineVersion, error)
+	Register(ctx context.Context, in runtime.RegisterInput) (runtime.EngineVersion, error)
+	Disable(ctx context.Context, version string) (runtime.EngineVersion, error)
+}
+
+// GamesList renders GET /_gm/games.
+func (h *AdminConsoleHandlers) GamesList() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.games == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "games", "Games", "Game administration is not available.", "bad", "/_gm/")
+			return
+		}
+		page := parsePositiveQueryInt(c.Query("page"), 1)
+		pageSize := parsePositiveQueryInt(c.Query("page_size"), 50)
+		result, err := h.games.ListAdminGames(c.Request.Context(), page, pageSize)
+		if err != nil {
+			h.logger.Error("admin console: list games", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "games", "Games", "Failed to load games.", "bad", "/_gm/")
+			return
+		}
+		h.render(c, http.StatusOK, "games", "games", "Games", toGamesListData(result))
+	}
+}
+
+// GameCreate handles POST /_gm/games — create a public game.
+func (h *AdminConsoleHandlers) GameCreate() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.games == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "games", "Games", "Game administration is not available.", "bad", "/_gm/")
+			return
+		}
+		enrollmentEndsAt, err := parseConsoleDateTime(c.PostForm("enrollment_ends_at"))
+		if err != nil {
+			h.renderMessage(c, http.StatusBadRequest, "games", "Invalid input", "Enrollment end must be a valid date/time.", "bad", "/_gm/games")
+			return
+		}
+		game, err := h.games.CreateGame(c.Request.Context(), lobby.CreateGameInput{
+			OwnerUserID:         nil,
+			Visibility:          lobby.VisibilityPublic,
+			GameName:            strings.TrimSpace(c.PostForm("game_name")),
+			Description:         strings.TrimSpace(c.PostForm("description")),
+			MinPlayers:          formInt32(c, "min_players"),
+			MaxPlayers:          formInt32(c, "max_players"),
+			StartGapHours:       formInt32(c, "start_gap_hours"),
+			StartGapPlayers:     formInt32(c, "start_gap_players"),
+			EnrollmentEndsAt:    enrollmentEndsAt,
+			TurnSchedule:        strings.TrimSpace(c.PostForm("turn_schedule")),
+			TargetEngineVersion: strings.TrimSpace(c.PostForm("target_engine_version")),
+		})
+		if err != nil {
+			if errors.Is(err, lobby.ErrInvalidInput) {
+				h.renderMessage(c, http.StatusBadRequest, "games", "Invalid input", "The game could not be created: check the fields.", "bad", "/_gm/games")
+				return
+			}
+			h.logger.Error("admin console: create game", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "games", "Create failed", "Failed to create the game.", "bad", "/_gm/games")
+			return
+		}
+		c.Redirect(http.StatusSeeOther, "/_gm/games/"+game.GameID.String())
+	}
+}
+
+// GameDetail renders GET /_gm/games/:game_id with the runtime snapshot.
+func (h *AdminConsoleHandlers) GameDetail() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.games == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "games", "Games", "Game administration is not available.", "bad", "/_gm/")
+			return
+		}
+		gameID, ok := parseGameIDParam(c)
+		if !ok {
+			return
+		}
+		game, err := h.games.GetGame(c.Request.Context(), gameID)
+		if err != nil {
+			if errors.Is(err, lobby.ErrNotFound) {
+				h.renderMessage(c, http.StatusNotFound, "games", "Game not found", "No such game.", "bad", "/_gm/games")
+				return
+			}
+			h.logger.Error("admin console: get game", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "games", "Games", "Failed to load the game.", "bad", "/_gm/games")
+			return
+		}
+
+		var runtimeRecord *runtime.RuntimeRecord
+		if h.runtime != nil {
+			if record, rtErr := h.runtime.GetRuntime(c.Request.Context(), gameID); rtErr == nil {
+				runtimeRecord = &record
+			}
+		}
+		h.render(c, http.StatusOK, "game_detail", "games", game.GameName, toGameDetailData(game, runtimeRecord))
+	}
+}
+
+// GameForceStart handles POST /_gm/games/:game_id/force-start.
+func (h *AdminConsoleHandlers) GameForceStart() gin.HandlerFunc {
+	return h.gameAction("force-start", func(ctx context.Context, gameID uuid.UUID) error {
+		_, err := h.games.AdminForceStart(ctx, gameID)
+		return err
+	})
+}
+
+// GameForceStop handles POST /_gm/games/:game_id/force-stop.
+func (h *AdminConsoleHandlers) GameForceStop() gin.HandlerFunc {
+	return h.gameAction("force-stop", func(ctx context.Context, gameID uuid.UUID) error {
+		_, err := h.games.AdminForceStop(ctx, gameID)
+		return err
+	})
+}
+
+// GameBanMember handles POST /_gm/games/:game_id/ban-member.
+func (h *AdminConsoleHandlers) GameBanMember() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.games == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "games", "Games", "Game administration is not available.", "bad", "/_gm/")
+			return
+		}
+		gameID, ok := parseGameIDParam(c)
+		if !ok {
+			return
+		}
+		back := "/_gm/games/" + gameID.String()
+		userID, err := uuid.Parse(strings.TrimSpace(c.PostForm("user_id")))
+		if err != nil {
+			h.renderMessage(c, http.StatusBadRequest, "games", "Invalid input", "User ID must be a valid UUID.", "bad", back)
+			return
+		}
+		if _, err := h.games.AdminBanMember(c.Request.Context(), gameID, userID, strings.TrimSpace(c.PostForm("reason"))); err != nil {
+			h.logger.Error("admin console: ban member", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "games", "Ban failed", "Failed to ban the member.", "bad", back)
+			return
+		}
+		c.Redirect(http.StatusSeeOther, back)
+	}
+}
+
+// RuntimeRestart handles POST /_gm/games/:game_id/runtime/restart.
+func (h *AdminConsoleHandlers) RuntimeRestart() gin.HandlerFunc {
+	return h.runtimeAction("restart", func(ctx context.Context, gameID uuid.UUID) error {
+		_, err := h.runtime.AdminRestart(ctx, gameID)
+		return err
+	})
+}
+
+// RuntimeForceNextTurn handles POST /_gm/games/:game_id/runtime/force-next-turn.
+func (h *AdminConsoleHandlers) RuntimeForceNextTurn() gin.HandlerFunc {
+	return h.runtimeAction("force-next-turn", func(ctx context.Context, gameID uuid.UUID) error {
+		_, err := h.runtime.AdminForceNextTurn(ctx, gameID)
+		return err
+	})
+}
+
+// RuntimePatch handles POST /_gm/games/:game_id/runtime/patch.
+func (h *AdminConsoleHandlers) RuntimePatch() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.runtime == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "games", "Runtime", "Runtime administration is not available.", "bad", "/_gm/games")
+			return
+		}
+		gameID, ok := parseGameIDParam(c)
+		if !ok {
+			return
+		}
+		back := "/_gm/games/" + gameID.String()
+		target := strings.TrimSpace(c.PostForm("target_version"))
+		if target == "" {
+			h.renderMessage(c, http.StatusBadRequest, "games", "Invalid input", "A target version is required.", "bad", back)
+			return
+		}
+		if _, err := h.runtime.AdminPatch(c.Request.Context(), gameID, target); err != nil {
+			h.logger.Error("admin console: runtime patch", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "games", "Patch failed", "Failed to patch the runtime.", "bad", back)
+			return
+		}
+		c.Redirect(http.StatusSeeOther, back)
+	}
+}
+
+// gameAction is the shared shape for game-state POST actions that take only the
+// game id and redirect back to the detail page.
+func (h *AdminConsoleHandlers) gameAction(label string, run func(context.Context, uuid.UUID) error) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.games == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "games", "Games", "Game administration is not available.", "bad", "/_gm/")
+			return
+		}
+		gameID, ok := parseGameIDParam(c)
+		if !ok {
+			return
+		}
+		back := "/_gm/games/" + gameID.String()
+		if err := run(c.Request.Context(), gameID); err != nil {
+			h.logger.Error("admin console: game "+label, zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "games", "Action failed", "The "+label+" action failed.", "bad", back)
+			return
+		}
+		c.Redirect(http.StatusSeeOther, back)
+	}
+}
+
+// runtimeAction is the shared shape for runtime POST actions that take only the
+// game id and redirect back to the detail page.
+func (h *AdminConsoleHandlers) runtimeAction(label string, run func(context.Context, uuid.UUID) error) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.runtime == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "games", "Runtime", "Runtime administration is not available.", "bad", "/_gm/games")
+			return
+		}
+		gameID, ok := parseGameIDParam(c)
+		if !ok {
+			return
+		}
+		back := "/_gm/games/" + gameID.String()
+		if err := run(c.Request.Context(), gameID); err != nil {
+			h.logger.Error("admin console: runtime "+label, zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "games", "Action failed", "The runtime "+label+" action failed.", "bad", back)
+			return
+		}
+		c.Redirect(http.StatusSeeOther, back)
+	}
+}
+
+// EngineVersionsList renders GET /_gm/engine-versions.
+func (h *AdminConsoleHandlers) EngineVersionsList() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.engineVersions == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "engine-versions", "Engine versions", "Engine-version administration is not available.", "bad", "/_gm/")
+			return
+		}
+		items, err := h.engineVersions.List(c.Request.Context())
+		if err != nil {
+			h.logger.Error("admin console: list engine versions", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "engine-versions", "Engine versions", "Failed to load engine versions.", "bad", "/_gm/")
+			return
+		}
+		h.render(c, http.StatusOK, "engine_versions", "games", "Engine versions", toEngineVersionsData(items))
+	}
+}
+
+// EngineVersionRegister handles POST /_gm/engine-versions.
+func (h *AdminConsoleHandlers) EngineVersionRegister() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.engineVersions == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "engine-versions", "Engine versions", "Engine-version administration is not available.", "bad", "/_gm/")
+			return
+		}
+		enabled := c.PostForm("enabled") == "true"
+		_, err := h.engineVersions.Register(c.Request.Context(), runtime.RegisterInput{
+			Version:  strings.TrimSpace(c.PostForm("version")),
+			ImageRef: strings.TrimSpace(c.PostForm("image_ref")),
+			Enabled:  &enabled,
+		})
+		if err != nil {
+			if errors.Is(err, runtime.ErrInvalidInput) || errors.Is(err, runtime.ErrEngineVersionTaken) {
+				h.renderMessage(c, http.StatusBadRequest, "engine-versions", "Invalid input", "The version could not be registered (invalid semver, missing image, or duplicate).", "bad", "/_gm/engine-versions")
+				return
+			}
+			h.logger.Error("admin console: register engine version", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "engine-versions", "Register failed", "Failed to register the engine version.", "bad", "/_gm/engine-versions")
+			return
+		}
+		c.Redirect(http.StatusSeeOther, "/_gm/engine-versions")
+	}
+}
+
+// EngineVersionDisable handles POST /_gm/engine-versions/:version/disable.
+func (h *AdminConsoleHandlers) EngineVersionDisable() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.engineVersions == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "engine-versions", "Engine versions", "Engine-version administration is not available.", "bad", "/_gm/")
+			return
+		}
+		version := strings.TrimSpace(c.Param("version"))
+		if _, err := h.engineVersions.Disable(c.Request.Context(), version); err != nil {
+			h.logger.Error("admin console: disable engine version", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "engine-versions", "Disable failed", "Failed to disable the engine version.", "bad", "/_gm/engine-versions")
+			return
+		}
+		c.Redirect(http.StatusSeeOther, "/_gm/engine-versions")
+	}
+}
+
+// formInt32 reads a non-negative int32 form field, defaulting to 0.
+func formInt32(c *gin.Context, name string) int32 {
+	parsed, err := strconv.Atoi(strings.TrimSpace(c.PostForm(name)))
+	if err != nil || parsed < 0 {
+		return 0
+	}
+	return int32(parsed)
+}
+
+// parseConsoleDateTime parses the value of an <input type="datetime-local">
+// (or an RFC 3339 timestamp) as UTC.
+func parseConsoleDateTime(raw string) (time.Time, error) {
+	raw = strings.TrimSpace(raw)
+	for _, layout := range []string{"2006-01-02T15:04", "2006-01-02T15:04:05", time.RFC3339} {
+		if t, err := time.ParseInLocation(layout, raw, time.UTC); err == nil {
+			return t.UTC(), nil
+		}
+	}
+	return time.Time{}, errors.New("invalid date/time")
+}
+
+// toGamesListData maps a game page into the games list view model.
+func toGamesListData(page lobby.GamePage) adminconsole.GamesListData {
+	data := adminconsole.GamesListData{
+		Items:    make([]adminconsole.GameRow, 0, len(page.Items)),
+		Page:     page.Page,
+		PageSize: page.PageSize,
+		Total:    page.Total,
+		PrevPage: page.Page - 1,
+		NextPage: page.Page + 1,
+		HasPrev:  page.Page > 1,
+		HasNext:  page.Page*page.PageSize < page.Total,
+	}
+	for _, game := range page.Items {
+		data.Items = append(data.Items, adminconsole.GameRow{
+			GameID:       game.GameID.String(),
+			GameName:     game.GameName,
+			Visibility:   game.Visibility,
+			Status:       game.Status,
+			Owner:        ownerLabel(game.OwnerUserID),
+			Players:      strconv.Itoa(int(game.MinPlayers)) + "–" + strconv.Itoa(int(game.MaxPlayers)),
+			TurnSchedule: game.TurnSchedule,
+			CreatedAt:    fmtConsoleTime(game.CreatedAt),
+		})
+	}
+	return data
+}
+
+// toGameDetailData maps a game record and optional runtime record into the
+// detail view model.
+func toGameDetailData(game lobby.GameRecord, rec *runtime.RuntimeRecord) adminconsole.GameDetailData {
+	data := adminconsole.GameDetailData{
+		GameID:              game.GameID.String(),
+		GameName:            game.GameName,
+		Description:         game.Description,
+		Visibility:          game.Visibility,
+		Status:              game.Status,
+		Owner:               ownerLabel(game.OwnerUserID),
+		MinPlayers:          game.MinPlayers,
+		MaxPlayers:          game.MaxPlayers,
+		StartGapHours:       game.StartGapHours,
+		StartGapPlayers:     game.StartGapPlayers,
+		TurnSchedule:        game.TurnSchedule,
+		TargetEngineVersion: game.TargetEngineVersion,
+		EnrollmentEndsAt:    fmtConsoleTime(game.EnrollmentEndsAt),
+		CreatedAt:           fmtConsoleTime(game.CreatedAt),
+		StartedAt:           fmtConsoleTimePtr(game.StartedAt),
+		FinishedAt:          fmtConsoleTimePtr(game.FinishedAt),
+	}
+	if rec != nil {
+		data.HasRuntime = true
+		data.RuntimeStatus = rec.Status
+		data.CurrentEngineVersion = rec.CurrentEngineVersion
+		data.EngineHealth = rec.EngineHealth
+		data.CurrentTurn = rec.CurrentTurn
+		data.NextGenerationAt = fmtConsoleTimePtr(rec.NextGenerationAt)
+		data.Paused = rec.Paused
+	}
+	return data
+}
+
+// toEngineVersionsData maps engine versions into the registry view model.
+func toEngineVersionsData(items []runtime.EngineVersion) adminconsole.EngineVersionsData {
+	data := adminconsole.EngineVersionsData{Items: make([]adminconsole.EngineVersionRow, 0, len(items))}
+	for _, v := range items {
+		data.Items = append(data.Items, adminconsole.EngineVersionRow{
+			Version:   v.Version,
+			ImageRef:  v.ImageRef,
+			Enabled:   v.Enabled,
+			CreatedAt: fmtConsoleTime(v.CreatedAt),
+		})
+	}
+	return data
+}
+
+// ownerLabel renders an optional owner id; public games have no owner.
+func ownerLabel(ownerID *uuid.UUID) string {
+	if ownerID == nil {
+		return "—"
+	}
+	return ownerID.String()
+}

backend/internal/server/handlers_admin_console_games_test.go

@@ -0,0 +1,353 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/lobby"
+	"galaxy/backend/internal/runtime"
+	"galaxy/backend/internal/server/middleware/basicauth"
+
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+type fakeGameAdmin struct {
+	page    lobby.GamePage
+	game    lobby.GameRecord
+	getErr  error
+	created lobby.CreateGameInput
+
+	createCalls     int
+	forceStartCalls int
+	forceStopCalls  int
+	banCalls        int
+	lastBanUser     uuid.UUID
+	lastBanReason   string
+}
+
+func (f *fakeGameAdmin) ListAdminGames(context.Context, int, int) (lobby.GamePage, error) {
+	return f.page, nil
+}
+func (f *fakeGameAdmin) GetGame(context.Context, uuid.UUID) (lobby.GameRecord, error) {
+	return f.game, f.getErr
+}
+func (f *fakeGameAdmin) CreateGame(_ context.Context, in lobby.CreateGameInput) (lobby.GameRecord, error) {
+	f.createCalls++
+	f.created = in
+	return f.game, nil
+}
+func (f *fakeGameAdmin) AdminForceStart(context.Context, uuid.UUID) (lobby.GameRecord, error) {
+	f.forceStartCalls++
+	return f.game, nil
+}
+func (f *fakeGameAdmin) AdminForceStop(context.Context, uuid.UUID) (lobby.GameRecord, error) {
+	f.forceStopCalls++
+	return f.game, nil
+}
+func (f *fakeGameAdmin) AdminBanMember(_ context.Context, _, userID uuid.UUID, reason string) (lobby.Membership, error) {
+	f.banCalls++
+	f.lastBanUser = userID
+	f.lastBanReason = reason
+	return lobby.Membership{}, nil
+}
+
+type fakeRuntimeAdmin struct {
+	record           runtime.RuntimeRecord
+	getErr           error
+	restartCalls     int
+	forceNextCalls   int
+	patchCalls       int
+	lastPatchVersion string
+}
+
+func (f *fakeRuntimeAdmin) GetRuntime(context.Context, uuid.UUID) (runtime.RuntimeRecord, error) {
+	return f.record, f.getErr
+}
+func (f *fakeRuntimeAdmin) AdminRestart(context.Context, uuid.UUID) (runtime.OperationLog, error) {
+	f.restartCalls++
+	return runtime.OperationLog{}, nil
+}
+func (f *fakeRuntimeAdmin) AdminPatch(_ context.Context, _ uuid.UUID, target string) (runtime.OperationLog, error) {
+	f.patchCalls++
+	f.lastPatchVersion = target
+	return runtime.OperationLog{}, nil
+}
+func (f *fakeRuntimeAdmin) AdminForceNextTurn(context.Context, uuid.UUID) (runtime.OperationLog, error) {
+	f.forceNextCalls++
+	return runtime.OperationLog{}, nil
+}
+
+type fakeEngineVersionAdmin struct {
+	list          []runtime.EngineVersion
+	registered    runtime.RegisterInput
+	registerCalls int
+	disableCalls  int
+	lastDisabled  string
+}
+
+func (f *fakeEngineVersionAdmin) List(context.Context) ([]runtime.EngineVersion, error) {
+	return f.list, nil
+}
+func (f *fakeEngineVersionAdmin) Register(_ context.Context, in runtime.RegisterInput) (runtime.EngineVersion, error) {
+	f.registerCalls++
+	f.registered = in
+	return runtime.EngineVersion{}, nil
+}
+func (f *fakeEngineVersionAdmin) Disable(_ context.Context, version string) (runtime.EngineVersion, error) {
+	f.disableCalls++
+	f.lastDisabled = version
+	return runtime.EngineVersion{}, nil
+}
+
+func newGamesConsoleRouter(t *testing.T, games GameAdmin, rt RuntimeAdmin, ev EngineVersionAdmin) (http.Handler, *adminconsole.CSRF) {
+	t.Helper()
+	csrf := adminconsole.NewCSRF([]byte("test-key"))
+	handler, err := NewRouter(RouterDependencies{
+		Logger:        zap.NewNop(),
+		AdminVerifier: basicauth.NewStaticVerifier("secret"),
+		AdminConsole: NewAdminConsoleHandlers(AdminConsoleDeps{
+			CSRF: csrf, Games: games, Runtime: rt, EngineVersions: ev,
+		}),
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return handler, csrf
+}
+
+func consoleGet(t *testing.T, router http.Handler, path string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	return rec
+}
+
+func consolePost(t *testing.T, router http.Handler, path, form string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, "http://galaxy.lan"+path, strings.NewReader(form))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Origin", "https://galaxy.lan")
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	return rec
+}
+
+func TestConsoleGamesList(t *testing.T) {
+	games := &fakeGameAdmin{page: lobby.GamePage{
+		Items: []lobby.GameRecord{{GameID: uuid.New(), GameName: "Nova", Visibility: "public", Status: "enrollment_open"}},
+		Page:  1, PageSize: 50, Total: 1,
+	}}
+	router, _ := newGamesConsoleRouter(t, games, nil, nil)
+
+	rec := consoleGet(t, router, "/_gm/games")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	for _, want := range []string{"Nova", "public", "enrollment_open", "Create public game"} {
+		if !strings.Contains(rec.Body.String(), want) {
+			t.Errorf("games list missing %q", want)
+		}
+	}
+}
+
+func TestConsoleGameDetailWithRuntime(t *testing.T) {
+	id := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: id, GameName: "Nova", Status: "running"}}
+	rt := &fakeRuntimeAdmin{record: runtime.RuntimeRecord{GameID: id, Status: "running", CurrentEngineVersion: "0.1.0", CurrentTurn: 7}}
+	router, csrf := newGamesConsoleRouter(t, games, rt, nil)
+
+	rec := consoleGet(t, router, "/_gm/games/"+id.String())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	for _, want := range []string{"Nova", "Force start", "Force stop", "0.1.0", "Patch", "Ban member", csrf.Token("ops")} {
+		if !strings.Contains(rec.Body.String(), want) {
+			t.Errorf("game detail missing %q", want)
+		}
+	}
+}
+
+func TestConsoleGameDetailNoRuntime(t *testing.T) {
+	id := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: id, GameName: "Nova"}}
+	rt := &fakeRuntimeAdmin{getErr: errors.New("not found")}
+	router, _ := newGamesConsoleRouter(t, games, rt, nil)
+
+	rec := consoleGet(t, router, "/_gm/games/"+id.String())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "No runtime record") {
+		t.Error("expected a no-runtime note")
+	}
+}
+
+func TestConsoleGameCreate(t *testing.T) {
+	id := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: id}}
+	router, csrf := newGamesConsoleRouter(t, games, nil, nil)
+
+	form := "_csrf=" + csrf.Token("ops") +
+		"&game_name=Nova&description=d&min_players=2&max_players=8&start_gap_hours=0&start_gap_players=0" +
+		"&enrollment_ends_at=2030-01-02T15:04&turn_schedule=@every+24h&target_engine_version=0.1.0"
+	rec := consolePost(t, router, "/_gm/games", form)
+
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303; body=%s", rec.Code, rec.Body.String())
+	}
+	if got := rec.Header().Get("Location"); got != "/_gm/games/"+id.String() {
+		t.Errorf("redirect = %q, want detail page", got)
+	}
+	if games.createCalls != 1 {
+		t.Fatalf("CreateGame called %d times, want 1", games.createCalls)
+	}
+	if games.created.Visibility != lobby.VisibilityPublic {
+		t.Errorf("visibility = %q, want public", games.created.Visibility)
+	}
+	if games.created.GameName != "Nova" {
+		t.Errorf("game name = %q", games.created.GameName)
+	}
+	if games.created.EnrollmentEndsAt.Year() != 2030 {
+		t.Errorf("enrollment year = %d, want 2030", games.created.EnrollmentEndsAt.Year())
+	}
+	if games.created.OwnerUserID != nil {
+		t.Error("public game must have a nil owner")
+	}
+}
+
+func TestConsoleGameForceStart(t *testing.T) {
+	id := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: id}}
+	router, csrf := newGamesConsoleRouter(t, games, nil, nil)
+
+	rec := consolePost(t, router, "/_gm/games/"+id.String()+"/force-start", "_csrf="+csrf.Token("ops"))
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303", rec.Code)
+	}
+	if games.forceStartCalls != 1 {
+		t.Errorf("AdminForceStart called %d times, want 1", games.forceStartCalls)
+	}
+}
+
+func TestConsoleGameForceStartRejectsBadCSRF(t *testing.T) {
+	id := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: id}}
+	router, _ := newGamesConsoleRouter(t, games, nil, nil)
+
+	rec := consolePost(t, router, "/_gm/games/"+id.String()+"/force-start", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+	if games.forceStartCalls != 0 {
+		t.Error("force-start must not run without a CSRF token")
+	}
+}
+
+func TestConsoleGameBanMember(t *testing.T) {
+	gameID := uuid.New()
+	target := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: gameID}}
+	router, csrf := newGamesConsoleRouter(t, games, nil, nil)
+
+	form := "_csrf=" + csrf.Token("ops") + "&user_id=" + target.String() + "&reason=cheating"
+	rec := consolePost(t, router, "/_gm/games/"+gameID.String()+"/ban-member", form)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303; body=%s", rec.Code, rec.Body.String())
+	}
+	if games.banCalls != 1 || games.lastBanUser != target || games.lastBanReason != "cheating" {
+		t.Errorf("ban recorded %d user=%s reason=%q", games.banCalls, games.lastBanUser, games.lastBanReason)
+	}
+}
+
+func TestConsoleGameBanMemberRejectsBadUUID(t *testing.T) {
+	gameID := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: gameID}}
+	router, csrf := newGamesConsoleRouter(t, games, nil, nil)
+
+	rec := consolePost(t, router, "/_gm/games/"+gameID.String()+"/ban-member", "_csrf="+csrf.Token("ops")+"&user_id=not-a-uuid")
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if games.banCalls != 0 {
+		t.Error("ban must not run with an invalid user id")
+	}
+}
+
+func TestConsoleRuntimePatch(t *testing.T) {
+	id := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: id}}
+	rt := &fakeRuntimeAdmin{}
+	router, csrf := newGamesConsoleRouter(t, games, rt, nil)
+
+	rec := consolePost(t, router, "/_gm/games/"+id.String()+"/runtime/patch", "_csrf="+csrf.Token("ops")+"&target_version=0.1.1")
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303", rec.Code)
+	}
+	if rt.patchCalls != 1 || rt.lastPatchVersion != "0.1.1" {
+		t.Errorf("patch recorded %d version=%q", rt.patchCalls, rt.lastPatchVersion)
+	}
+}
+
+func TestConsoleRuntimePatchMissingVersion(t *testing.T) {
+	id := uuid.New()
+	games := &fakeGameAdmin{game: lobby.GameRecord{GameID: id}}
+	rt := &fakeRuntimeAdmin{}
+	router, csrf := newGamesConsoleRouter(t, games, rt, nil)
+
+	rec := consolePost(t, router, "/_gm/games/"+id.String()+"/runtime/patch", "_csrf="+csrf.Token("ops"))
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if rt.patchCalls != 0 {
+		t.Error("patch must not run without a target version")
+	}
+}
+
+func TestConsoleEngineVersions(t *testing.T) {
+	ev := &fakeEngineVersionAdmin{list: []runtime.EngineVersion{{Version: "0.1.0", ImageRef: "img:0.1.0", Enabled: true}}}
+	router, csrf := newGamesConsoleRouter(t, nil, nil, ev)
+
+	rec := consoleGet(t, router, "/_gm/engine-versions")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	for _, want := range []string{"0.1.0", "img:0.1.0", "Register version", "Disable"} {
+		if !strings.Contains(rec.Body.String(), want) {
+			t.Errorf("engine versions page missing %q", want)
+		}
+	}
+
+	rec = consolePost(t, router, "/_gm/engine-versions", "_csrf="+csrf.Token("ops")+"&version=0.2.0&image_ref=img:0.2.0&enabled=true")
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("register status = %d, want 303", rec.Code)
+	}
+	if ev.registerCalls != 1 || ev.registered.Version != "0.2.0" || ev.registered.Enabled == nil || !*ev.registered.Enabled {
+		t.Errorf("register recorded %d version=%q enabled=%v", ev.registerCalls, ev.registered.Version, ev.registered.Enabled)
+	}
+
+	rec = consolePost(t, router, "/_gm/engine-versions/0.1.0/disable", "_csrf="+csrf.Token("ops"))
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("disable status = %d, want 303", rec.Code)
+	}
+	if ev.disableCalls != 1 || ev.lastDisabled != "0.1.0" {
+		t.Errorf("disable recorded %d version=%q", ev.disableCalls, ev.lastDisabled)
+	}
+}
+
+func TestConsoleGamesUnavailable(t *testing.T) {
+	router, _ := newGamesConsoleRouter(t, nil, nil, nil)
+
+	rec := consoleGet(t, router, "/_gm/games")
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", rec.Code)
+	}
+}

backend/internal/server/handlers_admin_console_mail.go

@@ -0,0 +1,327 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/diplomail"
+	"galaxy/backend/internal/mail"
+	"galaxy/backend/internal/notification"
+	"galaxy/backend/internal/server/clientip"
+	"galaxy/backend/internal/server/middleware/basicauth"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+// MailAdmin is the subset of the mail service the console uses.
+type MailAdmin interface {
+	AdminListDeliveries(ctx context.Context, page, pageSize int) (mail.AdminListDeliveriesPage, error)
+	AdminGetDelivery(ctx context.Context, deliveryID uuid.UUID) (mail.Delivery, error)
+	AdminListAttempts(ctx context.Context, deliveryID uuid.UUID) ([]mail.Attempt, error)
+	AdminResendDelivery(ctx context.Context, deliveryID uuid.UUID) (mail.Delivery, error)
+	AdminListDeadLetters(ctx context.Context, page, pageSize int) (mail.AdminListDeadLettersPage, error)
+}
+
+// NotificationAdmin is the subset of the notification service the console uses.
+type NotificationAdmin interface {
+	AdminListNotifications(ctx context.Context, page, pageSize int) (notification.AdminListNotificationsPage, error)
+	AdminListDeadLetters(ctx context.Context, page, pageSize int) (notification.AdminListDeadLettersPage, error)
+	AdminListMalformed(ctx context.Context, page, pageSize int) (notification.AdminListMalformedPage, error)
+}
+
+// DiplomailAdmin is the subset of the diplomail service the console uses.
+type DiplomailAdmin interface {
+	SendAdminMultiGameBroadcast(ctx context.Context, in diplomail.SendMultiGameBroadcastInput) ([]diplomail.Message, int, error)
+}
+
+const consoleSnapshotPageSize = 50
+
+// MailPage renders GET /_gm/mail — paginated deliveries plus a dead-letter snapshot.
+func (h *AdminConsoleHandlers) MailPage() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.mail == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "mail", "Mail", "Mail administration is not available.", "bad", "/_gm/")
+			return
+		}
+		page := parsePositiveQueryInt(c.Query("page"), 1)
+		pageSize := parsePositiveQueryInt(c.Query("page_size"), 50)
+		ctx := c.Request.Context()
+
+		deliveries, err := h.mail.AdminListDeliveries(ctx, page, pageSize)
+		if err != nil {
+			h.logger.Error("admin console: list deliveries", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Mail", "Failed to load deliveries.", "bad", "/_gm/")
+			return
+		}
+		dead, err := h.mail.AdminListDeadLetters(ctx, 1, consoleSnapshotPageSize)
+		if err != nil {
+			h.logger.Error("admin console: list mail dead-letters", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Mail", "Failed to load dead-letters.", "bad", "/_gm/")
+			return
+		}
+		h.render(c, http.StatusOK, "mail", "mail", "Mail", toMailData(deliveries, dead))
+	}
+}
+
+// MailDeliveryDetail renders GET /_gm/mail/deliveries/:delivery_id.
+func (h *AdminConsoleHandlers) MailDeliveryDetail() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.mail == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "mail", "Mail", "Mail administration is not available.", "bad", "/_gm/")
+			return
+		}
+		deliveryID, ok := parseConsoleDeliveryID(c, h)
+		if !ok {
+			return
+		}
+		ctx := c.Request.Context()
+		delivery, err := h.mail.AdminGetDelivery(ctx, deliveryID)
+		if err != nil {
+			if errors.Is(err, mail.ErrDeliveryNotFound) {
+				h.renderMessage(c, http.StatusNotFound, "mail", "Delivery not found", "No such delivery.", "bad", "/_gm/mail")
+				return
+			}
+			h.logger.Error("admin console: get delivery", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Mail", "Failed to load the delivery.", "bad", "/_gm/mail")
+			return
+		}
+		attempts, err := h.mail.AdminListAttempts(ctx, deliveryID)
+		if err != nil {
+			h.logger.Error("admin console: list attempts", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Mail", "Failed to load attempts.", "bad", "/_gm/mail")
+			return
+		}
+		h.render(c, http.StatusOK, "mail_delivery", "mail", "Delivery", toMailDeliveryDetail(delivery, attempts))
+	}
+}
+
+// MailResend handles POST /_gm/mail/deliveries/:delivery_id/resend.
+func (h *AdminConsoleHandlers) MailResend() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.mail == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "mail", "Mail", "Mail administration is not available.", "bad", "/_gm/")
+			return
+		}
+		deliveryID, ok := parseConsoleDeliveryID(c, h)
+		if !ok {
+			return
+		}
+		back := "/_gm/mail/deliveries/" + deliveryID.String()
+		if _, err := h.mail.AdminResendDelivery(c.Request.Context(), deliveryID); err != nil {
+			h.logger.Error("admin console: resend delivery", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Resend failed", "Failed to resend the delivery (it may already be sent).", "bad", back)
+			return
+		}
+		c.Redirect(http.StatusSeeOther, back)
+	}
+}
+
+// NotificationsPage renders GET /_gm/notifications — notifications, dead-letters,
+// and malformed intents on one overview page.
+func (h *AdminConsoleHandlers) NotificationsPage() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.notifications == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "mail", "Notifications", "Notification administration is not available.", "bad", "/_gm/")
+			return
+		}
+		ctx := c.Request.Context()
+		notifications, err := h.notifications.AdminListNotifications(ctx, 1, consoleSnapshotPageSize)
+		if err != nil {
+			h.logger.Error("admin console: list notifications", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Notifications", "Failed to load notifications.", "bad", "/_gm/")
+			return
+		}
+		dead, err := h.notifications.AdminListDeadLetters(ctx, 1, consoleSnapshotPageSize)
+		if err != nil {
+			h.logger.Error("admin console: list notification dead-letters", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Notifications", "Failed to load dead-letters.", "bad", "/_gm/")
+			return
+		}
+		malformed, err := h.notifications.AdminListMalformed(ctx, 1, consoleSnapshotPageSize)
+		if err != nil {
+			h.logger.Error("admin console: list malformed intents", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Notifications", "Failed to load malformed intents.", "bad", "/_gm/")
+			return
+		}
+		h.render(c, http.StatusOK, "notifications", "mail", "Notifications", toNotificationsData(notifications, dead, malformed))
+	}
+}
+
+// BroadcastForm renders GET /_gm/broadcast.
+func (h *AdminConsoleHandlers) BroadcastForm() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.diplomail == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "mail", "Broadcast", "Broadcast is not available.", "bad", "/_gm/")
+			return
+		}
+		h.render(c, http.StatusOK, "broadcast", "mail", "Broadcast", nil)
+	}
+}
+
+// BroadcastSend handles POST /_gm/broadcast — multi-game admin broadcast.
+func (h *AdminConsoleHandlers) BroadcastSend() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.diplomail == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "mail", "Broadcast", "Broadcast is not available.", "bad", "/_gm/")
+			return
+		}
+		username, _ := basicauth.UsernameFromContext(c.Request.Context())
+		gameIDs, err := parseGameIDList(c.PostForm("game_ids"))
+		if err != nil {
+			h.renderMessage(c, http.StatusBadRequest, "mail", "Invalid input", "Game IDs must be valid UUIDs.", "bad", "/_gm/broadcast")
+			return
+		}
+		_, total, err := h.diplomail.SendAdminMultiGameBroadcast(c.Request.Context(), diplomail.SendMultiGameBroadcastInput{
+			CallerUsername: username,
+			Scope:          strings.TrimSpace(c.PostForm("scope")),
+			GameIDs:        gameIDs,
+			RecipientScope: strings.TrimSpace(c.PostForm("recipients")),
+			Subject:        strings.TrimSpace(c.PostForm("subject")),
+			Body:           c.PostForm("body"),
+			SenderIP:       clientip.ExtractSourceIP(c),
+		})
+		if err != nil {
+			if errors.Is(err, diplomail.ErrInvalidInput) {
+				h.renderMessage(c, http.StatusBadRequest, "mail", "Invalid input", "The broadcast was rejected: check the scope, recipients, and body.", "bad", "/_gm/broadcast")
+				return
+			}
+			h.logger.Error("admin console: broadcast", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "mail", "Broadcast failed", "Failed to send the broadcast.", "bad", "/_gm/broadcast")
+			return
+		}
+		h.renderMessage(c, http.StatusOK, "mail", "Broadcast sent", fmt.Sprintf("Broadcast delivered to %d recipients.", total), "ok", "/_gm/broadcast")
+	}
+}
+
+// parseConsoleDeliveryID parses the delivery_id path parameter, rendering a
+// console message page on failure.
+func parseConsoleDeliveryID(c *gin.Context, h *AdminConsoleHandlers) (uuid.UUID, bool) {
+	parsed, err := uuid.Parse(c.Param("delivery_id"))
+	if err != nil {
+		h.renderMessage(c, http.StatusBadRequest, "mail", "Invalid input", "delivery_id must be a valid UUID.", "bad", "/_gm/mail")
+		return uuid.Nil, false
+	}
+	return parsed, true
+}
+
+// parseGameIDList parses a comma-separated list of UUIDs, ignoring blanks.
+func parseGameIDList(raw string) ([]uuid.UUID, error) {
+	fields := strings.Split(raw, ",")
+	ids := make([]uuid.UUID, 0, len(fields))
+	for _, field := range fields {
+		field = strings.TrimSpace(field)
+		if field == "" {
+			continue
+		}
+		parsed, err := uuid.Parse(field)
+		if err != nil {
+			return nil, err
+		}
+		ids = append(ids, parsed)
+	}
+	return ids, nil
+}
+
+func toMailData(deliveries mail.AdminListDeliveriesPage, dead mail.AdminListDeadLettersPage) adminconsole.MailData {
+	data := adminconsole.MailData{
+		Deliveries:  make([]adminconsole.MailDeliveryRow, 0, len(deliveries.Items)),
+		DeadLetters: make([]adminconsole.MailDeadLetterRow, 0, len(dead.Items)),
+		Page:        deliveries.Page,
+		PageSize:    deliveries.PageSize,
+		Total:       deliveries.Total,
+		PrevPage:    deliveries.Page - 1,
+		NextPage:    deliveries.Page + 1,
+		HasPrev:     deliveries.Page > 1,
+		HasNext:     int64(deliveries.Page*deliveries.PageSize) < deliveries.Total,
+	}
+	for _, d := range deliveries.Items {
+		data.Deliveries = append(data.Deliveries, adminconsole.MailDeliveryRow{
+			DeliveryID:  d.DeliveryID.String(),
+			Template:    d.TemplateID,
+			Status:      d.Status,
+			Attempts:    d.Attempts,
+			NextAttempt: fmtConsoleTimePtr(d.NextAttemptAt),
+			Created:     fmtConsoleTime(d.CreatedAt),
+		})
+	}
+	for _, d := range dead.Items {
+		data.DeadLetters = append(data.DeadLetters, adminconsole.MailDeadLetterRow{
+			DeliveryID: d.DeliveryID.String(),
+			Reason:     d.Reason,
+			Archived:   fmtConsoleTime(d.ArchivedAt),
+		})
+	}
+	return data
+}
+
+func toMailDeliveryDetail(d mail.Delivery, attempts []mail.Attempt) adminconsole.MailDeliveryDetail {
+	detail := adminconsole.MailDeliveryDetail{
+		DeliveryID:   d.DeliveryID.String(),
+		Template:     d.TemplateID,
+		Status:       d.Status,
+		Attempts:     d.Attempts,
+		NextAttempt:  fmtConsoleTimePtr(d.NextAttemptAt),
+		LastError:    d.LastError,
+		Created:      fmtConsoleTime(d.CreatedAt),
+		Sent:         fmtConsoleTimePtr(d.SentAt),
+		DeadLettered: fmtConsoleTimePtr(d.DeadLetteredAt),
+		CanResend:    d.Status != mail.StatusSent,
+		AttemptRows:  make([]adminconsole.MailAttemptRow, 0, len(attempts)),
+	}
+	for _, a := range attempts {
+		detail.AttemptRows = append(detail.AttemptRows, adminconsole.MailAttemptRow{
+			AttemptNo: a.AttemptNo,
+			Outcome:   a.Outcome,
+			Started:   fmtConsoleTime(a.StartedAt),
+			Finished:  fmtConsoleTimePtr(a.FinishedAt),
+			Error:     a.Error,
+		})
+	}
+	return detail
+}
+
+func toNotificationsData(notifications notification.AdminListNotificationsPage, dead notification.AdminListDeadLettersPage, malformed notification.AdminListMalformedPage) adminconsole.NotificationsData {
+	data := adminconsole.NotificationsData{
+		Notifications: make([]adminconsole.NotificationRow, 0, len(notifications.Items)),
+		DeadLetters:   make([]adminconsole.NotificationDeadLetterRow, 0, len(dead.Items)),
+		Malformed:     make([]adminconsole.MalformedRow, 0, len(malformed.Items)),
+	}
+	for _, n := range notifications.Items {
+		data.Notifications = append(data.Notifications, adminconsole.NotificationRow{
+			NotificationID: n.NotificationID.String(),
+			Kind:           n.Kind,
+			UserID:         optionalUUID(n.UserID),
+			Created:        fmtConsoleTime(n.CreatedAt),
+		})
+	}
+	for _, d := range dead.Items {
+		data.DeadLetters = append(data.DeadLetters, adminconsole.NotificationDeadLetterRow{
+			NotificationID: d.NotificationID.String(),
+			RouteID:        d.RouteID.String(),
+			Reason:         d.Reason,
+			Archived:       fmtConsoleTime(d.ArchivedAt),
+		})
+	}
+	for _, m := range malformed.Items {
+		data.Malformed = append(data.Malformed, adminconsole.MalformedRow{
+			ID:       m.ID.String(),
+			Reason:   m.Reason,
+			Received: fmtConsoleTime(m.ReceivedAt),
+		})
+	}
+	return data
+}
+
+// optionalUUID renders a nullable user id; system-scoped rows have none.
+func optionalUUID(id *uuid.UUID) string {
+	if id == nil {
+		return "—"
+	}
+	return id.String()
+}

backend/internal/server/handlers_admin_console_mail_test.go

@@ -0,0 +1,242 @@
+package server
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/diplomail"
+	"galaxy/backend/internal/mail"
+	"galaxy/backend/internal/notification"
+	"galaxy/backend/internal/server/middleware/basicauth"
+
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+type fakeMailAdmin struct {
+	deliveries  mail.AdminListDeliveriesPage
+	dead        mail.AdminListDeadLettersPage
+	delivery    mail.Delivery
+	getErr      error
+	attempts    []mail.Attempt
+	resendCalls int
+}
+
+func (f *fakeMailAdmin) AdminListDeliveries(context.Context, int, int) (mail.AdminListDeliveriesPage, error) {
+	return f.deliveries, nil
+}
+func (f *fakeMailAdmin) AdminGetDelivery(context.Context, uuid.UUID) (mail.Delivery, error) {
+	return f.delivery, f.getErr
+}
+func (f *fakeMailAdmin) AdminListAttempts(context.Context, uuid.UUID) ([]mail.Attempt, error) {
+	return f.attempts, nil
+}
+func (f *fakeMailAdmin) AdminResendDelivery(context.Context, uuid.UUID) (mail.Delivery, error) {
+	f.resendCalls++
+	return f.delivery, nil
+}
+func (f *fakeMailAdmin) AdminListDeadLetters(context.Context, int, int) (mail.AdminListDeadLettersPage, error) {
+	return f.dead, nil
+}
+
+type fakeNotificationAdmin struct {
+	notifications notification.AdminListNotificationsPage
+	dead          notification.AdminListDeadLettersPage
+	malformed     notification.AdminListMalformedPage
+}
+
+func (f *fakeNotificationAdmin) AdminListNotifications(context.Context, int, int) (notification.AdminListNotificationsPage, error) {
+	return f.notifications, nil
+}
+func (f *fakeNotificationAdmin) AdminListDeadLetters(context.Context, int, int) (notification.AdminListDeadLettersPage, error) {
+	return f.dead, nil
+}
+func (f *fakeNotificationAdmin) AdminListMalformed(context.Context, int, int) (notification.AdminListMalformedPage, error) {
+	return f.malformed, nil
+}
+
+type fakeDiplomailAdmin struct {
+	total          int
+	err            error
+	broadcastCalls int
+	last           diplomail.SendMultiGameBroadcastInput
+}
+
+func (f *fakeDiplomailAdmin) SendAdminMultiGameBroadcast(_ context.Context, in diplomail.SendMultiGameBroadcastInput) ([]diplomail.Message, int, error) {
+	f.broadcastCalls++
+	f.last = in
+	if f.err != nil {
+		return nil, 0, f.err
+	}
+	return nil, f.total, nil
+}
+
+func mailConsoleRouter(t *testing.T, m MailAdmin, n NotificationAdmin, d DiplomailAdmin) (http.Handler, *adminconsole.CSRF) {
+	t.Helper()
+	csrf := adminconsole.NewCSRF([]byte("test-key"))
+	handler, err := NewRouter(RouterDependencies{
+		Logger:        zap.NewNop(),
+		AdminVerifier: basicauth.NewStaticVerifier("secret"),
+		AdminConsole:  NewAdminConsoleHandlers(AdminConsoleDeps{CSRF: csrf, Mail: m, Notifications: n, Diplomail: d}),
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return handler, csrf
+}
+
+func TestConsoleMailPage(t *testing.T) {
+	id := uuid.New()
+	m := &fakeMailAdmin{
+		deliveries: mail.AdminListDeliveriesPage{
+			Items: []mail.Delivery{{DeliveryID: id, TemplateID: "auth.login_code", Status: "pending", CreatedAt: time.Now()}},
+			Page:  1, PageSize: 50, Total: 1,
+		},
+		dead: mail.AdminListDeadLettersPage{
+			Items: []mail.DeadLetter{{DeliveryID: uuid.New(), Reason: "smtp 550", ArchivedAt: time.Now()}},
+		},
+	}
+	router, _ := mailConsoleRouter(t, m, nil, nil)
+
+	rec := consoleGet(t, router, "/_gm/mail")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	for _, want := range []string{"auth.login_code", "pending", "Dead-letters", "smtp 550"} {
+		if !strings.Contains(rec.Body.String(), want) {
+			t.Errorf("mail page missing %q", want)
+		}
+	}
+}
+
+func TestConsoleMailDeliveryDetail(t *testing.T) {
+	id := uuid.New()
+	m := &fakeMailAdmin{
+		delivery: mail.Delivery{DeliveryID: id, TemplateID: "auth.login_code", Status: "pending", Attempts: 2},
+		attempts: []mail.Attempt{{AttemptNo: 1, Outcome: "transient_failure", StartedAt: time.Now(), Error: "timeout"}},
+	}
+	router, _ := mailConsoleRouter(t, m, nil, nil)
+
+	rec := consoleGet(t, router, "/_gm/mail/deliveries/"+id.String())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	for _, want := range []string{id.String(), "auth.login_code", "Attempts", "transient_failure", "Resend"} {
+		if !strings.Contains(rec.Body.String(), want) {
+			t.Errorf("delivery detail missing %q", want)
+		}
+	}
+}
+
+func TestConsoleMailDeliveryDetailNotFound(t *testing.T) {
+	m := &fakeMailAdmin{getErr: mail.ErrDeliveryNotFound}
+	router, _ := mailConsoleRouter(t, m, nil, nil)
+
+	rec := consoleGet(t, router, "/_gm/mail/deliveries/"+uuid.New().String())
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404", rec.Code)
+	}
+}
+
+func TestConsoleMailResend(t *testing.T) {
+	id := uuid.New()
+	m := &fakeMailAdmin{delivery: mail.Delivery{DeliveryID: id}}
+	router, csrf := mailConsoleRouter(t, m, nil, nil)
+
+	rec := consolePost(t, router, "/_gm/mail/deliveries/"+id.String()+"/resend", "_csrf="+csrf.Token("ops"))
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303", rec.Code)
+	}
+	if m.resendCalls != 1 {
+		t.Errorf("AdminResendDelivery called %d times, want 1", m.resendCalls)
+	}
+}
+
+func TestConsoleMailResendRejectsBadCSRF(t *testing.T) {
+	id := uuid.New()
+	m := &fakeMailAdmin{delivery: mail.Delivery{DeliveryID: id}}
+	router, _ := mailConsoleRouter(t, m, nil, nil)
+
+	rec := consolePost(t, router, "/_gm/mail/deliveries/"+id.String()+"/resend", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+	if m.resendCalls != 0 {
+		t.Error("resend must not run without a CSRF token")
+	}
+}
+
+func TestConsoleNotificationsPage(t *testing.T) {
+	n := &fakeNotificationAdmin{
+		notifications: notification.AdminListNotificationsPage{Items: []notification.Notification{{NotificationID: uuid.New(), Kind: "lobby.invite.received"}}},
+		dead:          notification.AdminListDeadLettersPage{Items: []notification.DeadLetter{{NotificationID: uuid.New(), RouteID: uuid.New(), Reason: "push gone"}}},
+		malformed:     notification.AdminListMalformedPage{Items: []notification.MalformedIntent{{ID: uuid.New(), Reason: "bad shape"}}},
+	}
+	router, _ := mailConsoleRouter(t, nil, n, nil)
+
+	rec := consoleGet(t, router, "/_gm/notifications")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	for _, want := range []string{"lobby.invite.received", "push gone", "bad shape", "Malformed intents"} {
+		if !strings.Contains(rec.Body.String(), want) {
+			t.Errorf("notifications page missing %q", want)
+		}
+	}
+}
+
+func TestConsoleBroadcastForm(t *testing.T) {
+	router, _ := mailConsoleRouter(t, nil, nil, &fakeDiplomailAdmin{})
+
+	rec := consoleGet(t, router, "/_gm/broadcast")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "Send broadcast") {
+		t.Error("broadcast form missing")
+	}
+}
+
+func TestConsoleBroadcastSend(t *testing.T) {
+	d := &fakeDiplomailAdmin{total: 5}
+	router, csrf := mailConsoleRouter(t, nil, nil, d)
+
+	form := "_csrf=" + csrf.Token("ops") + "&scope=all_running&recipients=active&body=hello"
+	rec := consolePost(t, router, "/_gm/broadcast", form)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "5 recipients") {
+		t.Errorf("broadcast result missing recipient count; body=%s", rec.Body.String())
+	}
+	if d.broadcastCalls != 1 || d.last.Scope != "all_running" || d.last.Body != "hello" || d.last.CallerUsername != "ops" {
+		t.Errorf("broadcast input = %+v (calls=%d)", d.last, d.broadcastCalls)
+	}
+}
+
+func TestConsoleBroadcastSendBadGameIDs(t *testing.T) {
+	d := &fakeDiplomailAdmin{}
+	router, csrf := mailConsoleRouter(t, nil, nil, d)
+
+	form := "_csrf=" + csrf.Token("ops") + "&scope=selected&game_ids=not-a-uuid&body=hello"
+	rec := consolePost(t, router, "/_gm/broadcast", form)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if d.broadcastCalls != 0 {
+		t.Error("broadcast must not run with invalid game ids")
+	}
+}
+
+func TestConsoleMailUnavailable(t *testing.T) {
+	router, _ := mailConsoleRouter(t, nil, nil, nil)
+
+	rec := consoleGet(t, router, "/_gm/mail")
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", rec.Code)
+	}
+}

backend/internal/server/handlers_admin_console_operators.go

@@ -0,0 +1,149 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+
+	"galaxy/backend/internal/admin"
+	"galaxy/backend/internal/adminconsole"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+// OperatorAdmin is the subset of the admin-account service the console uses.
+// *admin.Service satisfies it.
+type OperatorAdmin interface {
+	List(ctx context.Context) ([]admin.Admin, error)
+	Create(ctx context.Context, in admin.CreateInput) (admin.Admin, error)
+	Disable(ctx context.Context, username string) (admin.Admin, error)
+	Enable(ctx context.Context, username string) (admin.Admin, error)
+	ResetPassword(ctx context.Context, username, password string) (admin.Admin, error)
+}
+
+// OperatorsList renders GET /_gm/operators.
+func (h *AdminConsoleHandlers) OperatorsList() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.operators == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "operators", "Operators", "Operator administration is not available.", "bad", "/_gm/")
+			return
+		}
+		admins, err := h.operators.List(c.Request.Context())
+		if err != nil {
+			h.logger.Error("admin console: list operators", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "operators", "Operators", "Failed to load operators.", "bad", "/_gm/")
+			return
+		}
+		h.render(c, http.StatusOK, "operators", "operators", "Operators", toOperatorsData(admins))
+	}
+}
+
+// OperatorCreate handles POST /_gm/operators.
+func (h *AdminConsoleHandlers) OperatorCreate() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.operators == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "operators", "Operators", "Operator administration is not available.", "bad", "/_gm/")
+			return
+		}
+		_, err := h.operators.Create(c.Request.Context(), admin.CreateInput{
+			Username: strings.TrimSpace(c.PostForm("username")),
+			Password: c.PostForm("password"),
+		})
+		if err != nil {
+			switch {
+			case errors.Is(err, admin.ErrUsernameTaken):
+				h.renderMessage(c, http.StatusConflict, "operators", "Username taken", "That username is already in use.", "bad", "/_gm/operators")
+			case errors.Is(err, admin.ErrInvalidInput):
+				h.renderMessage(c, http.StatusBadRequest, "operators", "Invalid input", "Username and password are required.", "bad", "/_gm/operators")
+			default:
+				h.logger.Error("admin console: create operator", zap.Error(err))
+				h.renderMessage(c, http.StatusInternalServerError, "operators", "Create failed", "Failed to create the operator.", "bad", "/_gm/operators")
+			}
+			return
+		}
+		c.Redirect(http.StatusSeeOther, "/_gm/operators")
+	}
+}
+
+// OperatorDisable handles POST /_gm/operators/:username/disable.
+func (h *AdminConsoleHandlers) OperatorDisable() gin.HandlerFunc {
+	return h.operatorAction("disable", func(ctx context.Context, username string) error {
+		_, err := h.operators.Disable(ctx, username)
+		return err
+	})
+}
+
+// OperatorEnable handles POST /_gm/operators/:username/enable.
+func (h *AdminConsoleHandlers) OperatorEnable() gin.HandlerFunc {
+	return h.operatorAction("enable", func(ctx context.Context, username string) error {
+		_, err := h.operators.Enable(ctx, username)
+		return err
+	})
+}
+
+// OperatorResetPassword handles POST /_gm/operators/:username/reset-password.
+func (h *AdminConsoleHandlers) OperatorResetPassword() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.operators == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "operators", "Operators", "Operator administration is not available.", "bad", "/_gm/")
+			return
+		}
+		username := c.Param("username")
+		password := c.PostForm("password")
+		if strings.TrimSpace(password) == "" {
+			h.renderMessage(c, http.StatusBadRequest, "operators", "Invalid input", "A new password is required.", "bad", "/_gm/operators")
+			return
+		}
+		if _, err := h.operators.ResetPassword(c.Request.Context(), username, password); err != nil {
+			if errors.Is(err, admin.ErrNotFound) {
+				h.renderMessage(c, http.StatusNotFound, "operators", "Operator not found", "No such operator.", "bad", "/_gm/operators")
+				return
+			}
+			if errors.Is(err, admin.ErrInvalidInput) {
+				h.renderMessage(c, http.StatusBadRequest, "operators", "Invalid input", "The password was rejected.", "bad", "/_gm/operators")
+				return
+			}
+			h.logger.Error("admin console: reset operator password", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "operators", "Reset failed", "Failed to reset the password.", "bad", "/_gm/operators")
+			return
+		}
+		c.Redirect(http.StatusSeeOther, "/_gm/operators")
+	}
+}
+
+// operatorAction is the shared shape for operator POST actions that take only
+// the username and redirect back to the list.
+func (h *AdminConsoleHandlers) operatorAction(label string, run func(context.Context, string) error) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.operators == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "operators", "Operators", "Operator administration is not available.", "bad", "/_gm/")
+			return
+		}
+		if err := run(c.Request.Context(), c.Param("username")); err != nil {
+			if errors.Is(err, admin.ErrNotFound) {
+				h.renderMessage(c, http.StatusNotFound, "operators", "Operator not found", "No such operator.", "bad", "/_gm/operators")
+				return
+			}
+			h.logger.Error("admin console: operator "+label, zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "operators", "Action failed", "The "+label+" action failed.", "bad", "/_gm/operators")
+			return
+		}
+		c.Redirect(http.StatusSeeOther, "/_gm/operators")
+	}
+}
+
+// toOperatorsData maps admin accounts into the operators view model.
+func toOperatorsData(admins []admin.Admin) adminconsole.OperatorsData {
+	data := adminconsole.OperatorsData{Items: make([]adminconsole.OperatorRow, 0, len(admins))}
+	for _, a := range admins {
+		data.Items = append(data.Items, adminconsole.OperatorRow{
+			Username:   a.Username,
+			CreatedAt:  fmtConsoleTime(a.CreatedAt),
+			LastUsedAt: fmtConsoleTimePtr(a.LastUsedAt),
+			Disabled:   a.DisabledAt != nil,
+		})
+	}
+	return data
+}

backend/internal/server/handlers_admin_console_operators_test.go

@@ -0,0 +1,166 @@
+package server
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+
+	"galaxy/backend/internal/admin"
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/server/middleware/basicauth"
+
+	"go.uber.org/zap"
+)
+
+type fakeOperatorAdmin struct {
+	list      []admin.Admin
+	createErr error
+
+	created       admin.CreateInput
+	createCalls   int
+	disableCalls  int
+	enableCalls   int
+	resetCalls    int
+	lastResetUser string
+	lastResetPass string
+}
+
+func (f *fakeOperatorAdmin) List(context.Context) ([]admin.Admin, error) { return f.list, nil }
+func (f *fakeOperatorAdmin) Create(_ context.Context, in admin.CreateInput) (admin.Admin, error) {
+	f.createCalls++
+	f.created = in
+	if f.createErr != nil {
+		return admin.Admin{}, f.createErr
+	}
+	return admin.Admin{Username: in.Username}, nil
+}
+func (f *fakeOperatorAdmin) Disable(_ context.Context, username string) (admin.Admin, error) {
+	f.disableCalls++
+	return admin.Admin{Username: username}, nil
+}
+func (f *fakeOperatorAdmin) Enable(_ context.Context, username string) (admin.Admin, error) {
+	f.enableCalls++
+	return admin.Admin{Username: username}, nil
+}
+func (f *fakeOperatorAdmin) ResetPassword(_ context.Context, username, password string) (admin.Admin, error) {
+	f.resetCalls++
+	f.lastResetUser = username
+	f.lastResetPass = password
+	return admin.Admin{Username: username}, nil
+}
+
+func operatorsRouter(t *testing.T, operators OperatorAdmin) (http.Handler, *adminconsole.CSRF) {
+	t.Helper()
+	csrf := adminconsole.NewCSRF([]byte("test-key"))
+	handler, err := NewRouter(RouterDependencies{
+		Logger:        zap.NewNop(),
+		AdminVerifier: basicauth.NewStaticVerifier("secret"),
+		AdminConsole:  NewAdminConsoleHandlers(AdminConsoleDeps{CSRF: csrf, Operators: operators}),
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return handler, csrf
+}
+
+func TestConsoleOperatorsList(t *testing.T) {
+	fake := &fakeOperatorAdmin{list: []admin.Admin{{Username: "root"}}}
+	router, _ := operatorsRouter(t, fake)
+
+	rec := consoleGet(t, router, "/_gm/operators")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	for _, want := range []string{"root", "Create operator", "Reset"} {
+		if !strings.Contains(rec.Body.String(), want) {
+			t.Errorf("operators page missing %q", want)
+		}
+	}
+}
+
+func TestConsoleOperatorCreate(t *testing.T) {
+	fake := &fakeOperatorAdmin{}
+	router, csrf := operatorsRouter(t, fake)
+
+	rec := consolePost(t, router, "/_gm/operators", "_csrf="+csrf.Token("ops")+"&username=mod&password=s3cret")
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303; body=%s", rec.Code, rec.Body.String())
+	}
+	if fake.createCalls != 1 || fake.created.Username != "mod" || fake.created.Password != "s3cret" {
+		t.Errorf("create recorded %d username=%q", fake.createCalls, fake.created.Username)
+	}
+}
+
+func TestConsoleOperatorCreateConflict(t *testing.T) {
+	fake := &fakeOperatorAdmin{createErr: admin.ErrUsernameTaken}
+	router, csrf := operatorsRouter(t, fake)
+
+	rec := consolePost(t, router, "/_gm/operators", "_csrf="+csrf.Token("ops")+"&username=root&password=x")
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("status = %d, want 409", rec.Code)
+	}
+}
+
+func TestConsoleOperatorDisableEnable(t *testing.T) {
+	fake := &fakeOperatorAdmin{}
+	router, csrf := operatorsRouter(t, fake)
+
+	if rec := consolePost(t, router, "/_gm/operators/root/disable", "_csrf="+csrf.Token("ops")); rec.Code != http.StatusSeeOther {
+		t.Fatalf("disable status = %d, want 303", rec.Code)
+	}
+	if rec := consolePost(t, router, "/_gm/operators/root/enable", "_csrf="+csrf.Token("ops")); rec.Code != http.StatusSeeOther {
+		t.Fatalf("enable status = %d, want 303", rec.Code)
+	}
+	if fake.disableCalls != 1 || fake.enableCalls != 1 {
+		t.Errorf("disable=%d enable=%d, want 1/1", fake.disableCalls, fake.enableCalls)
+	}
+}
+
+func TestConsoleOperatorResetPassword(t *testing.T) {
+	fake := &fakeOperatorAdmin{}
+	router, csrf := operatorsRouter(t, fake)
+
+	rec := consolePost(t, router, "/_gm/operators/root/reset-password", "_csrf="+csrf.Token("ops")+"&password=newpass")
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303", rec.Code)
+	}
+	if fake.resetCalls != 1 || fake.lastResetUser != "root" || fake.lastResetPass != "newpass" {
+		t.Errorf("reset recorded %d user=%q", fake.resetCalls, fake.lastResetUser)
+	}
+}
+
+func TestConsoleOperatorResetPasswordMissing(t *testing.T) {
+	fake := &fakeOperatorAdmin{}
+	router, csrf := operatorsRouter(t, fake)
+
+	rec := consolePost(t, router, "/_gm/operators/root/reset-password", "_csrf="+csrf.Token("ops"))
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if fake.resetCalls != 0 {
+		t.Error("reset must not run without a password")
+	}
+}
+
+func TestConsoleOperatorRejectsBadCSRF(t *testing.T) {
+	fake := &fakeOperatorAdmin{}
+	router, _ := operatorsRouter(t, fake)
+
+	rec := consolePost(t, router, "/_gm/operators/root/disable", "")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+	if fake.disableCalls != 0 {
+		t.Error("disable must not run without a CSRF token")
+	}
+}
+
+func TestConsoleOperatorsUnavailable(t *testing.T) {
+	router, _ := operatorsRouter(t, nil)
+
+	rec := consoleGet(t, router, "/_gm/operators")
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", rec.Code)
+	}
+}

backend/internal/server/handlers_admin_console_test.go

@@ -0,0 +1,214 @@
+package server
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/opsstatus"
+	"galaxy/backend/internal/server/middleware/basicauth"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+// fakeMonitor is a static opsstatus.Reader for dashboard rendering tests.
+type fakeMonitor struct {
+	snapshot opsstatus.Snapshot
+}
+
+func (f fakeMonitor) Collect(context.Context) opsstatus.Snapshot {
+	return f.snapshot
+}
+
+func newConsoleTestRouter(t *testing.T) http.Handler {
+	t.Helper()
+	handler, err := NewRouter(RouterDependencies{
+		Logger:        zap.NewNop(),
+		AdminVerifier: basicauth.NewStaticVerifier("secret"),
+		AdminConsole:  NewAdminConsoleHandlers(AdminConsoleDeps{CSRF: adminconsole.NewCSRF([]byte("test-key"))}),
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return handler
+}
+
+func TestAdminConsoleRequiresAuth(t *testing.T) {
+	router := newConsoleTestRouter(t)
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+	if got := rec.Header().Get("WWW-Authenticate"); !strings.Contains(got, "Basic") {
+		t.Fatalf("WWW-Authenticate = %q, want a Basic challenge", got)
+	}
+}
+
+func TestAdminConsoleDashboardRenders(t *testing.T) {
+	router := newConsoleTestRouter(t)
+
+	for _, path := range []string{"/_gm", "/_gm/"} {
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		req.SetBasicAuth("ops", "secret")
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+
+		if rec.Code != http.StatusOK {
+			t.Fatalf("GET %s status = %d, want 200; body=%s", path, rec.Code, rec.Body.String())
+		}
+		if ct := rec.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/html") {
+			t.Errorf("GET %s content-type = %q, want text/html", path, ct)
+		}
+		body := rec.Body.String()
+		if !strings.Contains(body, "Dashboard") {
+			t.Errorf("GET %s body missing the dashboard heading", path)
+		}
+		if !strings.Contains(body, "ops") {
+			t.Errorf("GET %s body missing the operator name", path)
+		}
+	}
+}
+
+func TestAdminConsoleDashboardShowsMonitoring(t *testing.T) {
+	monitor := fakeMonitor{snapshot: opsstatus.Snapshot{
+		PostgresHealthy:       true,
+		Runtimes:              []opsstatus.StatusCount{{Status: "running", Count: 3}, {Status: "stopped", Count: 1}},
+		MailDeliveries:        []opsstatus.StatusCount{{Status: "pending", Count: 2}},
+		NotificationRoutes:    []opsstatus.StatusCount{{Status: "published", Count: 9}},
+		NotificationMalformed: 4,
+		Errors:                []string{"notification route counts: boom"},
+	}}
+
+	handler, err := NewRouter(RouterDependencies{
+		Logger:        zap.NewNop(),
+		AdminVerifier: basicauth.NewStaticVerifier("secret"),
+		AdminConsole: NewAdminConsoleHandlers(AdminConsoleDeps{
+			CSRF:    adminconsole.NewCSRF([]byte("test-key")),
+			Monitor: monitor,
+			Ready:   func() bool { return true },
+		}),
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/", nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	for _, want := range []string{
+		"Game runtimes", "running", "stopped",
+		"Mail deliveries", "pending",
+		"Notification routes", "published",
+		"Malformed notifications",
+		"notification route counts: boom",
+		"healthy",
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("dashboard body missing %q", want)
+		}
+	}
+}
+
+func TestAdminConsoleDashboardWithoutMonitor(t *testing.T) {
+	router := newConsoleTestRouter(t) // no monitor wired
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/", nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "Monitoring is not wired") {
+		t.Error("dashboard without a monitor should note that monitoring is unavailable")
+	}
+}
+
+func TestAdminConsoleServesAsset(t *testing.T) {
+	router := newConsoleTestRouter(t)
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/assets/console.css", nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("asset status = %d, want 200", rec.Code)
+	}
+	if ct := rec.Header().Get("Content-Type"); !strings.Contains(ct, "text/css") {
+		t.Errorf("asset content-type = %q, want text/css", ct)
+	}
+}
+
+func TestAdminConsoleRequireCSRF(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	csrf := adminconsole.NewCSRF([]byte("test-key"))
+	console := NewAdminConsoleHandlers(AdminConsoleDeps{CSRF: csrf})
+
+	engine := gin.New()
+	engine.Use(func(c *gin.Context) {
+		c.Request = c.Request.WithContext(basicauth.WithUsername(c.Request.Context(), "ops"))
+		c.Next()
+	})
+	engine.Use(console.RequireCSRF())
+	engine.GET("/x", func(c *gin.Context) { c.Status(http.StatusOK) })
+	engine.POST("/x", func(c *gin.Context) { c.Status(http.StatusOK) })
+
+	token := csrf.Token("ops")
+
+	cases := []struct {
+		name   string
+		method string
+		form   string
+		origin string
+		host   string
+		want   int
+	}{
+		{"get is a safe method", http.MethodGet, "", "", "galaxy.lan", http.StatusOK},
+		{"valid token, same origin", http.MethodPost, "_csrf=" + token, "https://galaxy.lan", "galaxy.lan", http.StatusOK},
+		{"valid token, no origin header", http.MethodPost, "_csrf=" + token, "", "galaxy.lan", http.StatusOK},
+		{"missing token", http.MethodPost, "", "https://galaxy.lan", "galaxy.lan", http.StatusForbidden},
+		{"wrong token", http.MethodPost, "_csrf=bogus", "https://galaxy.lan", "galaxy.lan", http.StatusForbidden},
+		{"cross-origin", http.MethodPost, "_csrf=" + token, "https://evil.example", "galaxy.lan", http.StatusForbidden},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var body io.Reader
+			if tc.form != "" {
+				body = strings.NewReader(tc.form)
+			}
+			req := httptest.NewRequest(tc.method, "/x", body)
+			if tc.form != "" {
+				req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			}
+			if tc.origin != "" {
+				req.Header.Set("Origin", tc.origin)
+			}
+			req.Host = tc.host
+
+			rec := httptest.NewRecorder()
+			engine.ServeHTTP(rec, req)
+
+			if rec.Code != tc.want {
+				t.Fatalf("status = %d, want %d (body=%s)", rec.Code, tc.want, rec.Body.String())
+			}
+		})
+	}
+}

backend/internal/server/handlers_admin_console_users.go

@@ -0,0 +1,252 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/server/middleware/basicauth"
+	"galaxy/backend/internal/user"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+// UserAdmin is the subset of the user service the operator console depends on.
+// *user.Service satisfies it; tests supply a fake so the console pages render
+// without a database.
+type UserAdmin interface {
+	ListAccounts(ctx context.Context, page, pageSize int) (user.AccountPage, error)
+	GetAccount(ctx context.Context, userID uuid.UUID) (user.Account, error)
+	ApplySanction(ctx context.Context, input user.ApplySanctionInput) (user.Account, error)
+	ApplyEntitlement(ctx context.Context, input user.ApplyEntitlementInput) (user.Account, error)
+	SoftDelete(ctx context.Context, userID uuid.UUID, actor user.ActorRef) error
+}
+
+// consoleTiers lists the selectable entitlement tiers in display order.
+var consoleTiers = []string{user.TierFree, user.TierMonthly, user.TierYearly, user.TierPermanent}
+
+// UsersList renders GET /_gm/users — the paginated account list.
+func (h *AdminConsoleHandlers) UsersList() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.users == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "users", "Users", "User administration is not available.", "bad", "/_gm/")
+			return
+		}
+		page := parsePositiveQueryInt(c.Query("page"), 1)
+		pageSize := parsePositiveQueryInt(c.Query("page_size"), 50)
+
+		result, err := h.users.ListAccounts(c.Request.Context(), page, pageSize)
+		if err != nil {
+			h.logger.Error("admin console: list users", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "users", "Users", "Failed to load users.", "bad", "/_gm/")
+			return
+		}
+		h.render(c, http.StatusOK, "users", "users", "Users", toUsersListData(result))
+	}
+}
+
+// UserDetail renders GET /_gm/users/:user_id.
+func (h *AdminConsoleHandlers) UserDetail() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.users == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "users", "Users", "User administration is not available.", "bad", "/_gm/")
+			return
+		}
+		userID, ok := parseUserIDParam(c)
+		if !ok {
+			return
+		}
+		account, err := h.users.GetAccount(c.Request.Context(), userID)
+		if err != nil {
+			if errors.Is(err, user.ErrAccountNotFound) {
+				h.renderMessage(c, http.StatusNotFound, "users", "User not found", "No such user, or the account has been soft-deleted.", "bad", "/_gm/users")
+				return
+			}
+			h.logger.Error("admin console: get user", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "users", "Users", "Failed to load the user.", "bad", "/_gm/users")
+			return
+		}
+		h.render(c, http.StatusOK, "user_detail", "users", account.Email, toUserDetailData(account))
+	}
+}
+
+// UserBlock handles POST /_gm/users/:user_id/block — applies a permanent block.
+func (h *AdminConsoleHandlers) UserBlock() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.users == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "users", "Users", "User administration is not available.", "bad", "/_gm/")
+			return
+		}
+		userID, ok := parseUserIDParam(c)
+		if !ok {
+			return
+		}
+		back := "/_gm/users/" + userID.String()
+		reason := strings.TrimSpace(c.PostForm("reason_code"))
+		if reason == "" {
+			h.renderMessage(c, http.StatusBadRequest, "users", "Invalid input", "A reason is required to block a user.", "bad", back)
+			return
+		}
+		_, err := h.users.ApplySanction(c.Request.Context(), user.ApplySanctionInput{
+			UserID:       userID,
+			SanctionCode: user.SanctionCodePermanentBlock,
+			Scope:        "account",
+			ReasonCode:   reason,
+			Actor:        actorFromContext(c),
+		})
+		if err != nil {
+			h.logger.Error("admin console: block user", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "users", "Block failed", "Failed to block the user.", "bad", back)
+			return
+		}
+		c.Redirect(http.StatusSeeOther, back)
+	}
+}
+
+// UserEntitlement handles POST /_gm/users/:user_id/entitlement.
+func (h *AdminConsoleHandlers) UserEntitlement() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.users == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "users", "Users", "User administration is not available.", "bad", "/_gm/")
+			return
+		}
+		userID, ok := parseUserIDParam(c)
+		if !ok {
+			return
+		}
+		back := "/_gm/users/" + userID.String()
+		tier := strings.TrimSpace(c.PostForm("tier"))
+		source := strings.TrimSpace(c.PostForm("source"))
+		if source == "" {
+			source = "admin"
+		}
+		_, err := h.users.ApplyEntitlement(c.Request.Context(), user.ApplyEntitlementInput{
+			UserID:     userID,
+			Tier:       tier,
+			Source:     source,
+			Actor:      actorFromContext(c),
+			ReasonCode: strings.TrimSpace(c.PostForm("reason_code")),
+		})
+		if err != nil {
+			if errors.Is(err, user.ErrInvalidInput) {
+				h.renderMessage(c, http.StatusBadRequest, "users", "Invalid input", "The entitlement request was rejected: check the tier.", "bad", back)
+				return
+			}
+			h.logger.Error("admin console: apply entitlement", zap.Error(err))
+			h.renderMessage(c, http.StatusInternalServerError, "users", "Entitlement failed", "Failed to update the entitlement.", "bad", back)
+			return
+		}
+		c.Redirect(http.StatusSeeOther, back)
+	}
+}
+
+// UserSoftDelete handles POST /_gm/users/:user_id/soft-delete.
+func (h *AdminConsoleHandlers) UserSoftDelete() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if h.users == nil {
+			h.renderMessage(c, http.StatusServiceUnavailable, "users", "Users", "User administration is not available.", "bad", "/_gm/")
+			return
+		}
+		userID, ok := parseUserIDParam(c)
+		if !ok {
+			return
+		}
+		if err := h.users.SoftDelete(c.Request.Context(), userID, actorFromContext(c)); err != nil {
+			if errors.Is(err, user.ErrAccountNotFound) {
+				h.renderMessage(c, http.StatusNotFound, "users", "User not found", "No such user.", "bad", "/_gm/users")
+				return
+			}
+			// A cascade error does not undo the soft delete; log and proceed.
+			h.logger.Warn("admin console: soft-delete cascade returned error", zap.Error(err))
+		}
+		c.Redirect(http.StatusSeeOther, "/_gm/users")
+	}
+}
+
+// actorFromContext builds the admin ActorRef for audit trails from the
+// authenticated operator username stored by the Basic Auth middleware.
+func actorFromContext(c *gin.Context) user.ActorRef {
+	username, _ := basicauth.UsernameFromContext(c.Request.Context())
+	return user.ActorRef{Type: "admin", ID: username}
+}
+
+// toUsersListData maps an account page into the users list view model.
+func toUsersListData(page user.AccountPage) adminconsole.UsersListData {
+	data := adminconsole.UsersListData{
+		Items:    make([]adminconsole.UserRow, 0, len(page.Items)),
+		Page:     page.Page,
+		PageSize: page.PageSize,
+		Total:    page.Total,
+		PrevPage: page.Page - 1,
+		NextPage: page.Page + 1,
+		HasPrev:  page.Page > 1,
+		HasNext:  page.Page*page.PageSize < page.Total,
+	}
+	for _, account := range page.Items {
+		data.Items = append(data.Items, adminconsole.UserRow{
+			UserID:      account.UserID.String(),
+			Email:       account.Email,
+			UserName:    account.UserName,
+			DisplayName: account.DisplayName,
+			Tier:        account.Entitlement.Tier,
+			Blocked:     account.PermanentBlock,
+			Deleted:     account.DeletedAt != nil,
+			CreatedAt:   fmtConsoleTime(account.CreatedAt),
+		})
+	}
+	return data
+}
+
+// toUserDetailData maps an account aggregate into the detail view model.
+func toUserDetailData(account user.Account) adminconsole.UserDetailData {
+	data := adminconsole.UserDetailData{
+		UserID:            account.UserID.String(),
+		Email:             account.Email,
+		UserName:          account.UserName,
+		DisplayName:       account.DisplayName,
+		PreferredLanguage: account.PreferredLanguage,
+		TimeZone:          account.TimeZone,
+		DeclaredCountry:   account.DeclaredCountry,
+		Blocked:           account.PermanentBlock,
+		Deleted:           account.DeletedAt != nil,
+		CreatedAt:         fmtConsoleTime(account.CreatedAt),
+		UpdatedAt:         fmtConsoleTime(account.UpdatedAt),
+		Tier:              account.Entitlement.Tier,
+		IsPaid:            account.Entitlement.IsPaid,
+		EntitlementSource: account.Entitlement.Source,
+		EntitlementReason: account.Entitlement.ReasonCode,
+		EntitlementEnds:   fmtConsoleTimePtr(account.Entitlement.EndsAt),
+		Tiers:             consoleTiers,
+	}
+	for _, sanction := range account.ActiveSanctions {
+		data.Sanctions = append(data.Sanctions, adminconsole.SanctionView{
+			SanctionCode: sanction.SanctionCode,
+			Scope:        sanction.Scope,
+			ReasonCode:   sanction.ReasonCode,
+			AppliedAt:    fmtConsoleTime(sanction.AppliedAt),
+			ExpiresAt:    fmtConsoleTimePtr(sanction.ExpiresAt),
+		})
+	}
+	return data
+}
+
+// fmtConsoleTime renders a timestamp for display in the console.
+func fmtConsoleTime(t time.Time) string {
+	if t.IsZero() {
+		return ""
+	}
+	return t.UTC().Format("2006-01-02 15:04 UTC")
+}
+
+// fmtConsoleTimePtr renders an optional timestamp, returning "" when nil.
+func fmtConsoleTimePtr(t *time.Time) string {
+	if t == nil {
+		return ""
+	}
+	return fmtConsoleTime(*t)
+}

backend/internal/server/handlers_admin_console_users_test.go

@@ -0,0 +1,288 @@
+package server
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"galaxy/backend/internal/adminconsole"
+	"galaxy/backend/internal/server/middleware/basicauth"
+	"galaxy/backend/internal/user"
+
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+// fakeUserAdmin records calls so the console handlers can be exercised without
+// a database.
+type fakeUserAdmin struct {
+	page    user.AccountPage
+	account user.Account
+	getErr  error
+
+	sanctionCalls   int
+	lastSanction    user.ApplySanctionInput
+	entitlementCall int
+	lastEntitlement user.ApplyEntitlementInput
+	softDeleteCalls int
+	lastSoftActor   user.ActorRef
+}
+
+func (f *fakeUserAdmin) ListAccounts(context.Context, int, int) (user.AccountPage, error) {
+	return f.page, nil
+}
+
+func (f *fakeUserAdmin) GetAccount(context.Context, uuid.UUID) (user.Account, error) {
+	return f.account, f.getErr
+}
+
+func (f *fakeUserAdmin) ApplySanction(_ context.Context, in user.ApplySanctionInput) (user.Account, error) {
+	f.sanctionCalls++
+	f.lastSanction = in
+	return f.account, nil
+}
+
+func (f *fakeUserAdmin) ApplyEntitlement(_ context.Context, in user.ApplyEntitlementInput) (user.Account, error) {
+	f.entitlementCall++
+	f.lastEntitlement = in
+	return f.account, nil
+}
+
+func (f *fakeUserAdmin) SoftDelete(_ context.Context, _ uuid.UUID, actor user.ActorRef) error {
+	f.softDeleteCalls++
+	f.lastSoftActor = actor
+	return nil
+}
+
+func newUsersConsoleRouter(t *testing.T, users UserAdmin) (http.Handler, *adminconsole.CSRF) {
+	t.Helper()
+	csrf := adminconsole.NewCSRF([]byte("test-key"))
+	handler, err := NewRouter(RouterDependencies{
+		Logger:        zap.NewNop(),
+		AdminVerifier: basicauth.NewStaticVerifier("secret"),
+		AdminConsole:  NewAdminConsoleHandlers(AdminConsoleDeps{CSRF: csrf, Users: users}),
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return handler, csrf
+}
+
+func TestConsoleUsersList(t *testing.T) {
+	fake := &fakeUserAdmin{page: user.AccountPage{
+		Items: []user.Account{
+			{UserID: uuid.New(), Email: "alice@example.test", UserName: "alice"},
+			{UserID: uuid.New(), Email: "bob@example.test", UserName: "bob", PermanentBlock: true},
+		},
+		Page: 1, PageSize: 50, Total: 2,
+	}}
+	router, _ := newUsersConsoleRouter(t, fake)
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/users", nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	for _, want := range []string{"alice@example.test", "bob@example.test", "blocked", "page 1"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("users list missing %q", want)
+		}
+	}
+}
+
+func TestConsoleUserDetailRendersForms(t *testing.T) {
+	id := uuid.New()
+	fake := &fakeUserAdmin{account: user.Account{
+		UserID: id, Email: "alice@example.test", UserName: "alice",
+		Entitlement: user.EntitlementSnapshot{Tier: user.TierFree},
+	}}
+	router, csrf := newUsersConsoleRouter(t, fake)
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/users/"+id.String(), nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	for _, want := range []string{
+		"alice@example.test",
+		"Permanently block",
+		"Update entitlement",
+		"Soft-delete account",
+		csrf.Token("ops"),
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("user detail missing %q", want)
+		}
+	}
+}
+
+func TestConsoleUserDetailNotFound(t *testing.T) {
+	fake := &fakeUserAdmin{getErr: user.ErrAccountNotFound}
+	router, _ := newUsersConsoleRouter(t, fake)
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/users/"+uuid.New().String(), nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "not found") {
+		t.Error("expected a not-found message")
+	}
+}
+
+func TestConsoleUserBlock(t *testing.T) {
+	id := uuid.New()
+	fake := &fakeUserAdmin{account: user.Account{UserID: id}}
+	router, csrf := newUsersConsoleRouter(t, fake)
+
+	form := "_csrf=" + csrf.Token("ops") + "&reason_code=spam"
+	req := httptest.NewRequest(http.MethodPost, "http://galaxy.lan/_gm/users/"+id.String()+"/block", strings.NewReader(form))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Origin", "https://galaxy.lan")
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303; body=%s", rec.Code, rec.Body.String())
+	}
+	if fake.sanctionCalls != 1 {
+		t.Fatalf("ApplySanction called %d times, want 1", fake.sanctionCalls)
+	}
+	if fake.lastSanction.SanctionCode != user.SanctionCodePermanentBlock {
+		t.Errorf("sanction code = %q, want permanent_block", fake.lastSanction.SanctionCode)
+	}
+	if fake.lastSanction.Scope != "account" {
+		t.Errorf("scope = %q, want account", fake.lastSanction.Scope)
+	}
+	if fake.lastSanction.ReasonCode != "spam" {
+		t.Errorf("reason = %q, want spam", fake.lastSanction.ReasonCode)
+	}
+	if fake.lastSanction.Actor.Type != "admin" || fake.lastSanction.Actor.ID != "ops" {
+		t.Errorf("actor = %+v, want admin/ops", fake.lastSanction.Actor)
+	}
+	if fake.lastSanction.UserID != id {
+		t.Errorf("sanction user id = %s, want %s", fake.lastSanction.UserID, id)
+	}
+}
+
+func TestConsoleUserBlockMissingReason(t *testing.T) {
+	id := uuid.New()
+	fake := &fakeUserAdmin{account: user.Account{UserID: id}}
+	router, csrf := newUsersConsoleRouter(t, fake)
+
+	form := "_csrf=" + csrf.Token("ops")
+	req := httptest.NewRequest(http.MethodPost, "http://galaxy.lan/_gm/users/"+id.String()+"/block", strings.NewReader(form))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Origin", "https://galaxy.lan")
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if fake.sanctionCalls != 0 {
+		t.Errorf("ApplySanction must not be called without a reason")
+	}
+}
+
+func TestConsoleUserBlockRejectsBadCSRF(t *testing.T) {
+	id := uuid.New()
+	fake := &fakeUserAdmin{account: user.Account{UserID: id}}
+	router, _ := newUsersConsoleRouter(t, fake)
+
+	req := httptest.NewRequest(http.MethodPost, "http://galaxy.lan/_gm/users/"+id.String()+"/block", strings.NewReader("reason_code=spam"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Origin", "https://galaxy.lan")
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+	if fake.sanctionCalls != 0 {
+		t.Errorf("ApplySanction must not run when the CSRF token is missing")
+	}
+}
+
+func TestConsoleUserEntitlement(t *testing.T) {
+	id := uuid.New()
+	fake := &fakeUserAdmin{account: user.Account{UserID: id}}
+	router, csrf := newUsersConsoleRouter(t, fake)
+
+	form := "_csrf=" + csrf.Token("ops") + "&tier=monthly&source=admin&reason_code=promo"
+	req := httptest.NewRequest(http.MethodPost, "http://galaxy.lan/_gm/users/"+id.String()+"/entitlement", strings.NewReader(form))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Origin", "https://galaxy.lan")
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303; body=%s", rec.Code, rec.Body.String())
+	}
+	if fake.entitlementCall != 1 {
+		t.Fatalf("ApplyEntitlement called %d times, want 1", fake.entitlementCall)
+	}
+	if fake.lastEntitlement.Tier != user.TierMonthly {
+		t.Errorf("tier = %q, want monthly", fake.lastEntitlement.Tier)
+	}
+	if fake.lastEntitlement.Actor.ID != "ops" {
+		t.Errorf("actor id = %q, want ops", fake.lastEntitlement.Actor.ID)
+	}
+}
+
+func TestConsoleUserSoftDelete(t *testing.T) {
+	id := uuid.New()
+	fake := &fakeUserAdmin{account: user.Account{UserID: id}}
+	router, csrf := newUsersConsoleRouter(t, fake)
+
+	form := "_csrf=" + csrf.Token("ops")
+	req := httptest.NewRequest(http.MethodPost, "http://galaxy.lan/_gm/users/"+id.String()+"/soft-delete", strings.NewReader(form))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Origin", "https://galaxy.lan")
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("status = %d, want 303", rec.Code)
+	}
+	if got := rec.Header().Get("Location"); got != "/_gm/users" {
+		t.Errorf("redirect Location = %q, want /_gm/users", got)
+	}
+	if fake.softDeleteCalls != 1 {
+		t.Fatalf("SoftDelete called %d times, want 1", fake.softDeleteCalls)
+	}
+	if fake.lastSoftActor.ID != "ops" {
+		t.Errorf("soft-delete actor = %q, want ops", fake.lastSoftActor.ID)
+	}
+}
+
+func TestConsoleUsersUnavailable(t *testing.T) {
+	router, _ := newUsersConsoleRouter(t, nil) // no user service wired
+
+	req := httptest.NewRequest(http.MethodGet, "/_gm/users", nil)
+	req.SetBasicAuth("ops", "secret")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", rec.Code)
+	}
+}

backend/internal/server/handlers_user_games.go

@@ -39,55 +39,6 @@ func NewUserGamesHandlers(rt *runtime.Service, engine *engineclient.Client, logg
 	return &UserGamesHandlers{runtime: rt, engine: engine, logger: logger.Named("http.user.games")}
 }
 
-// Commands handles POST /api/v1/user/games/{game_id}/commands.
-func (h *UserGamesHandlers) Commands() gin.HandlerFunc {
-	if h == nil || h.runtime == nil || h.engine == nil {
-		return handlers.NotImplemented("userGamesCommands")
-	}
-	return func(c *gin.Context) {
-		gameID, ok := parseGameIDParam(c)
-		if !ok {
-			return
-		}
-		userID, ok := userid.FromContext(c.Request.Context())
-		if !ok {
-			httperr.Abort(c, http.StatusBadRequest, httperr.CodeInvalidRequest, "user id missing")
-			return
-		}
-		body, err := io.ReadAll(c.Request.Body)
-		if err != nil {
-			httperr.Abort(c, http.StatusBadRequest, httperr.CodeInvalidRequest, "request body could not be read")
-			return
-		}
-		ctx := c.Request.Context()
-		if err := h.runtime.CheckOrdersAccept(ctx, gameID); err != nil {
-			respondGameProxyError(c, h.logger, "user games commands", ctx, err)
-			return
-		}
-		mapping, err := h.runtime.ResolvePlayerMapping(ctx, gameID, userID)
-		if err != nil {
-			respondGameProxyError(c, h.logger, "user games commands", ctx, err)
-			return
-		}
-		endpoint, err := h.runtime.EngineEndpoint(ctx, gameID)
-		if err != nil {
-			respondGameProxyError(c, h.logger, "user games commands", ctx, err)
-			return
-		}
-		payload, err := rebindActor(body, mapping.RaceName)
-		if err != nil {
-			httperr.Abort(c, http.StatusBadRequest, httperr.CodeInvalidRequest, "request body must be a JSON object")
-			return
-		}
-		resp, err := h.engine.ExecuteCommands(ctx, endpoint, payload)
-		if err != nil {
-			respondEngineProxyError(c, h.logger, "user games commands", ctx, resp, err)
-			return
-		}
-		c.Data(http.StatusOK, "application/json", resp)
-	}
-}
-
 // Orders handles POST /api/v1/user/games/{game_id}/orders.
 func (h *UserGamesHandlers) Orders() gin.HandlerFunc {
 	if h == nil || h.runtime == nil || h.engine == nil {

backend/internal/server/handlers_user_lobby_games.go

@@ -86,6 +86,15 @@ func (h *UserLobbyGamesHandlers) Create() gin.HandlerFunc {
 			return
 		}
 		ctx := c.Request.Context()
+		paid, err := h.svc.IsPaid(ctx, userID)
+		if err != nil {
+			respondLobbyError(c, h.logger, "user lobby games create", ctx, err)
+			return
+		}
+		if !paid {
+			httperr.Abort(c, http.StatusForbidden, httperr.CodeForbidden, "creating private games requires a paid subscription")
+			return
+		}
 		owner := userID
 		game, err := h.svc.CreateGame(ctx, lobby.CreateGameInput{
 			OwnerUserID: &owner,

backend/internal/server/router.go

@@ -81,6 +81,13 @@ type RouterDependencies struct {
 	AdminGeo *AdminGeoHandlers
 	InternalSessions *InternalSessionsHandlers
 	InternalUsers *InternalUsersHandlers
+
+	// AdminConsole, when non-nil, mounts the server-rendered operator
+	// console under the `/_gm` route group behind the same admin Basic
+	// Auth verifier as `/api/v1/admin`. A nil value leaves the console
+	// unmounted, which keeps routers built without console wiring (the
+	// contract test, most unit tests) unchanged.
+	AdminConsole *AdminConsoleHandlers
 }
 
 // NewRouter constructs the backend gin engine wired with the documented
@@ -123,6 +130,7 @@ func NewRouter(deps RouterDependencies) (http.Handler, error) {
 	registerUserRoutes(router, instruments, deps)
 	registerAdminRoutes(router, instruments, deps)
 	registerInternalRoutes(router, instruments, deps)
+	registerAdminConsoleRoutes(router, deps)
 
 	router.NoMethod(func(c *gin.Context) {
 		if allow := allowedMethodsForPath(c.Request.URL.Path); allow != "" {
@@ -270,7 +278,6 @@ func registerUserRoutes(router *gin.Engine, instruments *metrics.Instruments, de
 	raceNames.POST("/register", deps.UserLobbyRaceNames.Register())
 
 	userGames := group.Group("/games")
-	userGames.POST("/:game_id/commands", deps.UserGames.Commands())
 	userGames.POST("/:game_id/orders", deps.UserGames.Orders())
 	userGames.GET("/:game_id/orders", deps.UserGames.GetOrders())
 	userGames.GET("/:game_id/reports/:turn", deps.UserGames.Report())
@@ -365,6 +372,57 @@ func registerInternalRoutes(router *gin.Engine, instruments *metrics.Instruments
 	users.GET("/:user_id/account-internal", deps.InternalUsers.GetAccountInternal())
 }
 
+// registerAdminConsoleRoutes mounts the server-rendered operator console under
+// `/_gm` when deps.AdminConsole is wired. The group reuses the same admin Basic
+// Auth verifier as `/api/v1/admin`; the CSRF guard then protects every
+// state-changing request. A nil AdminConsole leaves the surface unmounted.
+func registerAdminConsoleRoutes(router *gin.Engine, deps RouterDependencies) {
+	if deps.AdminConsole == nil {
+		return
+	}
+
+	group := router.Group("/_gm")
+	group.Use(basicauth.Middleware(deps.AdminVerifier, adminBasicAuthRealm))
+	group.Use(deps.AdminConsole.RequireCSRF())
+
+	group.GET("/assets/*filepath", deps.AdminConsole.Asset())
+	group.GET("", deps.AdminConsole.Dashboard())
+	group.GET("/", deps.AdminConsole.Dashboard())
+
+	group.GET("/users", deps.AdminConsole.UsersList())
+	group.GET("/users/:user_id", deps.AdminConsole.UserDetail())
+	group.POST("/users/:user_id/block", deps.AdminConsole.UserBlock())
+	group.POST("/users/:user_id/entitlement", deps.AdminConsole.UserEntitlement())
+	group.POST("/users/:user_id/soft-delete", deps.AdminConsole.UserSoftDelete())
+
+	group.GET("/games", deps.AdminConsole.GamesList())
+	group.POST("/games", deps.AdminConsole.GameCreate())
+	group.GET("/games/:game_id", deps.AdminConsole.GameDetail())
+	group.POST("/games/:game_id/force-start", deps.AdminConsole.GameForceStart())
+	group.POST("/games/:game_id/force-stop", deps.AdminConsole.GameForceStop())
+	group.POST("/games/:game_id/ban-member", deps.AdminConsole.GameBanMember())
+	group.POST("/games/:game_id/runtime/restart", deps.AdminConsole.RuntimeRestart())
+	group.POST("/games/:game_id/runtime/patch", deps.AdminConsole.RuntimePatch())
+	group.POST("/games/:game_id/runtime/force-next-turn", deps.AdminConsole.RuntimeForceNextTurn())
+
+	group.GET("/engine-versions", deps.AdminConsole.EngineVersionsList())
+	group.POST("/engine-versions", deps.AdminConsole.EngineVersionRegister())
+	group.POST("/engine-versions/:version/disable", deps.AdminConsole.EngineVersionDisable())
+
+	group.GET("/operators", deps.AdminConsole.OperatorsList())
+	group.POST("/operators", deps.AdminConsole.OperatorCreate())
+	group.POST("/operators/:username/disable", deps.AdminConsole.OperatorDisable())
+	group.POST("/operators/:username/enable", deps.AdminConsole.OperatorEnable())
+	group.POST("/operators/:username/reset-password", deps.AdminConsole.OperatorResetPassword())
+
+	group.GET("/mail", deps.AdminConsole.MailPage())
+	group.GET("/mail/deliveries/:delivery_id", deps.AdminConsole.MailDeliveryDetail())
+	group.POST("/mail/deliveries/:delivery_id/resend", deps.AdminConsole.MailResend())
+	group.GET("/notifications", deps.AdminConsole.NotificationsPage())
+	group.GET("/broadcast", deps.AdminConsole.BroadcastForm())
+	group.POST("/broadcast", deps.AdminConsole.BroadcastSend())
+}
+
 // allowedMethodsForPath returns the comma-separated list of methods
 // the gin router accepts on requestPath. Only the probe paths declare
 // a non-empty list so NoMethod can advertise a useful `Allow` header

backend/openapi.yaml

@@ -265,7 +265,12 @@ paths:
       summary: Create a new private lobby game owned by the caller
       description: |
         Always emits a `private` game owned by `X-User-ID`. Public games
-        are created via `POST /api/v1/admin/games`.
+        are created via `POST /api/v1/admin/games`. The endpoint is
+        gated by the caller's paid tier: free-tier accounts receive
+        `403 forbidden` (code `forbidden`) and no `draft` row is
+        created. The tier is read through
+        `EntitlementProvider.IsPaid(userID)` from the user-domain
+        service.
       security:
         - UserHeader: []
       parameters:
@@ -285,6 +290,8 @@ paths:
                 $ref: "#/components/schemas/LobbyGameDetail"
         "400":
           $ref: "#/components/responses/InvalidRequestError"
+        "403":
+          $ref: "#/components/responses/ForbiddenError"
         "501":
           $ref: "#/components/responses/NotImplementedError"
         "500":
@@ -974,37 +981,6 @@ paths:
           $ref: "#/components/responses/NotImplementedError"
         "500":
           $ref: "#/components/responses/InternalError"
-  /api/v1/user/games/{game_id}/commands:
-    post:
-      tags: [User]
-      operationId: userGamesCommands
-      summary: Forward an engine command batch
-      security:
-        - UserHeader: []
-      parameters:
-        - $ref: "#/components/parameters/XUserID"
-        - $ref: "#/components/parameters/GameID"
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/EngineCommand"
-      responses:
-        "200":
-          description: Engine command result passed through.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/PassthroughObject"
-        "400":
-          $ref: "#/components/responses/InvalidRequestError"
-        "404":
-          $ref: "#/components/responses/NotFoundError"
-        "501":
-          $ref: "#/components/responses/NotImplementedError"
-        "500":
-          $ref: "#/components/responses/InternalError"
   /api/v1/user/games/{game_id}/orders:
     post:
       tags: [User]
@@ -3531,14 +3507,6 @@ components:
       properties:
         name:
           type: string
-    EngineCommand:
-      type: object
-      additionalProperties: true
-      description: |
-        Engine command request body. The schema is permissive because the
-        engine proxy passes the body through verbatim; the typed shape
-        lives in `pkg/model/rest.Command` and is enforced by
-        `internal/engineclient` before the engine call leaves backend.
     EngineOrder:
       type: object
       additionalProperties: true

client/README.md

@@ -1,10 +0,0 @@
-# Client for Galaxy Plus
-
-UI Client is capable of:
-
-- Register a new player and login for an existing player using only e-mail and one-time codes,
-- Enlist to a new Game from available onboard Games list,
-- Request list of Games in which Player participating,
-- Request, store and display particular Game data,
-- Use push-like mechanism for receiving asynchronous updates from Server,
-- Offline mode when no internet connection is available or user desired to work offline.

client/appmeta/meta.go

@@ -1,10 +0,0 @@
-// Package appmeta provides shared application metadata used by both the
-// bootstrap loader process and the standalone UI client process.
-package appmeta
-
-const (
-	// AppID is the shared Fyne application identifier used for a common storage root.
-	AppID = "GalaxyPlus"
-	// DefaultBackendURL is the default backend HTTP endpoint used by local runs.
-	DefaultBackendURL = "http://127.0.0.1:8080"
-)

client/background.go

@@ -1,116 +0,0 @@
-package client
-
-import (
-	"fmt"
-	"time"
-
-	gerr "galaxy/error"
-)
-
-var (
-	checkConnectionInterval = 5 * time.Second
-	checkVersionInterval    = time.Hour
-	statePersistInterval    = time.Second
-)
-
-func (e *client) startBackground() {
-	if e.conn == nil || e.updater == nil {
-		return
-	}
-
-	go e.backgroundLoop()
-}
-
-func (e *client) stopBackground() {
-	e.backgroundOnce.Do(func() {
-		close(e.backgroundStop)
-	})
-}
-
-func (e *client) backgroundLoop() {
-	checkConnTimer := time.NewTimer(checkConnectionInterval)
-	checkVersionTimer := time.NewTimer(checkVersionInterval)
-	persistStateTimer := time.NewTimer(statePersistInterval)
-	defer func() {
-		checkConnTimer.Stop()
-		checkVersionTimer.Stop()
-		persistStateTimer.Stop()
-	}()
-
-	for {
-		select {
-		case <-e.backgroundStop:
-			return
-		case <-checkConnTimer.C:
-			if e.conn != nil {
-				e.OnConnection(e.conn.CheckConnection())
-			}
-			checkConnTimer.Reset(checkConnectionInterval)
-		case <-checkVersionTimer.C:
-			if e.updater != nil {
-				if err := e.updater.CheckAndPrepareLatest(); err != nil {
-					e.handlerError(err)
-				}
-			}
-			checkVersionTimer.Reset(checkVersionInterval)
-		case <-persistStateTimer.C:
-			e.ensureStatePersist()
-			persistStateTimer.Reset(statePersistInterval)
-		}
-	}
-}
-
-func (e *client) ensureStatePersist() {
-	param := e.GetParams()
-	needSaving := false
-	e.stateMu.Lock()
-	if e.world != nil {
-		if param.CameraZoom > 0 && param.CameraZoom != e.state.CameraZoom {
-			e.state.CameraZoom = param.CameraZoom
-			needSaving = true
-		}
-		if param.CameraXWorldFp != e.state.CameraXFp {
-			e.state.CameraXFp = param.CameraXWorldFp
-			needSaving = true
-		}
-		if param.CameraYWorldFp != e.state.CameraYFp {
-			e.state.CameraYFp = param.CameraYWorldFp
-			needSaving = true
-		}
-	}
-	if e.mapSplitter != nil && e.mapSplitter.Offset != e.state.MapSplitterOffset {
-		e.state.MapSplitterOffset = e.mapSplitter.Offset
-		needSaving = true
-	}
-	if e.accInfo.Open != e.state.AccordionInfoOpen {
-		e.state.AccordionInfoOpen = e.accInfo.Open
-		needSaving = true
-	}
-	if e.accCalc.Open != e.state.AccordionCalcOpen {
-		e.state.AccordionCalcOpen = e.accCalc.Open
-		needSaving = true
-	}
-	if needSaving {
-		if err := e.s.SaveState(*e.state); err != nil {
-			e.handlerError(err)
-		}
-	}
-	e.stateMu.Unlock()
-}
-
-func (e *client) handlerError(err error) {
-	if err == nil {
-		return
-	}
-
-	fmt.Printf("ERROR: %s\n", err)
-
-	switch {
-	case gerr.IsConnection(err):
-		e.OnConnectionError(err)
-	case gerr.IsStorage(err):
-		e.OnStorageError(err)
-	default:
-		e.OnServiceError(err)
-	}
-}

client/background_test.go

@@ -1,39 +0,0 @@
-package client
-
-import (
-	"errors"
-	"testing"
-
-	gerr "galaxy/error"
-	"github.com/stretchr/testify/require"
-)
-
-func TestHandlerErrorDispatchesByClass(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name      string
-		err       error
-		wantEvent string
-	}{
-		{name: "connection", err: gerr.WrapConnection(errors.New("dial")), wantEvent: "connection"},
-		{name: "storage", err: gerr.WrapStorage(errors.New("write file")), wantEvent: "storage"},
-		{name: "service", err: gerr.WrapService(errors.New("bad response")), wantEvent: "service"},
-		{name: "unclassified defaults to service", err: errors.New("plain"), wantEvent: "service"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var got string
-			c := &client{
-				onConnectionErrFn: func(error) { got = "connection" },
-				onStorageErrFn:    func(error) { got = "storage" },
-				onServiceErrFn:    func(error) { got = "service" },
-			}
-
-			c.handlerError(tt.err)
-
-			require.Equal(t, tt.wantEvent, got)
-		})
-	}
-}

client/canvas.go

@@ -1,101 +0,0 @@
-package client
-
-import (
-	"image/color"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/canvas"
-	"fyne.io/fyne/v2/widget"
-)
-
-type interactiveRaster struct {
-	widget.BaseWidget
-
-	min        fyne.Size
-	raster     *canvas.Raster
-	onLayout   func(fyne.Size)
-	onScrolled func(*fyne.ScrollEvent)
-	onDragged  func(*fyne.DragEvent)
-	onDragEnd  func()
-	onTapped   func(*fyne.PointEvent)
-}
-
-func (r *interactiveRaster) SetMinSize(size fyne.Size) {
-	r.min = size
-	r.Resize(size)
-}
-
-func (r *interactiveRaster) MinSize() fyne.Size {
-	return r.min
-}
-
-func (r *interactiveRaster) CreateRenderer() fyne.WidgetRenderer {
-	return &rasterWidgetRender{
-		canvas:   r,
-		bg:       canvas.NewRasterWithPixels(bgPattern),
-		onLayout: r.onLayout,
-	}
-}
-
-// Tapped is a left-click event
-func (r *interactiveRaster) Tapped(ev *fyne.PointEvent) {
-	if r.onTapped == nil {
-		return
-	}
-	r.onTapped(ev)
-}
-
-// TappedSecondary is a right-click event
-func (r *interactiveRaster) TappedSecondary(*fyne.PointEvent) {}
-
-func newInteractiveRaster(
-	raster *canvas.Raster,
-	onLayout func(fyne.Size),
-	onScrolled func(*fyne.ScrollEvent),
-	onDragged func(*fyne.DragEvent),
-	onDragEnd func(),
-	onTapped func(*fyne.PointEvent),
-) *interactiveRaster {
-	r := &interactiveRaster{
-		raster:     raster,
-		onLayout:   onLayout,
-		onScrolled: onScrolled,
-		onDragged:  onDragged,
-		onDragEnd:  onDragEnd,
-		onTapped:   onTapped,
-	}
-	r.ExtendBaseWidget(r)
-	return r
-}
-
-func bgPattern(x, y, _, _ int) color.Color {
-	const boxSize = 25
-
-	if (x/boxSize)%2 == (y/boxSize)%2 {
-		return color.Gray{Y: 58}
-	}
-
-	return color.Gray{Y: 84}
-}
-
-func (r *interactiveRaster) Scrolled(e *fyne.ScrollEvent) {
-	if r.onScrolled == nil {
-		return
-	}
-	r.onScrolled(e)
-}
-
-func (r *interactiveRaster) Dragged(e *fyne.DragEvent) {
-	if r.onDragged == nil {
-		return
-	}
-
-	r.onDragged(e)
-}
-
-func (r *interactiveRaster) DragEnd() {
-	if r.onDragEnd == nil {
-		return
-	}
-	r.onDragEnd()
-}

client/client.go

@@ -1,289 +0,0 @@
-package client
-
-import (
-	"image"
-	"sync"
-
-	"galaxy/client/updater"
-	"galaxy/client/widget/calculator"
-	"galaxy/client/world"
-	"galaxy/connector"
-	mc "galaxy/model/client"
-	"galaxy/storage"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/canvas"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/lang"
-	"fyne.io/fyne/v2/theme"
-	"fyne.io/fyne/v2/widget"
-)
-
-const version = "1.0.0"
-
-type client struct {
-	s      storage.Storage
-	conn   connector.Connector
-	app    fyne.App
-	window fyne.Window
-
-	state   *mc.State
-	stateMu sync.RWMutex
-
-	reg *registry
-
-	calculator  *calculator.Calculator
-	mapSplitter *container.Split
-	accInfo     *widget.AccordionItem
-	accCalc     *widget.AccordionItem
-
-	// loadReportFunc func(uint)
-
-	world  *world.World
-	drawer *world.GGDrawer
-	raster *canvas.Raster
-	co     *RasterCoalescer[world.RenderParams]
-	pan    *PanController
-
-	// Protected camera/options state (UI-facing). This is the "base" params snapshot.
-	// Viewport/margins are NOT stored here; they come from raster draw callback.
-	mu          sync.RWMutex
-	wp          *world.RenderParams
-	canvasScale float32
-
-	// Latest raster geometry metadata for correct event->pixel conversion:
-	// - logical size: raster.Size() (Fyne units)
-	// - pixel size: last (wPx,hPx) passed to draw callback
-	metaMu           sync.RWMutex
-	lastRasterLogicW float32
-	lastRasterLogicH float32
-	lastRasterPxW    int
-	lastRasterPxH    int
-	lastCanvasScale  float32 // optional, useful for debugging
-
-	// Snapshot of params actually used for the last render (includes viewport/margins).
-	// Used for HitTest and to keep UI interactions consistent with what the user sees.
-	lastRenderedMu     sync.RWMutex
-	lastRenderedParams world.RenderParams
-
-	// Indexing / backing-canvas caches (owned by client because it depends on UI geometry)
-	lastIndexedViewportW int
-	lastIndexedViewportH int
-	lastIndexedZoomFp    int
-
-	lastCanvasW int
-	lastCanvasH int
-
-	viewportImg *image.RGBA
-	viewportW   int
-	viewportH   int
-
-	hits []world.Hit
-
-	updater        *updater.Manager
-	backgroundStop chan struct{}
-	backgroundOnce sync.Once
-
-	onConnectionFn    func(bool)
-	onConnectionErrFn func(error)
-	onStorageErrFn    func(error)
-	onServiceErrFn    func(error)
-}
-
-func NewClient(s storage.Storage, conn connector.Connector, app fyne.App) (mc.Client, error) {
-	e := &client{
-		s:               s,
-		conn:            conn,
-		app:             app,
-		window:          app.NewWindow("Galaxy Plus"),
-		reg:             newRegistry(),
-		lastCanvasScale: 1.0,
-		world:           nil,
-		hits:            make([]world.Hit, 5),
-		backgroundStop:  make(chan struct{}),
-	}
-	e.calculator = calculator.NewCaclulator(calculator.WithCreateHandler(e.createShipClass))
-	e.updater = updater.NewManager(e.s, e.conn)
-
-	stateExists, err := e.s.StateExists()
-	if err != nil {
-		return nil, err
-	}
-	if stateExists {
-		state, err := e.s.LoadState()
-		if err != nil {
-			return nil, err
-		}
-		e.state = &state
-	} else {
-		e.state = &mc.State{
-			ClientCurrentVersion: e.Version(),
-			CameraZoom:           1.0,
-			MapSplitterOffset:    0.5,
-			AccordionInfoOpen:    false,
-			AccordionCalcOpen:    false,
-		}
-		if err := e.s.SaveState(*e.state); err != nil {
-			return nil, err
-		}
-	}
-	if e.state.CameraZoom <= 0 {
-		e.state.CameraZoom = 1.0
-	}
-	if e.state.MapSplitterOffset <= 0 {
-		e.state.MapSplitterOffset = 0.5
-	}
-	e.wp = &world.RenderParams{
-		Options:        &world.RenderOptions{DisableWrapScroll: false},
-		CameraZoom:     e.state.CameraZoom,
-		CameraXWorldFp: e.state.CameraXFp,
-		CameraYWorldFp: e.state.CameraYFp,
-	}
-
-	e.drawer = &world.GGDrawer{DC: nil}
-
-	e.raster = canvas.NewRaster(func(wPx, hPx int) image.Image {
-		return e.draw(wPx, hPx)
-	})
-
-	e.pan = NewPanController(e)
-
-	e.co = NewRasterCoalescer(
-		FyneExecutor{},
-		e.raster,
-		func(wPx, hPx int, p world.RenderParams) image.Image {
-			return e.renderRasterImage(wPx, hPx, p)
-		},
-	)
-
-	return e, nil
-}
-
-func (e *client) BuildUI(w fyne.Window) {
-	mapCanvasObject := newInteractiveRaster(e.raster, e.onRasterWidgetLayout, e.onScrolled, e.onDragged, e.onDradEnd, e.onTapped)
-
-	toolbar := widget.NewToolbar(
-		widget.NewToolbarAction(
-			theme.FolderIcon(),
-			func() { e.initReportAsync("GAME_ID", 0) }),
-		widget.NewToolbarSeparator(),
-		widget.NewToolbarAction(
-			theme.NavigateBackIcon(),
-			func() {}),
-		widget.NewToolbarAction(
-			theme.NavigateNextIcon(),
-			func() {}),
-	)
-
-	e.accInfo = widget.NewAccordionItem(lang.L("title.info"), container.NewStack())
-	e.accInfo.Open = e.state.AccordionInfoOpen
-	e.accCalc = widget.NewAccordionItem(lang.L("title.calculator"), e.calculator.CanvasObject)
-	e.accCalc.Open = e.state.AccordionCalcOpen
-
-	accordion := widget.NewAccordion()
-	accordion.MultiOpen = true
-	accordion.Append(e.accCalc)
-	accordion.Append(e.accInfo)
-
-	e.mapSplitter = container.NewHSplit(mapCanvasObject, container.NewHScroll(accordion))
-	e.mapSplitter.SetOffset(e.state.MapSplitterOffset)
-
-	tabs := container.NewAppTabs(
-		container.NewTabItemWithIcon(
-			lang.L("title.map"),
-			theme.GridIcon(),
-			e.mapSplitter),
-		container.NewTabItemWithIcon(
-			"Calculator",
-			theme.ComputerIcon(),
-			container.NewStack(widget.NewButton("Calc", func() {})),
-		),
-	)
-
-	th := tabs.Theme()
-	icon := canvas.NewImageFromResource(th.Icon(theme.IconNameInfo))
-
-	statusLeft := widget.NewTextGridFromString("Status")
-	statusAd := widget.NewTextGridFromString("")
-
-	statusBar := container.NewBorder(
-		nil, // top
-		nil, // bottom
-		container.NewHBox(statusLeft, widget.NewSeparator()), // left
-		container.NewHBox(widget.NewSeparator(), icon),       // right
-		statusAd, // center
-	)
-
-	content := container.NewBorder(
-		toolbar,   // top
-		statusBar, // bottom
-		nil,       // left
-		nil,       // right
-		tabs,      // center
-	)
-
-	w.CenterOnScreen()
-	w.SetContent(content)
-	s := statusBar.Size()
-	icon.SetMinSize(fyne.NewSize(s.Height, s.Height))
-	e.initLatestReport()
-}
-
-func (e *client) loadWorld(w *world.World) {
-	if w == nil {
-		return
-	}
-	w.SetCircleRadiusScaleFp(world.SCALE / 1000)
-	e.world = w
-	// TODO: store camera position in user settings
-	e.wp.CameraXWorldFp = w.W / 2
-	e.wp.CameraYWorldFp = w.H / 2
-	e.world.SetTheme(world.ThemeDark)
-
-	e.RequestRefresh()
-}
-
-func (e *client) Run() error {
-	e.BuildUI(e.window)
-	e.startBackground()
-	e.RequestRefresh()
-	e.window.SetMaster()
-	e.window.Resize(fyne.NewSize(800, 600))
-	e.window.CenterOnScreen()
-	e.window.SetOnClosed(e.Shutdown)
-	e.window.ShowAndRun()
-	return nil
-}
-
-func (e *client) Shutdown() {
-	e.stopBackground()
-	e.ensureStatePersist()
-	e.window.Close()
-}
-
-// TODO: remove func?
-func (e *client) Version() string { return version }
-
-func (e *client) OnConnection(isGood bool) {
-	if e.onConnectionFn != nil {
-		e.onConnectionFn(isGood)
-	}
-}
-
-func (e *client) OnConnectionError(err error) {
-	if e.onConnectionErrFn != nil {
-		e.onConnectionErrFn(err)
-	}
-}
-
-func (e *client) OnStorageError(err error) {
-	if e.onStorageErrFn != nil {
-		e.onStorageErrFn(err)
-	}
-}
-
-func (e *client) OnServiceError(err error) {
-	if e.onServiceErrFn != nil {
-		e.onServiceErrFn(err)
-	}
-}

client/client_test.go

@@ -1,227 +0,0 @@
-package client
-
-import (
-	"image"
-	"sync"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-type testExecutor struct {
-	mu    sync.Mutex
-	queue []func()
-}
-
-func (e *testExecutor) Post(fn func()) {
-	e.mu.Lock()
-	e.queue = append(e.queue, fn)
-	e.mu.Unlock()
-}
-
-func (e *testExecutor) FlushAll() {
-	for {
-		var fn func()
-		e.mu.Lock()
-		if len(e.queue) > 0 {
-			fn = e.queue[0]
-			e.queue = e.queue[1:]
-		}
-		e.mu.Unlock()
-		if fn == nil {
-			return
-		}
-		fn()
-	}
-}
-
-type testRefresher struct {
-	mu    sync.Mutex
-	count int
-}
-
-func (r *testRefresher) Refresh() {
-	r.mu.Lock()
-	r.count++
-	r.mu.Unlock()
-}
-
-func (r *testRefresher) Count() int {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.count
-}
-
-func TestRasterCoalescer_RequestBeforeDraw_CoalescesToLatest(t *testing.T) {
-	t.Parallel()
-
-	exec := &testExecutor{}
-	ref := &testRefresher{}
-
-	var got []int
-
-	co := NewRasterCoalescer(exec, ref, func(w, h int, p int) image.Image {
-		got = append(got, p)
-		return image.NewRGBA(image.Rect(0, 0, w, h))
-	})
-
-	co.Request(1)
-	co.Request(2)
-	co.Request(3)
-
-	// Only a single refresh should be scheduled before the next Draw().
-	exec.FlushAll()
-	require.Equal(t, 1, ref.Count())
-
-	_ = co.Draw(10, 10)
-	require.Equal(t, []int{3}, got)
-}
-
-func TestRasterCoalescer_RequestDuringDraw_SchedulesOneFollowUpRefresh(t *testing.T) {
-	t.Parallel()
-
-	exec := &testExecutor{}
-	ref := &testRefresher{}
-	var got []int
-
-	var co *RasterCoalescer[int]
-	co = NewRasterCoalescer(exec, ref, func(w, h int, p int) image.Image {
-		got = append(got, p)
-		if p == 1 {
-			co.Request(2)
-			co.Request(3)
-		}
-		return image.NewRGBA(image.Rect(0, 0, w, h))
-	})
-
-	co.Request(1)
-
-	exec.FlushAll()
-	require.Equal(t, 1, ref.Count())
-
-	// First draw renders 1 and schedules exactly one additional refresh.
-	_ = co.Draw(10, 10)
-	exec.FlushAll()
-	require.Equal(t, 2, ref.Count())
-
-	// Second draw renders latest (3).
-	_ = co.Draw(10, 10)
-	require.Equal(t, []int{1, 3}, got)
-}
-
-func TestRasterCoalescer_ManyRequestsWhileDrawing_StillOnlyOneExtraRefresh(t *testing.T) {
-	t.Parallel()
-
-	exec := &testExecutor{}
-	ref := &testRefresher{}
-	var got []int
-
-	var co *RasterCoalescer[int]
-	co = NewRasterCoalescer(exec, ref, func(w, h int, p int) image.Image {
-		got = append(got, p)
-		if p == 1 {
-			for i := 2; i <= 50; i++ {
-				co.Request(i)
-			}
-		}
-		return image.NewRGBA(image.Rect(0, 0, w, h))
-	})
-
-	co.Request(1)
-	exec.FlushAll()
-	require.Equal(t, 1, ref.Count())
-
-	_ = co.Draw(10, 10)
-	exec.FlushAll()
-	require.Equal(t, 2, ref.Count())
-
-	_ = co.Draw(10, 10)
-	require.Equal(t, []int{1, 50}, got)
-}
-
-func TestCopyViewportRGBA_CopiesROIAndIsIndependentFromSource(t *testing.T) {
-	t.Parallel()
-
-	src := image.NewRGBA(image.Rect(0, 0, 20, 20))
-	dst := image.NewRGBA(image.Rect(0, 0, 5, 6))
-
-	// Fill src with a pattern: pixel (x,y) has RGBA = (x, y, 0, 255).
-	for y := 0; y < 20; y++ {
-		for x := 0; x < 20; x++ {
-			off := y*src.Stride + x*4
-			src.Pix[off+0] = byte(x)
-			src.Pix[off+1] = byte(y)
-			src.Pix[off+2] = 0
-			src.Pix[off+3] = 255
-		}
-	}
-
-	marginX, marginY := 7, 9
-	copyViewportRGBA(dst, src, marginX, marginY, 5, 6)
-
-	// Verify a few pixels in dst match the expected source ROI.
-	// dst(0,0) == src(marginX, marginY)
-	{
-		off := 0*dst.Stride + 0*4
-		require.Equal(t, byte(marginX), dst.Pix[off+0])
-		require.Equal(t, byte(marginY), dst.Pix[off+1])
-		require.Equal(t, byte(255), dst.Pix[off+3])
-	}
-	// dst(4,5) == src(marginX+4, marginY+5)
-	{
-		off := 5*dst.Stride + 4*4
-		require.Equal(t, byte(marginX+4), dst.Pix[off+0])
-		require.Equal(t, byte(marginY+5), dst.Pix[off+1])
-		require.Equal(t, byte(255), dst.Pix[off+3])
-	}
-
-	// Mutate src ROI after copy and ensure dst is unchanged (no aliasing).
-	{
-		off := (marginY+0)*src.Stride + (marginX+0)*4
-		src.Pix[off+0] = 200
-		src.Pix[off+1] = 201
-		src.Pix[off+3] = 123
-	}
-
-	offDst := 0*dst.Stride + 0*4
-	require.Equal(t, byte(marginX), dst.Pix[offDst+0])
-	require.Equal(t, byte(marginY), dst.Pix[offDst+1])
-	require.Equal(t, byte(255), dst.Pix[offDst+3])
-}
-
-func TestEventPosToPixel_FloorMapping(t *testing.T) {
-	t.Parallel()
-
-	e := &client{}
-
-	// Pretend raster logical is 100x50, pixel is 1000x500.
-	e.metaMu.Lock()
-	e.lastRasterLogicW = 100
-	e.lastRasterLogicH = 50
-	e.lastRasterPxW = 1000
-	e.lastRasterPxH = 500
-	e.metaMu.Unlock()
-
-	x, y, ok := e.eventPosToPixel(0, 0)
-	require.True(t, ok)
-	require.Equal(t, 0, x)
-	require.Equal(t, 0, y)
-
-	// Middle
-	x, y, ok = e.eventPosToPixel(50, 25)
-	require.True(t, ok)
-	require.Equal(t, 500, x)
-	require.Equal(t, 250, y)
-
-	// Near max logical should map near max pixel with floor.
-	x, y, ok = e.eventPosToPixel(99.9, 49.9)
-	require.True(t, ok)
-	require.GreaterOrEqual(t, x, 998)
-	require.GreaterOrEqual(t, y, 498)
-
-	// Clamp
-	x, y, ok = e.eventPosToPixel(-10, 999)
-	require.True(t, ok)
-	require.Equal(t, 0, x)
-	require.Equal(t, 500, y)
-}

client/cmd/loader/main.go

@@ -1,53 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"galaxy/client"
-	"galaxy/client/appmeta"
-	"galaxy/client/loader"
-	"galaxy/connector/http"
-	"galaxy/storage/fs"
-	"os"
-	"os/signal"
-
-	"fyne.io/fyne/v2/app"
-	"fyne.io/fyne/v2/lang"
-)
-
-func main() {
-	var err error
-	defer func() {
-		if err == nil {
-			if r := recover(); r != nil {
-				err = errors.Join(err, fmt.Errorf("panic: %v", r))
-			}
-		}
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-	}()
-
-	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
-	defer cancel()
-
-	app := app.NewWithID(appmeta.AppID)
-	if err = lang.AddTranslationsFS(client.Translations, "resource/lang"); err != nil {
-		return
-	}
-	s, err := fs.NewFS(app.Storage().RootURI().Path())
-	if err != nil {
-		return
-	}
-	c, err := http.NewHttpConnector(ctx, appmeta.DefaultBackendURL)
-	if err != nil {
-		return
-	}
-	l, err := loader.NewLoader(s, c, app)
-	if err != nil {
-		return
-	}
-	err = l.Run(ctx)
-}

client/cmd/ui/main.go

@@ -1,51 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"galaxy/client"
-	"galaxy/client/appmeta"
-	"galaxy/connector/http"
-	"galaxy/storage/fs"
-	"os"
-	"os/signal"
-
-	"fyne.io/fyne/v2/app"
-	"fyne.io/fyne/v2/lang"
-)
-
-func main() {
-	var err error
-	defer func() {
-		if err == nil {
-			if r := recover(); r != nil {
-				err = errors.Join(err, fmt.Errorf("panic: %v", r))
-			}
-		}
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-	}()
-	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
-	defer cancel()
-
-	app := app.NewWithID(appmeta.AppID)
-	if err = lang.AddTranslationsFS(client.Translations, "resource/lang"); err != nil {
-		return
-	}
-	s, err := fs.NewFS(app.Storage().RootURI().Path())
-	if err != nil {
-		return
-	}
-	conn, err := http.NewHttpConnector(ctx, appmeta.DefaultBackendURL)
-	if err != nil {
-		return
-	}
-	c, err := client.NewClient(s, conn, app)
-	if err != nil {
-		return
-	}
-	err = c.Run()
-}

client/coalesce.go

@@ -1,133 +0,0 @@
-package client
-
-/*
-Fyne-friendly latest-wins coalescing for canvas.NewRaster(draw func(w,h int) image.Image).
-
-Key property:
-- draw() renders at most once per invocation (never loops).
-- if new requests arrived while drawing, we schedule exactly one extra Refresh.
-*/
-
-import (
-	"image"
-	"sync"
-)
-
-// UIExecutor posts a function to run on the UI/main thread.
-type UIExecutor interface {
-	Post(fn func())
-}
-
-// Refresher is the minimal interface we need from fyne.CanvasObject / Raster.
-type Refresher interface {
-	Refresh()
-}
-
-// RasterRenderer renders the latest params and returns an image.
-// Must be called on the UI thread (inside draw callback).
-type RasterRenderer[P any] func(wPx, hPx int, params P) image.Image
-
-// RasterCoalescer implements latest-wins coalescing for raster rendering.
-// It is designed specifically for toolkits like fyne where the system calls draw(w,h)
-// and expects a returned image.
-type RasterCoalescer[P any] struct {
-	exec      UIExecutor
-	refresher Refresher
-	renderer  RasterRenderer[P]
-
-	mu sync.Mutex
-
-	// inDraw == true while Draw() is running on UI thread.
-	inDraw bool
-
-	// refreshQueued == true when we have already posted a Refresh() that has not yet
-	// resulted in a Draw() call (or is expected to call Draw soon).
-	refreshQueued bool
-
-	// pending == true when new params arrived while inDraw==true.
-	// Draw() will schedule exactly one follow-up Refresh after it returns.
-	pending bool
-
-	latest P
-	have   bool
-}
-
-// NewRasterCoalescer creates a new coalescer.
-// - exec.Post must run fn on UI thread.
-// - refresher.Refresh will trigger the framework to call draw(w,h).
-func NewRasterCoalescer[P any](exec UIExecutor, refresher Refresher, renderer RasterRenderer[P]) *RasterCoalescer[P] {
-	if exec == nil {
-		panic("RasterCoalescer: nil executor")
-	}
-	if refresher == nil {
-		panic("RasterCoalescer: nil refresher")
-	}
-	if renderer == nil {
-		panic("RasterCoalescer: nil renderer")
-	}
-	return &RasterCoalescer[P]{exec: exec, refresher: refresher, renderer: renderer}
-}
-
-// Request stores the latest params and schedules exactly one refresh (latest-wins).
-// Can be called from any goroutine.
-func (c *RasterCoalescer[P]) Request(params P) {
-	c.mu.Lock()
-	c.latest = params
-	c.have = true
-
-	// If we are currently inside Draw(), don't schedule refresh immediately.
-	// Just mark pending; Draw() will schedule one follow-up refresh after it returns.
-	if c.inDraw {
-		c.pending = true
-		c.mu.Unlock()
-		return
-	}
-
-	// Not drawing. Schedule at most one refresh until the next Draw() happens.
-	if c.refreshQueued {
-		c.mu.Unlock()
-		return
-	}
-
-	c.refreshQueued = true
-	c.mu.Unlock()
-
-	c.exec.Post(c.refresher.Refresh)
-}
-
-// Draw must be called from the raster draw callback on the UI thread.
-// It renders exactly once with the latest snapshot.
-// If more requests arrived while drawing, it schedules exactly one extra refresh.
-func (c *RasterCoalescer[P]) Draw(wPx, hPx int) image.Image {
-	c.mu.Lock()
-	// A Draw call corresponds to a previously scheduled refresh being serviced.
-	c.refreshQueued = false
-
-	if !c.have {
-		c.mu.Unlock()
-		return image.NewRGBA(image.Rect(0, 0, wPx, hPx))
-	}
-
-	c.inDraw = true
-	c.pending = false
-	params := c.latest
-	c.mu.Unlock()
-
-	img := c.renderer(wPx, hPx, params)
-
-	c.mu.Lock()
-	needAnother := c.pending
-	c.pending = false
-	c.inDraw = false
-
-	// If we need another frame, schedule exactly one refresh (if not already queued).
-	if needAnother && !c.refreshQueued {
-		c.refreshQueued = true
-		c.mu.Unlock()
-		c.exec.Post(c.refresher.Refresh)
-		return img
-	}
-
-	c.mu.Unlock()
-	return img
-}

client/embed.go

@@ -1,6 +0,0 @@
-package client
-
-import "embed"
-
-//go:embed resource/lang
-var Translations embed.FS

client/go.mod

@@ -1,46 +0,0 @@
-module galaxy/client
-
-go 1.26.0
-
-require (
-	fyne.io/fyne/v2 v2.7.3
-	github.com/fogleman/gg v1.3.0
-	github.com/stretchr/testify v1.11.1
-)
-
-require (
-	fyne.io/systray v1.12.0 // indirect
-	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/fredbi/uri v1.1.1 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fyne-io/gl-js v0.2.0 // indirect
-	github.com/fyne-io/glfw-js v0.3.0 // indirect
-	github.com/fyne-io/image v0.1.1 // indirect
-	github.com/fyne-io/oksvg v0.2.0 // indirect
-	github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 // indirect
-	github.com/go-gl/glfw/v3.3/glfw v0.0.0-20250301202403-da16c1255728 // indirect
-	github.com/go-text/render v0.2.0 // indirect
-	github.com/go-text/typesetting v0.3.3 // indirect
-	github.com/godbus/dbus/v5 v5.2.2 // indirect
-	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
-	github.com/hack-pad/go-indexeddb v0.3.2 // indirect
-	github.com/hack-pad/safejs v0.1.1 // indirect
-	github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade // indirect
-	github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
-	github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
-	github.com/nicksnyder/go-i18n/v2 v2.6.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/rymdport/portal v0.4.2 // indirect
-	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c // indirect
-	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef // indirect
-	github.com/yuin/goldmark v1.7.16 // indirect
-	golang.org/x/image v0.36.0 // indirect
-	golang.org/x/net v0.53.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-)

client/go.sum

@@ -1,82 +0,0 @@
-fyne.io/fyne/v2 v2.7.3 h1:xBT/iYbdnNHONWO38fZMBrVBiJG8rV/Jypmy4tVfRWE=
-fyne.io/fyne/v2 v2.7.3/go.mod h1:gu+dlIcZWSzKZmnrY8Fbnj2Hirabv2ek+AKsfQ2bBlw=
-fyne.io/systray v1.12.0 h1:CA1Kk0e2zwFlxtc02L3QFSiIbxJ/P0n582YrZHT7aTM=
-fyne.io/systray v1.12.0/go.mod h1:RVwqP9nYMo7h5zViCBHri2FgjXF7H2cub7MAq4NSoLs=
-github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
-github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
-github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
-github.com/fogleman/gg v1.3.0 h1:/7zJX8F6AaYQc57WQCyN9cAIz+4bCJGO9B+dyW29am8=
-github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
-github.com/fredbi/uri v1.1.1 h1:xZHJC08GZNIUhbP5ImTHnt5Ya0T8FI2VAwI/37kh2Ko=
-github.com/fredbi/uri v1.1.1/go.mod h1:4+DZQ5zBjEwQCDmXW5JdIjz0PUA+yJbvtBv+u+adr5o=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fyne-io/gl-js v0.2.0 h1:+EXMLVEa18EfkXBVKhifYB6OGs3HwKO3lUElA0LlAjs=
-github.com/fyne-io/gl-js v0.2.0/go.mod h1:ZcepK8vmOYLu96JoxbCKJy2ybr+g1pTnaBDdl7c3ajI=
-github.com/fyne-io/glfw-js v0.3.0 h1:d8k2+Y7l+zy2pc7wlGRyPfTgZoqDf3AI4G+2zOWhWUk=
-github.com/fyne-io/glfw-js v0.3.0/go.mod h1:Ri6te7rdZtBgBpxLW19uBpp3Dl6K9K/bRaYdJ22G8Jk=
-github.com/fyne-io/image v0.1.1 h1:WH0z4H7qfvNUw5l4p3bC1q70sa5+YWVt6HCj7y4VNyA=
-github.com/fyne-io/image v0.1.1/go.mod h1:xrfYBh6yspc+KjkgdZU/ifUC9sPA5Iv7WYUBzQKK7JM=
-github.com/fyne-io/oksvg v0.2.0 h1:mxcGU2dx6nwjJsSA9PCYZDuoAcsZ/OuJlvg/Q9Njfo8=
-github.com/fyne-io/oksvg v0.2.0/go.mod h1:dJ9oEkPiWhnTFNCmRgEze+YNprJF7YRbpjgpWS4kzoI=
-github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 h1:5BVwOaUSBTlVZowGO6VZGw2H/zl9nrd3eCZfYV+NfQA=
-github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71/go.mod h1:9YTyiznxEY1fVinfM7RvRcjRHbw2xLBJ3AAGIT0I4Nw=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20250301202403-da16c1255728 h1:RkGhqHxEVAvPM0/R+8g7XRwQnHatO0KAuVcwHo8q9W8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20250301202403-da16c1255728/go.mod h1:SyRD8YfuKk+ZXlDqYiqe1qMSqjNgtHzBTG810KUagMc=
-github.com/go-text/render v0.2.0 h1:LBYoTmp5jYiJ4NPqDc2pz17MLmA3wHw1dZSVGcOdeAc=
-github.com/go-text/render v0.2.0/go.mod h1:CkiqfukRGKJA5vZZISkjSYrcdtgKQWRa2HIzvwNN5SU=
-github.com/go-text/typesetting v0.3.3 h1:ihGNJU9KzdK2QRDy1Bm7FT5RFQoYb+3n3EIhI/4eaQc=
-github.com/go-text/typesetting v0.3.3/go.mod h1:vIRUT25mLQaSh4C8H/lIsKppQz/Gdb8Pu/tNwpi52ts=
-github.com/go-text/typesetting-utils v0.0.0-20250618110550-c820a94c77b8 h1:4KCscI9qYWMGTuz6BpJtbUSRzcBrUSSE0ENMJbNSrFs=
-github.com/go-text/typesetting-utils v0.0.0-20250618110550-c820a94c77b8/go.mod h1:3/62I4La/HBRX9TcTpBj4eipLiwzf+vhI+7whTc9V7o=
-github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
-github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
-github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
-github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
-github.com/google/pprof v0.0.0-20211214055906-6f57359322fd h1:1FjCyPC+syAzJ5/2S8fqdZK1R22vvA0J7JZKcuOIQ7Y=
-github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
-github.com/hack-pad/go-indexeddb v0.3.2 h1:DTqeJJYc1usa45Q5r52t01KhvlSN02+Oq+tQbSBI91A=
-github.com/hack-pad/go-indexeddb v0.3.2/go.mod h1:QvfTevpDVlkfomY498LhstjwbPW6QC4VC/lxYb0Kom0=
-github.com/hack-pad/safejs v0.1.1 h1:d5qPO0iQ7h2oVtpzGnLExE+Wn9AtytxIfltcS2b9KD8=
-github.com/hack-pad/safejs v0.1.1/go.mod h1:HdS+bKF1NrE72VoXZeWzxFOVQVUSqZJAG0xNCnb+Tio=
-github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade h1:FmusiCI1wHw+XQbvL9M+1r/C3SPqKrmBaIOYwVfQoDE=
-github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade/go.mod h1:ZDXo8KHryOWSIqnsb/CiDq7hQUYryCgdVnxbj8tDG7o=
-github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 h1:YLvr1eE6cdCqjOe972w/cYF+FjW34v27+9Vo5106B4M=
-github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25/go.mod h1:kLgvv7o6UM+0QSf0QjAse3wReFDsb9qbZJdfexWlrQw=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
-github.com/nicksnyder/go-i18n/v2 v2.6.1 h1:JDEJraFsQE17Dut9HFDHzCoAWGEQJom5s0TRd17NIEQ=
-github.com/nicksnyder/go-i18n/v2 v2.6.1/go.mod h1:Vee0/9RD3Quc/NmwEjzzD7VTZ+Ir7QbXocrkhOzmUKA=
-github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
-github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rymdport/portal v0.4.2 h1:7jKRSemwlTyVHHrTGgQg7gmNPJs88xkbKcIL3NlcmSU=
-github.com/rymdport/portal v0.4.2/go.mod h1:kFF4jslnJ8pD5uCi17brj/ODlfIidOxlgUDTO5ncnC4=
-github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c h1:km8GpoQut05eY3GiYWEedbTT0qnSxrCjsVbb7yKY1KE=
-github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c/go.mod h1:cNQ3dwVJtS5Hmnjxy6AgTPd0Inb3pW05ftPSX7NZO7Q=
-github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef h1:Ch6Q+AZUxDBCVqdkI8FSpFyZDtCVBc2VmejdNrm5rRQ=
-github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef/go.mod h1:nXTWP6+gD5+LUJ8krVhhoeHjvHTutPxMYl5SvkcnJNE=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/yuin/goldmark v1.7.16 h1:n+CJdUxaFMiDUNnWC3dMWCIQJSkxH4uz3ZwQBkAlVNE=
-github.com/yuin/goldmark v1.7.16/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/image v0.36.0 h1:Iknbfm1afbgtwPTmHnS2gTM/6PPZfH+z2EFuOkSbqwc=
-golang.org/x/image v0.36.0/go.mod h1:YsWD2TyyGKiIX1kZlu9QfKIsQ4nAAK9bdgdrIsE7xy4=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

client/hit.go

@@ -1,61 +0,0 @@
-package client
-
-import (
-	"galaxy/client/world"
-
-	"fyne.io/fyne/v2"
-)
-
-var m = func(v int) float64 { return float64(v) / float64(world.SCALE) }
-
-func (e *client) onTapped(ev *fyne.PointEvent) {
-	if e.world == nil || ev == nil {
-		return
-	}
-
-	xPx, yPx, ok := e.eventPosToPixel(ev.Position.X, ev.Position.Y)
-	if !ok {
-		return
-	}
-
-	params := e.getLastRenderedParams()
-	hits, err := e.world.HitTest(e.hits, &params, xPx, yPx)
-	if err != nil {
-		e.handlerError(err)
-		return
-	}
-
-	if len(hits) == 0 {
-		e.calculator.UnloadPlanet()
-		return
-	}
-
-	for i := range hits {
-		e.onHit(hits[i])
-	}
-}
-
-func (e *client) onHit(hit world.Hit) {
-	// var coord string
-	// if hit.Kind == world.KindLine {
-	// 	coord = fmt.Sprintf("{%f,%f - %f,%f}", m(hit.X1), m(hit.Y1), m(hit.X2), m(hit.Y2))
-	// } else {
-	// 	coord = fmt.Sprintf("{%f,%f}", m(hit.X), m(hit.Y))
-	// }
-	// fmt.Println("hit:", hit.ID, "Coord:", coord)
-	switch hit.Kind {
-	case world.KindPoint:
-	case world.KindCircle:
-		e.onHitCircle(hit.ID)
-	case world.KindLine:
-	}
-}
-
-func (e *client) onHitCircle(id world.PrimitiveID) {
-	p, ok := e.reg.localPlanet(id)
-	if !ok {
-		return
-	}
-	e.calculator.LoadPlanet(p.Name, p.Number, p.FreeIndustry.F(), p.Material.F(), p.Resources.F())
-	e.calculator.Refresh()
-}

client/loader/loader.go

@@ -1,214 +0,0 @@
-package loader
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"sync"
-
-	"galaxy/client/updater"
-	"galaxy/connector"
-	"galaxy/storage"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/theme"
-	"fyne.io/fyne/v2/widget"
-)
-
-const (
-	loaderLogViewportColumns = 80
-	loaderLogViewportRows    = 12
-)
-
-type loader struct {
-	app         fyne.App
-	storage     storage.Storage
-	connector   connector.Connector
-	updater     *updater.Manager
-	runner      uiRunner
-	debugWindow fyne.Window
-	textGrid    *widget.TextGrid
-	btn         *widget.Button
-
-	ctx context.Context
-
-	resultMu sync.Mutex
-	result   error
-
-	closeMu    sync.Mutex
-	closeQuits bool
-}
-
-// loaderLogViewportMinSize derives a stable monospace TextGrid viewport size
-// from the active Fyne text metrics.
-func loaderLogViewportMinSize(app fyne.App) fyne.Size {
-	if app == nil || app.Driver() == nil {
-		return fyne.NewSize(0, 0)
-	}
-
-	cellSize, _ := app.Driver().RenderedTextSize(
-		"M",
-		theme.TextSize(),
-		fyne.TextStyle{Monospace: true},
-		nil,
-	)
-
-	return fyne.NewSize(
-		cellSize.Width*loaderLogViewportColumns,
-		cellSize.Height*loaderLogViewportRows,
-	)
-}
-
-func NewLoader(s storage.Storage, conn connector.Connector, app fyne.App) (*loader, error) {
-	l := &loader{
-		app:         app,
-		connector:   conn,
-		storage:     s,
-		updater:     updater.NewManager(s, conn),
-		runner:      execRunner{},
-		textGrid:    widget.NewTextGrid(),
-		debugWindow: app.NewWindow("Loader"),
-	}
-	l.btn = widget.NewButton("Retry", l.onButtonAction)
-	l.btn.Disable()
-	l.textGrid.Scroll = fyne.ScrollNone
-	l.debugWindow.SetCloseIntercept(l.onWindowClose)
-
-	logScroll := container.NewScroll(l.textGrid)
-	logScroll.Direction = container.ScrollBoth
-	logScroll.SetMinSize(loaderLogViewportMinSize(app))
-
-	actionBar := container.NewCenter(container.NewHBox(l.btn))
-
-	content := container.NewBorder(nil, actionBar, nil, nil, logScroll)
-	l.debugWindow.SetContent(content)
-	l.debugWindow.Resize(content.MinSize())
-	l.debugWindow.SetFixedSize(true)
-	l.debugWindow.CenterOnScreen()
-
-	return l, nil
-}
-
-func (l *loader) runOnce(ctx context.Context) error {
-	target, err := l.updater.EnsureLaunchTarget()
-	if err != nil {
-		return err
-	}
-
-	l.logText(fmt.Sprintf("Starting UI client v%s", target.Version))
-	l.logText(fmt.Sprintf("Executable: %s", target.Path))
-
-	exitCode, runErr := l.runner.Run(ctx, target.Path)
-	markErr := l.updater.MarkLaunchResult(target.Version, exitCode, runErr)
-
-	switch {
-	case runErr != nil:
-		return errors.Join(fmt.Errorf("launch UI client v%s: %w", target.Version, runErr), markErr)
-	case exitCode != 0:
-		return errors.Join(fmt.Errorf("UI client v%s exited with code %d", target.Version, exitCode), markErr)
-	default:
-		return markErr
-	}
-}
-
-// init prepares and launches the standalone UI client, or shows a retry button on failure.
-func (l *loader) init(ctx context.Context) {
-	l.setCloseQuits(false)
-	fyne.Do(func() {
-		l.textGrid.SetText("")
-		l.btn.Hide()
-		l.btn.Disable()
-		// show debugWindow can be done with future debug mode, e.g. with -debug flag
-		l.debugWindow.Hide()
-	})
-
-	err := l.runOnce(ctx)
-	if err == nil || errors.Is(err, context.Canceled) {
-		l.setResult(nil)
-		fyne.Do(func() {
-			l.debugWindow.Hide()
-			l.app.Quit()
-		})
-		return
-	}
-
-	l.setCloseQuits(true)
-	l.setResult(err)
-	l.logError(err)
-	fyne.Do(func() {
-		l.btn.SetText("Retry")
-		l.btn.Enable()
-		l.btn.Show()
-		l.debugWindow.Show()
-	})
-}
-
-func (l *loader) onButtonAction() {
-	if l.ctx == nil {
-		return
-	}
-	go l.init(l.ctx)
-}
-
-func (l *loader) onWindowClose() {
-	if l.getCloseQuits() {
-		l.app.Quit()
-		return
-	}
-
-	l.debugWindow.Hide()
-}
-
-func (l *loader) logText(v string) {
-	if l.textGrid == nil {
-		return
-	}
-	fyne.Do(func() { l.textGrid.Append(v) })
-}
-
-func (l *loader) logError(err error) {
-	l.logText(fmt.Sprintf("ERROR: %s", err))
-}
-
-func (l *loader) setResult(err error) {
-	l.resultMu.Lock()
-	defer l.resultMu.Unlock()
-	l.result = err
-}
-
-func (l *loader) getResult() error {
-	l.resultMu.Lock()
-	defer l.resultMu.Unlock()
-	return l.result
-}
-
-func (l *loader) setCloseQuits(v bool) {
-	l.closeMu.Lock()
-	defer l.closeMu.Unlock()
-	l.closeQuits = v
-}
-
-func (l *loader) getCloseQuits() bool {
-	l.closeMu.Lock()
-	defer l.closeMu.Unlock()
-	return l.closeQuits
-}
-
-// Run starts the loader window, launches the standalone UI process, and returns
-// the final launch result once the loader application exits.
-func (l *loader) Run(ctx context.Context) error {
-	l.ctx = ctx
-
-	go l.init(ctx)
-	go func() {
-		<-ctx.Done()
-		fyne.Do(l.app.Quit)
-	}()
-
-	l.app.Run()
-	if errors.Is(ctx.Err(), context.Canceled) {
-		return nil
-	}
-	return l.getResult()
-}

client/loader/loader_test.go

@@ -1,211 +0,0 @@
-package loader
-
-import (
-	"context"
-	"errors"
-	"path/filepath"
-	"testing"
-
-	"galaxy/client/updater"
-	"galaxy/connector"
-	mc "galaxy/model/client"
-	"galaxy/model/report"
-	"galaxy/storage"
-	"galaxy/storage/fs"
-
-	"github.com/stretchr/testify/require"
-)
-
-type stubConnector struct {
-	versions  []connector.VersionInfo
-	versionErr error
-	downloads map[string][]byte
-	downloadErr error
-}
-
-func (c *stubConnector) CheckConnection() bool {
-	return true
-}
-
-func (c *stubConnector) CheckVersion() ([]connector.VersionInfo, error) {
-	if c.versionErr != nil {
-		return nil, c.versionErr
-	}
-	return c.versions, nil
-}
-
-func (c *stubConnector) DownloadVersion(url string) ([]byte, error) {
-	if c.downloadErr != nil {
-		return nil, c.downloadErr
-	}
-	data, ok := c.downloads[url]
-	if !ok {
-		return nil, errors.New("missing download payload")
-	}
-	return data, nil
-}
-
-func (c *stubConnector) FetchReport(mc.GameID, uint, func(report.Report, error)) {}
-
-type stubRunner struct {
-	paths    []string
-	exitCode int
-	err      error
-}
-
-func (r *stubRunner) Run(_ context.Context, path string) (int, error) {
-	r.paths = append(r.paths, path)
-	return r.exitCode, r.err
-}
-
-func TestRunOnceFirstLaunchDownloadsAndPromotesVersion(t *testing.T) {
-	t.Parallel()
-
-	s := newTestStorage(t)
-	payload := []byte("ui-binary-1.2.3")
-	info := connector.VersionInfo{
-		OS:       "windows",
-		Arch:     "amd64",
-		Kind:     connector.ArtifactKindExecutable,
-		Version:  "1.2.3",
-		URL:      "https://example.com/ui-1.2.3.exe",
-		Checksum: connector.NewSHA256Digest(payload),
-	}
-	conn := &stubConnector{
-		versions:  []connector.VersionInfo{info},
-		downloads: map[string][]byte{info.URL: payload},
-	}
-	runner := &stubRunner{}
-	l := &loader{
-		storage:   s,
-		connector: conn,
-		updater:   updater.NewManager(s, conn, updater.WithPlatform("windows", "amd64")),
-		runner:    runner,
-	}
-
-	err := l.runOnce(context.Background())
-	require.NoError(t, err)
-
-	state, err := s.LoadState()
-	require.NoError(t, err)
-	require.Equal(t, "1.2.3", state.ClientCurrentVersion)
-	require.Nil(t, state.ClientNextVersion)
-
-	expectedPath := filepath.Join(s.StorageRoot(), updater.ArtifactPath("1.2.3", "windows", "amd64", connector.ArtifactKindExecutable))
-	require.Equal(t, []string{expectedPath}, runner.paths)
-}
-
-func TestRunOnceSpawnFailureClearsPendingAndKeepsCurrent(t *testing.T) {
-	t.Parallel()
-
-	s := newTestStorage(t)
-	currentPath := updater.ArtifactPath("1.0.0", "windows", "amd64", connector.ArtifactKindExecutable)
-	require.NoError(t, s.WriteFile(currentPath, []byte("current")))
-	require.NoError(t, s.SaveState(mc.State{ClientCurrentVersion: "1.0.0"}))
-
-	payload := []byte("ui-binary-1.1.0")
-	info := connector.VersionInfo{
-		OS:       "windows",
-		Arch:     "amd64",
-		Kind:     connector.ArtifactKindExecutable,
-		Version:  "1.1.0",
-		URL:      "https://example.com/ui-1.1.0.exe",
-		Checksum: connector.NewSHA256Digest(payload),
-	}
-	conn := &stubConnector{
-		versions:  []connector.VersionInfo{info},
-		downloads: map[string][]byte{info.URL: payload},
-	}
-	manager := updater.NewManager(s, conn, updater.WithPlatform("windows", "amd64"))
-	require.NoError(t, manager.CheckAndPrepareLatest())
-
-	l := &loader{
-		storage:   s,
-		connector: conn,
-		updater:   manager,
-		runner: &stubRunner{
-			err: errors.New("spawn failed"),
-		},
-	}
-
-	err := l.runOnce(context.Background())
-	require.Error(t, err)
-
-	state, err := s.LoadState()
-	require.NoError(t, err)
-	require.Equal(t, "1.0.0", state.ClientCurrentVersion)
-	require.Nil(t, state.ClientNextVersion)
-
-	currentExists, _, err := s.FileExists(currentPath)
-	require.NoError(t, err)
-	require.True(t, currentExists)
-
-	nextExists, _, err := s.FileExists(updater.ArtifactPath("1.1.0", "windows", "amd64", connector.ArtifactKindExecutable))
-	require.NoError(t, err)
-	require.False(t, nextExists)
-}
-
-func TestRunOnceNonZeroExitClearsPendingAndKeepsCurrent(t *testing.T) {
-	t.Parallel()
-
-	s := newTestStorage(t)
-	currentPath := updater.ArtifactPath("1.0.0", "windows", "amd64", connector.ArtifactKindExecutable)
-	require.NoError(t, s.WriteFile(currentPath, []byte("current")))
-	require.NoError(t, s.SaveState(mc.State{ClientCurrentVersion: "1.0.0"}))
-
-	payload := []byte("ui-binary-1.1.0")
-	info := connector.VersionInfo{
-		OS:       "windows",
-		Arch:     "amd64",
-		Kind:     connector.ArtifactKindExecutable,
-		Version:  "1.1.0",
-		URL:      "https://example.com/ui-1.1.0.exe",
-		Checksum: connector.NewSHA256Digest(payload),
-	}
-	conn := &stubConnector{
-		versions:  []connector.VersionInfo{info},
-		downloads: map[string][]byte{info.URL: payload},
-	}
-	manager := updater.NewManager(s, conn, updater.WithPlatform("windows", "amd64"))
-	require.NoError(t, manager.CheckAndPrepareLatest())
-
-	l := &loader{
-		storage:   s,
-		connector: conn,
-		updater:   manager,
-		runner: &stubRunner{
-			exitCode: 23,
-		},
-	}
-
-	err := l.runOnce(context.Background())
-	require.Error(t, err)
-
-	state, err := s.LoadState()
-	require.NoError(t, err)
-	require.Equal(t, "1.0.0", state.ClientCurrentVersion)
-	require.Nil(t, state.ClientNextVersion)
-
-	nextExists, _, err := s.FileExists(updater.ArtifactPath("1.1.0", "windows", "amd64", connector.ArtifactKindExecutable))
-	require.NoError(t, err)
-	require.False(t, nextExists)
-}
-
-func newTestStorage(t *testing.T) *testStorage {
-	t.Helper()
-
-	root := t.TempDir()
-	s, err := fs.NewFS(root)
-	require.NoError(t, err)
-
-	return &testStorage{Storage: s, root: root}
-}
-
-type testStorage struct {
-	storage.Storage
-	root string
-}
-
-func (s *testStorage) StorageRoot() string {
-	return s.root
-}

client/loader/loader_ui_test.go

@@ -1,181 +0,0 @@
-package loader
-
-import (
-	"fmt"
-	"testing"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	fynetest "fyne.io/fyne/v2/test"
-	"fyne.io/fyne/v2/theme"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewLoaderConfiguresWindowGeometry(t *testing.T) {
-	app := fynetest.NewApp()
-	spy := &spyApp{App: app}
-
-	l, err := NewLoader(newTestStorage(t), &stubConnector{}, spy)
-	require.NoError(t, err)
-
-	require.NotNil(t, spy.window)
-	require.Same(t, spy.window, l.debugWindow)
-	require.True(t, spy.window.setContentCalled)
-	require.True(t, spy.window.resizeCalled)
-	require.Equal(t, spy.window.content.MinSize(), spy.window.resizeSize)
-	require.True(t, spy.window.fixedSizeCalled)
-	require.True(t, spy.window.fixedSize)
-	require.True(t, spy.window.centerOnScreenCalled)
-}
-
-func TestNewLoaderBuildsScrollableBorderLayout(t *testing.T) {
-	app := fynetest.NewApp()
-
-	l, err := NewLoader(newTestStorage(t), &stubConnector{}, app)
-	require.NoError(t, err)
-
-	content, ok := l.debugWindow.Content().(*fyne.Container)
-	require.True(t, ok)
-	require.Equal(t, "*layout.borderLayout", fmt.Sprintf("%T", content.Layout))
-	require.Len(t, content.Objects, 2)
-
-	logScroll, ok := content.Objects[0].(*container.Scroll)
-	require.True(t, ok)
-	require.Same(t, l.textGrid, logScroll.Content)
-	require.Equal(t, container.ScrollBoth, logScroll.Direction)
-	require.Equal(t, loaderLogViewportMinSize(app), logScroll.MinSize())
-	require.Equal(t, fyne.ScrollNone, l.textGrid.Scroll)
-
-	actionBar, ok := content.Objects[1].(*fyne.Container)
-	require.True(t, ok)
-	require.Len(t, actionBar.Objects, 1)
-
-	actionRow, ok := actionBar.Objects[0].(*fyne.Container)
-	require.True(t, ok)
-	require.Len(t, actionRow.Objects, 1)
-	require.Same(t, l.btn, actionRow.Objects[0])
-
-	content.Resize(content.MinSize())
-
-	require.Equal(t, fyne.NewPos(0, 0), logScroll.Position())
-	require.Equal(t, content.Size().Width, logScroll.Size().Width)
-	require.Equal(
-		t,
-		content.Size().Height-actionBar.MinSize().Height-theme.Padding(),
-		logScroll.Size().Height,
-	)
-
-	require.Equal(
-		t,
-		fyne.NewPos(0, content.Size().Height-actionBar.MinSize().Height),
-		actionBar.Position(),
-	)
-	require.Equal(t, content.Size().Width, actionBar.Size().Width)
-	require.Equal(t, actionRow.MinSize().Width, actionRow.Size().Width)
-	require.Equal(t, l.btn.MinSize().Width, l.btn.Size().Width)
-	require.Equal(t, l.btn.MinSize().Height, l.btn.Size().Height)
-	require.Equal(t, (content.Size().Width-actionRow.Size().Width)/2, actionRow.Position().X)
-}
-
-func TestNewLoaderInterceptsWindowCloseByHidingWindow(t *testing.T) {
-	app := fynetest.NewApp()
-	spy := &spyApp{App: app}
-
-	l, err := NewLoader(newTestStorage(t), &stubConnector{}, spy)
-	require.NoError(t, err)
-
-	require.NotNil(t, spy.window)
-	require.Same(t, spy.window, l.debugWindow)
-	require.NotNil(t, spy.window.closeIntercept)
-
-	spy.window.closeIntercept()
-
-	require.Equal(t, 1, spy.window.hideCalls)
-	require.Zero(t, spy.window.closeCalls)
-	require.Zero(t, spy.quitCalls)
-}
-
-func TestLoaderWindowCloseQuitsApplicationAfterLaunchFailure(t *testing.T) {
-	app := fynetest.NewApp()
-	spy := &spyApp{App: app}
-
-	l, err := NewLoader(newTestStorage(t), &stubConnector{}, spy)
-	require.NoError(t, err)
-
-	l.setCloseQuits(true)
-	spy.window.closeIntercept()
-
-	require.Zero(t, spy.window.hideCalls)
-	require.Zero(t, spy.window.closeCalls)
-	require.Equal(t, 1, spy.quitCalls)
-}
-
-type spyApp struct {
-	fyne.App
-	window    *spyWindow
-	quitCalls int
-}
-
-func (a *spyApp) NewWindow(title string) fyne.Window {
-	a.window = &spyWindow{Window: a.App.NewWindow(title)}
-	return a.window
-}
-
-func (a *spyApp) Quit() {
-	a.quitCalls++
-	a.App.Quit()
-}
-
-type spyWindow struct {
-	fyne.Window
-
-	content              fyne.CanvasObject
-	closeIntercept       func()
-	resizeSize           fyne.Size
-	hideCalls            int
-	closeCalls           int
-	setContentCalled     bool
-	resizeCalled         bool
-	fixedSize            bool
-	fixedSizeCalled      bool
-	centerOnScreenCalled bool
-}
-
-func (w *spyWindow) CenterOnScreen() {
-	w.centerOnScreenCalled = true
-	w.Window.CenterOnScreen()
-}
-
-func (w *spyWindow) Close() {
-	w.closeCalls++
-	w.Window.Close()
-}
-
-func (w *spyWindow) Hide() {
-	w.hideCalls++
-	w.Window.Hide()
-}
-
-func (w *spyWindow) Resize(size fyne.Size) {
-	w.resizeCalled = true
-	w.resizeSize = size
-	w.Window.Resize(size)
-}
-
-func (w *spyWindow) SetContent(content fyne.CanvasObject) {
-	w.setContentCalled = true
-	w.content = content
-	w.Window.SetContent(content)
-}
-
-func (w *spyWindow) SetCloseIntercept(callback func()) {
-	w.closeIntercept = callback
-	w.Window.SetCloseIntercept(callback)
-}
-
-func (w *spyWindow) SetFixedSize(fixed bool) {
-	w.fixedSizeCalled = true
-	w.fixedSize = fixed
-	w.Window.SetFixedSize(fixed)
-}

client/loader/runner.go

@@ -1,34 +0,0 @@
-package loader
-
-import (
-	"context"
-	"errors"
-	"os"
-	"os/exec"
-)
-
-// uiRunner executes the standalone UI artifact and returns its exit code.
-type uiRunner interface {
-	Run(context.Context, string) (int, error)
-}
-
-type execRunner struct{}
-
-func (execRunner) Run(ctx context.Context, path string) (int, error) {
-	cmd := exec.CommandContext(ctx, path)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	cmd.Stdin = os.Stdin
-
-	err := cmd.Run()
-	if err == nil {
-		return 0, nil
-	}
-
-	var exitErr *exec.ExitError
-	if errors.As(err, &exitErr) {
-		return exitErr.ExitCode(), nil
-	}
-
-	return -1, err
-}

client/loader/util.go

@@ -1,14 +0,0 @@
-package loader
-
-import "crypto/sha256"
-
-// SumSHA256 calculates SHA-256 for the provided byte slice and returns
-// the raw 32-byte digest as a fixed-size array.
-func SumSHA256(data []byte) [32]byte {
-	return sha256.Sum256(data)
-}
-
-// EqualSHA256 returns true when both SHA-256 digests are identical.
-func EqualSHA256(a, b [32]byte) bool {
-	return a == b
-}

client/loader/util_test.go

@@ -1,56 +0,0 @@
-package loader
-
-import (
-	"crypto/sha256"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TestSumSHA256 verifies that SumSHA256 returns the same digest
-// as the standard library implementation for a non-empty payload.
-func TestSumSHA256(t *testing.T) {
-	t.Parallel()
-
-	data := []byte("hello world")
-	expected := sha256.Sum256(data)
-
-	actual := SumSHA256(data)
-
-	require.Equal(t, expected, actual)
-}
-
-// TestSumSHA256Empty verifies that SumSHA256 correctly handles
-// an empty byte slice.
-func TestSumSHA256Empty(t *testing.T) {
-	t.Parallel()
-
-	data := []byte{}
-	expected := sha256.Sum256(data)
-
-	actual := SumSHA256(data)
-
-	require.Equal(t, expected, actual)
-}
-
-// TestEqualSHA256Same verifies that two identical digests
-// are considered equal.
-func TestEqualSHA256Same(t *testing.T) {
-	t.Parallel()
-
-	data := []byte("hello")
-	digest := sha256.Sum256(data)
-
-	require.True(t, EqualSHA256(digest, digest))
-}
-
-// TestEqualSHA256Different verifies that different digests
-// are considered not equal.
-func TestEqualSHA256Different(t *testing.T) {
-	t.Parallel()
-
-	digestA := sha256.Sum256([]byte("hello"))
-	digestB := sha256.Sum256([]byte("world"))
-
-	require.False(t, EqualSHA256(digestA, digestB))
-}

client/mock.go

@@ -1,48 +0,0 @@
-package client
-
-import (
-	"image/color"
-
-	"galaxy/client/world"
-)
-
-func mockWorld() *world.World {
-	w := world.NewWorld(300, 300)
-	mockWorldInit(w)
-	return w
-}
-
-func mockWorldInit(w *world.World) {
-	lineStyle := w.AddStyleLine(world.StyleOverride{
-		StrokeColor:   color.RGBA{R: 0, G: 255, B: 0, A: 255},
-		StrokeWidthPx: new(3.0),
-		StrokeDashes:  new([]float64{10.}),
-	})
-
-	if _, err := w.AddCircle(150, 150, 50); err != nil {
-		panic(err)
-	}
-
-	if _, err := w.AddCircle(150, 299, 30); err != nil {
-		panic(err)
-	}
-	if _, err := w.AddCircle(299, 150, 30); err != nil {
-		panic(err)
-	}
-
-	if _, err := w.AddLine(100, 20, 200, 30, world.LineWithStyleID(lineStyle), world.LineWithPriority(500)); err != nil {
-		panic(err)
-	}
-
-	if _, err := w.AddLine(50, 50, 250, 100); err != nil {
-		panic(err)
-	}
-
-	if _, err := w.AddPoint(10, 10); err != nil {
-		panic(err)
-	}
-
-	if _, err := w.AddPoint(25, 255); err != nil {
-		panic(err)
-	}
-}

client/registry.go

@@ -1,76 +0,0 @@
-package client
-
-import (
-	"galaxy/client/world"
-	"galaxy/model/report"
-)
-
-const (
-	entityClassUnknown int = iota - 1
-	entityClassLocalPlanet
-	entityClassOthersPlanet
-	entityClassFreePlanet
-	entityClassUnidentifiedPlanet
-)
-
-type registry struct {
-	report                  *report.Report
-	localPlanetIndex        map[world.PrimitiveID]int
-	unidentifiedPlanetIndex map[world.PrimitiveID]int
-}
-
-func newRegistry() *registry {
-	return &registry{
-		localPlanetIndex:        make(map[world.PrimitiveID]int),
-		unidentifiedPlanetIndex: make(map[world.PrimitiveID]int),
-	}
-}
-
-func (r *registry) clear(report *report.Report) {
-	r.report = report
-	clear(r.localPlanetIndex)
-	clear(r.unidentifiedPlanetIndex)
-}
-
-func (r *registry) entityClass(id world.PrimitiveID) int {
-	if r.isLocalPlanet(id) {
-		return entityClassLocalPlanet
-	}
-	if r.isUnidentifiedPlanet(id) {
-		return entityClassUnidentifiedPlanet
-	}
-	return entityClassUnknown
-}
-
-func (r *registry) registerLocalPlanet(id world.PrimitiveID, index int) {
-	r.localPlanetIndex[id] = index
-}
-
-func (r *registry) isLocalPlanet(id world.PrimitiveID) bool {
-	_, ok := r.localPlanetIndex[id]
-	return ok
-}
-
-func (r *registry) localPlanet(id world.PrimitiveID) (*report.LocalPlanet, bool) {
-	i, ok := r.localPlanetIndex[id]
-	if !ok {
-		return nil, false
-	}
-	if i > len(r.report.LocalPlanet)-1 {
-		return nil, false
-	}
-	return &r.report.LocalPlanet[i], true
-}
-
-func (r *registry) registerUnidentifiedPlanet(id world.PrimitiveID, index int) {
-	r.unidentifiedPlanetIndex[id] = index
-}
-
-func (r *registry) isUnidentifiedPlanet(id world.PrimitiveID) bool {
-	_, ok := r.unidentifiedPlanetIndex[id]
-	return ok
-}
-
-func (c *client) createShipClass(n string, D float64, A uint, W float64, S float64, C float64) {
-
-}

client/report.go

@@ -1,119 +0,0 @@
-package client
-
-import (
-	"fmt"
-	"galaxy/client/widget/calculator"
-	"galaxy/client/world"
-	mc "galaxy/model/client"
-	"galaxy/model/report"
-	"slices"
-
-	"fyne.io/fyne/v2"
-)
-
-func (e *client) initLatestReport() {
-	e.stateMu.Lock()
-	if e.state.ActiveGameID != nil {
-		if stateIdx := slices.IndexFunc(e.state.GameState, func(gs mc.GameState) bool { return gs.ID == *e.state.ActiveGameID }); stateIdx >= 0 {
-			e.initReportAsync(*e.state.ActiveGameID, e.state.GameState[stateIdx].ActiveTurn)
-		}
-	}
-	e.stateMu.Unlock()
-}
-
-func (e *client) initReportAsync(gid mc.GameID, t uint) {
-	e.s.ReportExistsAsync(gid, t, func(b bool, err error) { e.reportAtStorageExists(gid, t, b, err) })
-}
-
-func (e *client) reportAtStorageExists(gid mc.GameID, t uint, exists bool, err error) {
-	if err != nil {
-		e.handlerError(err)
-		return
-	}
-	if exists {
-		e.s.LoadReportAsync(gid, t, func(r report.Report, err error) { e.loadReportHandler(gid, r, err) })
-		return
-	}
-	e.conn.FetchReport(gid, t, func(r report.Report, err error) { e.fetchReportHandler(gid, r, err) })
-}
-
-func (e *client) fetchReportHandler(gid mc.GameID, r report.Report, err error) {
-	if err != nil {
-		e.handlerError(err)
-		return
-	}
-
-	e.s.SaveReportAsync(gid, r.Turn, r, func(err error) { e.loadReportHandler(gid, r, err) })
-}
-
-func (e *client) loadReportHandler(gid mc.GameID, r report.Report, err error) {
-	if err != nil {
-		e.handlerError(err)
-		return
-	}
-
-	e.stateMu.Lock()
-	needSaveState := false
-	stateIdx := slices.IndexFunc(e.state.GameState, func(gs mc.GameState) bool { return gs.ID == gid })
-	if stateIdx < 0 {
-		e.state.GameState = append(e.state.GameState, mc.GameState{ID: gid, LastTurn: r.Turn, ActiveTurn: r.Turn})
-		stateIdx = len(e.state.GameState) - 1
-		needSaveState = true
-	}
-	if e.state.ActiveGameID == nil {
-		e.state.ActiveGameID = new(gid)
-		needSaveState = true
-	}
-	if e.state.GameState[stateIdx].LastTurn < r.Turn {
-		e.state.GameState[stateIdx].LastTurn = r.Turn
-		e.state.GameState[stateIdx].ActiveTurn = r.Turn
-		needSaveState = true
-	}
-	if needSaveState {
-		if err := e.s.SaveState(*e.state); err != nil {
-			e.handlerError(err)
-			return
-		}
-	}
-	e.stateMu.Unlock()
-
-	e.setReport(r)
-}
-
-func (e *client) setReport(r report.Report) {
-	w := world.NewWorld(int(r.Width), int(r.Height))
-	e.reg.clear(&r)
-	for i := range r.LocalPlanet {
-		p := r.LocalPlanet[i]
-		id, err := w.AddCircle(p.X.F(), p.Y.F(), p.Size.F(), world.CircleWithClass(world.CircleClassLocalPlanet))
-		if err != nil {
-			e.handlerError(err)
-			return
-		}
-		e.reg.registerLocalPlanet(id, i)
-	}
-	for i := range r.UnidentifiedPlanet {
-		p := r.UnidentifiedPlanet[i]
-		id, err := w.AddPoint(p.X.F(), p.Y.F(), world.PointWithClass(world.PointClassTrackIncoming))
-		if err != nil {
-			e.handlerError(err)
-			return
-		}
-		e.reg.registerUnidentifiedPlanet(id, i)
-	}
-	e.loadWorld(w)
-
-	selfIdx := slices.IndexFunc(r.Player, func(p report.Player) bool { return p.Name == r.Race })
-	if selfIdx >= 0 {
-		fyne.Do(func() {
-			e.calculator.Init(
-				calculator.WithPlayerDrives(r.Player[selfIdx].Drive.F()),
-				calculator.WithPlayerWeapons(r.Player[selfIdx].Weapons.F()),
-				calculator.WithPlayerShields(r.Player[selfIdx].Shields.F()),
-				calculator.WithPlayerCargo(r.Player[selfIdx].Cargo.F()),
-			)
-		})
-	} else {
-		e.OnServiceError(fmt.Errorf("race %q not found at report players list", r.Race))
-	}
-}

client/resource/lang/en.json

@@ -1,30 +0,0 @@
-{
-    "title": {
-        "map": "Map",
-        "calculator": "Ship Calculator",
-        "info": "Info"
-    },
-    "planet": {
-        "title": "Planet #{{.Number}} '{{.Name}}' production fot this ship:",
-        "mat": "Materials",
-        "prod.mass": "Prod. Mass",
-        "prod.ships": "Ships"
-    },
-    "tech": {
-        "d": "Drive",
-        "w": "Weapons",
-        "s": "Shields",
-        "c": "Cargo"
-    },
-    "ship": {
-        "action.create": "Create",
-        "mass": "Mass",
-        "speed": "Speed",
-        "attack": "Attack",
-        "defense": "Defense",
-        "load": "Load"
-    },
-    "label": {
-        "max": "Max."
-    }
-}

client/ui.go

@@ -1,334 +0,0 @@
-package client
-
-import (
-	"image"
-	"math"
-
-	"galaxy/client/world"
-
-	"fyne.io/fyne/v2"
-	"github.com/fogleman/gg"
-)
-
-/*
-Fyne integration notes:
-
-- canvas.NewRaster calls draw(w,h) on the UI thread.
-- We MUST keep draw() cheap and never loop re-rendering inside it.
-- Coalescing must therefore schedule refreshes and render at most once per draw call.
-- The world renderer expects:
-  - RenderParams.ViewportWidthPx/HeightPx: the size of the visible viewport.
-  - RenderParams.MarginXPx/MarginYPx: margins around viewport.
-  - RenderParams.CameraXWorldFp/YWorldFp: camera center in world-fixed units.
-  - RenderParams.CameraZoom: float zoom (converted inside world).
-- world.Render draws on the full expanded canvas (viewport + 2*margins on each axis).
-
-This adapter enforces:
-- viewport sizes come from draw(w,h)
-- margins are computed from viewport sizes (w/4 and h/4)
-- gg context backing image is resized to the expanded canvas size
-- IndexOnViewportChange is called when viewport sizes changed (you can also include zoom if desired)
-*/
-
-var (
-	blankImage image.Image = image.NewRGBA(image.Rect(0, 0, 0, 0))
-)
-
-// FyneExecutor posts functions onto the Fyne UI thread.
-type FyneExecutor struct{}
-
-func (FyneExecutor) Post(fn func()) {
-	fyne.Do(fn)
-}
-
-// GetParams returns a copy of current render params for external reads.
-func (e *client) GetParams() world.RenderParams {
-	e.mu.RLock()
-	defer e.mu.RUnlock()
-	return *e.wp
-}
-
-// UpdateParams applies a modification function to render params and schedules a refresh.
-// This is a safe way to mutate camera/zoom from event handlers.
-func (e *client) UpdateParams(fn func(p *world.RenderParams)) {
-	e.mu.Lock()
-	fn(e.wp)
-	p := *e.wp
-	e.mu.Unlock()
-
-	e.co.Request(p)
-}
-
-// RequestRefresh schedules a refresh with the current params snapshot.
-// Useful if you changed world objects and want to redraw.
-func (e *client) RequestRefresh() {
-	e.mu.RLock()
-	p := *e.wp
-	e.mu.RUnlock()
-	e.co.Request(p)
-}
-
-// draw is the raster callback. It must be cheap and must not block on multiple re-renders.
-// It delegates coalescing + rendering decision to RasterCoalescer.
-func (e *client) draw(wPx, hPx int) image.Image {
-	return e.co.Draw(wPx, hPx)
-}
-
-// renderRasterImage renders the expanded canvas into the GGDrawer backing image,
-// then copies only the viewport ROI into a reusable viewport buffer and returns it.
-func (e *client) renderRasterImage(viewportW, viewportH int, p world.RenderParams) image.Image {
-	if e.world == nil {
-		return image.NewRGBA(image.Rect(0, 0, 0, 0))
-	}
-
-	// Keep the incoming zoom snapshot so we can safely sync corrected zoom back
-	// to base params only when no newer zoom was written concurrently.
-	inputZoom := p.CameraZoom
-
-	// Record current raster pixel size (used for event coordinate conversion).
-	e.metaMu.Lock()
-	e.lastRasterPxW = viewportW
-	e.lastRasterPxH = viewportH
-	e.metaMu.Unlock()
-
-	// Fill viewport/margins derived from draw callback.
-	p.ViewportWidthPx = viewportW
-	p.ViewportHeightPx = viewportH
-	p.MarginXPx = viewportW / 4
-	p.MarginYPx = viewportH / 4
-
-	// Correct zoom for viewport/world constraints, and clamp camera for no-wrap.
-	correctedZoom := e.world.CorrectCameraZoom(inputZoom, viewportW, viewportH)
-	p.CameraZoom = correctedZoom
-
-	// Sync corrected zoom to the canonical UI-facing params snapshot.
-	// Guard prevents stale render snapshots from overwriting a newer zoom value
-	// that may have been set by another UI event.
-	e.mu.Lock()
-	if e.wp.CameraZoom == inputZoom {
-		e.wp.CameraZoom = correctedZoom
-	}
-	e.mu.Unlock()
-
-	// Ensure indexing is up-to-date when viewport size or zoom changes.
-	zoomFp, err := p.CameraZoomFp()
-	if err == nil {
-		if viewportW != e.lastIndexedViewportW || viewportH != e.lastIndexedViewportH || zoomFp != e.lastIndexedZoomFp {
-			e.world.IndexOnViewportChange(viewportW, viewportH, p.CameraZoom)
-			e.lastIndexedViewportW = viewportW
-			e.lastIndexedViewportH = viewportH
-			e.lastIndexedZoomFp = zoomFp
-		}
-	}
-
-	e.world.ClampRenderParamsNoWrap(&p)
-
-	// Ensure backing expanded canvas (gg context) is sized properly.
-	canvasW := p.CanvasWidthPx()
-	canvasH := p.CanvasHeightPx()
-	e.ensureDrawerCanvas(canvasW, canvasH)
-
-	// Render into expanded canvas backing.
-	_ = e.world.Render(e.drawer, p) // TODO: handle error
-
-	// Save snapshot of params actually used for this render (for HitTest consistency).
-	e.lastRenderedMu.Lock()
-	e.lastRenderedParams = p
-	e.lastRenderedMu.Unlock()
-
-	// Copy viewport ROI into reusable viewport buffer and return it.
-	e.ensureViewportBuffer(viewportW, viewportH)
-
-	src, ok := e.drawer.DC.Image().(*image.RGBA)
-	if !ok || src == nil {
-		return image.NewRGBA(image.Rect(0, 0, viewportW, viewportH))
-	}
-
-	copyViewportRGBA(e.viewportImg, src, p.MarginXPx, p.MarginYPx, viewportW, viewportH)
-	return e.viewportImg
-}
-
-// ensureDrawerCanvas ensures drawer has a gg.Context sized to canvasW x canvasH.
-func (e *client) ensureDrawerCanvas(canvasW, canvasH int) {
-	if e.drawer.DC != nil && e.lastCanvasW == canvasW && e.lastCanvasH == canvasH {
-		return
-	}
-	// world.NewGGContextRGBA should return *gg.Context backed by *image.RGBA (gg.NewContext does).
-	e.drawer.DC = NewGGContextRGBA(canvasW, canvasH)
-	e.lastCanvasW = canvasW
-	e.lastCanvasH = canvasH
-}
-
-func (e *client) ensureViewportBuffer(w, h int) {
-	if e.viewportImg != nil && e.viewportW == w && e.viewportH == h {
-		return
-	}
-	e.viewportImg = image.NewRGBA(image.Rect(0, 0, w, h))
-	e.viewportW = w
-	e.viewportH = h
-}
-
-func (e *client) getLastRenderedParams() world.RenderParams {
-	e.lastRenderedMu.RLock()
-	defer e.lastRenderedMu.RUnlock()
-	return e.lastRenderedParams
-}
-
-// eventPosToPixel converts event logical coordinates (Fyne units) into pixel coordinates,
-// using the last known raster logical size and the last draw callback pixel size.
-//
-// pixelX = floor(eventX * rasterPixelWidth / rasterLogicalWidth)
-func (e *client) eventPosToPixel(eventX, eventY float32) (xPx, yPx int, ok bool) {
-	e.metaMu.RLock()
-	logW := e.lastRasterLogicW
-	logH := e.lastRasterLogicH
-	pxW := e.lastRasterPxW
-	pxH := e.lastRasterPxH
-	e.metaMu.RUnlock()
-
-	if logW <= 0 || logH <= 0 || pxW <= 0 || pxH <= 0 {
-		return 0, 0, false
-	}
-
-	x := int(math.Floor(float64(eventX) * float64(pxW) / float64(logW)))
-	y := int(math.Floor(float64(eventY) * float64(pxH) / float64(logH)))
-
-	// Clamp to viewport bounds.
-	if x < 0 {
-		x = 0
-	} else if x > pxW {
-		x = pxW
-	}
-	if y < 0 {
-		y = 0
-	} else if y > pxH {
-		y = pxH
-	}
-	return x, y, true
-}
-
-func (e *client) CanvasScale() float32 {
-	e.metaMu.RLock()
-	defer e.metaMu.RUnlock()
-	if e.lastCanvasScale <= 0 {
-		return 1
-	}
-	return e.lastCanvasScale
-}
-
-func (e *client) ForceFullRedraw() {
-	if e.world == nil {
-		return
-	}
-	e.world.ForceFullRedrawNext()
-}
-
-func (e *client) onRasterWidgetLayout(fyne.Size) {
-	e.updateSizes()
-}
-
-// updateSizes updates only metadata we need for event->pixel conversion and schedules a redraw.
-// It must NOT try to compute pixel viewport sizes (those are known in raster draw callback).
-func (e *client) updateSizes() {
-	canvasObj := fyne.CurrentApp().Driver().CanvasForObject(e.raster)
-	if canvasObj == nil {
-		return
-	}
-
-	sz := e.raster.Size() // logical (Fyne units)
-	scale := canvasObj.Scale()
-
-	e.metaMu.Lock()
-	e.lastRasterLogicW = sz.Width
-	e.lastRasterLogicH = sz.Height
-	e.lastCanvasScale = scale
-	e.metaMu.Unlock()
-
-	e.RequestRefresh()
-}
-
-func (e *client) onDragged(ev *fyne.DragEvent) {
-	e.pan.Dragged(ev)
-}
-
-func (e *client) onDradEnd() {
-	e.pan.DragEnd()
-}
-
-func (e *client) onScrolled(s *fyne.ScrollEvent) {
-	if e.world == nil || s == nil {
-		return
-	}
-
-	// Use last rendered viewport sizes (pixel) for zoom logic.
-	e.metaMu.RLock()
-	vw := e.lastRasterPxW
-	vh := e.lastRasterPxH
-	e.metaMu.RUnlock()
-	if vw <= 0 || vh <= 0 {
-		return
-	}
-
-	cxPx, cyPx, ok := e.eventPosToPixel(s.Position.X, s.Position.Y)
-	if !ok {
-		return
-	}
-
-	e.mu.Lock()
-	oldZoom := e.wp.CameraZoom
-
-	// Exponential zoom factor; tune later.
-	const base = 1.005
-	delta := float64(s.Scrolled.DY)
-	newZoom := oldZoom * math.Pow(base, delta)
-
-	newZoom = e.world.CorrectCameraZoom(newZoom, vw, vh)
-	if newZoom == oldZoom {
-		e.mu.Unlock()
-		return
-	}
-
-	oldZoomFp, err := world.CameraZoomToWorldFixed(oldZoom)
-	if err != nil {
-		e.mu.Unlock()
-		return
-	}
-	newZoomFp, err := world.CameraZoomToWorldFixed(newZoom)
-	if err != nil {
-		e.mu.Unlock()
-		return
-	}
-
-	// Pivot zoom for no-wrap behavior.
-	newCamX, newCamY := world.PivotZoomCameraNoWrap(
-		e.wp.CameraXWorldFp, e.wp.CameraYWorldFp,
-		vw, vh,
-		cxPx, cyPx,
-		oldZoomFp, newZoomFp,
-	)
-
-	e.wp.CameraZoom = newZoom
-	e.wp.CameraXWorldFp = newCamX
-	e.wp.CameraYWorldFp = newCamY
-	e.mu.Unlock()
-
-	// Any zoom change should rebuild index and force full redraw.
-	e.world.ForceFullRedrawNext()
-	e.RequestRefresh()
-}
-
-// copyViewportRGBA copies a viewport rectangle from src RGBA into dst RGBA.
-// dst must be sized exactly (0,0)-(vw,vh). This is allocation-free.
-// It avoids SubImage aliasing issues: dst becomes independent from src backing memory.
-func copyViewportRGBA(dst, src *image.RGBA, marginX, marginY, vw, vh int) {
-	for y := 0; y < vh; y++ {
-		srcOff := (marginY+y)*src.Stride + marginX*4
-		dstOff := y * dst.Stride
-		n := vw * 4
-		copy(dst.Pix[dstOff:dstOff+n], src.Pix[srcOff:srcOff+n])
-	}
-}
-
-func NewGGContextRGBA(w, h int) *gg.Context {
-	return gg.NewContext(w, h)
-}

client/ui_drag.go

@@ -1,110 +0,0 @@
-package client
-
-import (
-	"math"
-
-	"fyne.io/fyne/v2"
-
-	"galaxy/client/world"
-)
-
-/*
-Client pan integration for Fyne Draggable:
-
-- DragEvent.Dragged provides per-event delta in Fyne logical units.
-- Client knows canvasScale (pixels per Fyne unit) and converts to pixels.
-- We update camera center in world-fixed (CameraXWorldFp/YWorldFp).
-
-Sign convention (map follows pointer):
-- Drag right (dxPx > 0): move world content right => move camera left => CameraXWorldFp -= dxWorldFp
-- Drag down  (dyPx > 0): move world content down  => move camera up   => CameraYWorldFp -= dyWorldFp
-*/
-
-// draggableClient is the minimal interface we need from your client implementation.
-// If your Client already has these methods/fields, you can fold the code directly into it.
-type draggableClient interface {
-	// CanvasScale returns pixels per Fyne logical unit.
-	CanvasScale() float32
-
-	// UpdateParams applies a mutation and schedules refresh through your coalescer.
-	UpdateParams(fn func(p *world.RenderParams))
-
-	// RequestRefresh schedules a refresh with current params (no mutation).
-	RequestRefresh()
-
-	// ForceFullRedraw forces a full redraw on next Render (used on DragEnd).
-	ForceFullRedraw()
-}
-
-// PanController holds per-drag transient state.
-type PanController struct {
-	ed draggableClient
-
-	dragging bool
-	lastFx   float32 // last absolute position in Fyne units
-	lastFy   float32
-
-	// Remainders to keep subpixel fyne->px conversion stable across many events.
-	remPxX float32
-	remPxY float32
-}
-
-func NewPanController(ed draggableClient) *PanController {
-	return &PanController{ed: ed}
-}
-
-// Dragged processes one drag event, updates camera center by delta, and schedules redraw.
-func (p *PanController) Dragged(ev *fyne.DragEvent) {
-	if ev == nil {
-		return
-	}
-
-	scale := p.ed.CanvasScale()
-	if scale <= 0 {
-		return
-	}
-
-	// DragEvent.Dragged is delta in Fyne logical units (device independent).
-	// Convert to pixels by multiplying by canvas scale.
-	dxPxF := ev.Dragged.DX * scale
-	dyPxF := ev.Dragged.DY * scale
-
-	// accumulate subpixel remainder in pixels
-	dxPxF += p.remPxX
-	dyPxF += p.remPxY
-
-	dxPx := int(math.Round(float64(dxPxF)))
-	dyPx := int(math.Round(float64(dyPxF)))
-
-	p.remPxX = dxPxF - float32(dxPx)
-	p.remPxY = dyPxF - float32(dyPx)
-
-	if dxPx == 0 && dyPx == 0 {
-		return
-	}
-
-	p.ed.UpdateParams(func(rp *world.RenderParams) {
-		zoomFp, err := rp.CameraZoomFp()
-		if err != nil || zoomFp <= 0 {
-			return
-		}
-
-		dxWorldFp := world.PixelSpanToWorldFixed(dxPx, zoomFp)
-		dyWorldFp := world.PixelSpanToWorldFixed(dyPx, zoomFp)
-
-		// Map follows pointer
-		rp.CameraXWorldFp -= dxWorldFp
-		rp.CameraYWorldFp -= dyWorldFp
-	})
-}
-
-// DragEnd ends the drag gesture. We force a full redraw next to eliminate any
-// possible artifacts from incremental shifting and to "settle" the final state.
-func (p *PanController) DragEnd() {
-	p.dragging = false
-	p.remPxX = 0
-	p.remPxY = 0
-
-	p.ed.ForceFullRedraw()
-	p.ed.RequestRefresh()
-}

client/ui_test.go

@@ -1,201 +0,0 @@
-package client
-
-import (
-	"image"
-	"testing"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/test"
-
-	"github.com/stretchr/testify/require"
-
-	"galaxy/client/world"
-)
-
-type fakeClient struct {
-	scale float32
-	p     world.RenderParams
-
-	forced  bool
-	updates int
-	refresh int
-}
-
-func (e *fakeClient) CanvasScale() float32 { return e.scale }
-
-func (e *fakeClient) UpdateParams(fn func(p *world.RenderParams)) {
-	fn(&e.p)
-	e.updates++
-}
-
-func (e *fakeClient) RequestRefresh() { e.refresh++ }
-
-func (e *fakeClient) ForceFullRedraw() { e.forced = true }
-
-func TestPanController_DraggedUpdatesCameraByDeltaPx(t *testing.T) {
-	t.Parallel()
-
-	fe := &fakeClient{
-		scale: 1.0, // 1 fyne unit == 1 px for the test
-		p: world.RenderParams{
-			CameraZoom:     1.0,
-			CameraXWorldFp: 5 * world.SCALE,
-			CameraYWorldFp: 5 * world.SCALE,
-		},
-	}
-
-	pc := NewPanController(fe)
-
-	// Drag right by +3 px and down by +2 px.
-	pc.Dragged(&fyne.DragEvent{
-		Dragged: fyne.Delta{DX: 3, DY: 2},
-	})
-
-	require.Equal(t, 1, fe.updates)
-
-	// Map follows pointer => camera moves opposite to pointer delta.
-	require.Equal(t, 5*world.SCALE-3*world.SCALE, fe.p.CameraXWorldFp)
-	require.Equal(t, 5*world.SCALE-2*world.SCALE, fe.p.CameraYWorldFp)
-}
-
-func TestPanController_DraggedUsesCanvasScaleByMultiplying(t *testing.T) {
-	t.Parallel()
-
-	fe := &fakeClient{
-		scale: 2.0, // 2 px per fyne unit
-		p: world.RenderParams{
-			CameraZoom:     1.0,
-			CameraXWorldFp: 0,
-			CameraYWorldFp: 0,
-		},
-	}
-
-	pc := NewPanController(fe)
-
-	// Dragged.DX=1 fyne unit => 2 px after scaling.
-	pc.Dragged(&fyne.DragEvent{
-		Dragged: fyne.Delta{DX: 1, DY: 0},
-	})
-
-	require.Equal(t, -2*world.SCALE, fe.p.CameraXWorldFp)
-}
-
-func TestPanController_DragEndForcesFullRedrawAndRefresh(t *testing.T) {
-	t.Parallel()
-
-	fe := &fakeClient{
-		scale: 1.0,
-		p: world.RenderParams{
-			CameraZoom:     1.0,
-			CameraXWorldFp: 0,
-			CameraYWorldFp: 0,
-		},
-	}
-
-	pc := NewPanController(fe)
-
-	// Simulate a drag start.
-	pc.Dragged(&fyne.DragEvent{PointEvent: fyne.PointEvent{Position: fyne.Position{X: 1, Y: 1}}})
-
-	pc.DragEnd()
-	require.True(t, fe.forced)
-	require.Equal(t, 1, fe.refresh)
-}
-
-// Optional: demonstrate use of fyne/test package to ensure types are available.
-// (Not strictly needed, but keeps fyne dependency "active" in tests.)
-func TestFyneTestDriverIsUsable(t *testing.T) {
-	t.Parallel()
-	_ = test.NewApp()
-}
-
-type immediateExecutor struct{}
-
-func (immediateExecutor) Post(fn func()) {
-	if fn != nil {
-		fn()
-	}
-}
-
-type noopRefresher struct{}
-
-func (noopRefresher) Refresh() {}
-
-func newZoomSyncTestClient(t *testing.T, worldW, worldH int, cameraZoom float64) *client {
-	t.Helper()
-
-	w := world.NewWorld(worldW, worldH)
-	e := &client{
-		world:  w,
-		drawer: &world.GGDrawer{},
-		wp: &world.RenderParams{
-			CameraZoom:     cameraZoom,
-			CameraXWorldFp: w.W / 2,
-			CameraYWorldFp: w.H / 2,
-			Options:        &world.RenderOptions{DisableWrapScroll: false},
-		},
-		hits: make([]world.Hit, 5),
-	}
-
-	e.co = NewRasterCoalescer(
-		immediateExecutor{},
-		noopRefresher{},
-		func(wPx, hPx int, _ world.RenderParams) image.Image {
-			return image.NewRGBA(image.Rect(0, 0, wPx, hPx))
-		},
-	)
-
-	return e
-}
-
-func TestRenderRasterImage_SyncsCorrectedZoomToBaseParams(t *testing.T) {
-	t.Parallel()
-
-	e := newZoomSyncTestClient(t, 10, 10, 1.0)
-	p := *e.wp
-
-	correctedZoom := e.world.CorrectCameraZoom(p.CameraZoom, 100, 100)
-	require.NotEqual(t, p.CameraZoom, correctedZoom)
-
-	_ = e.renderRasterImage(100, 100, p)
-
-	require.Equal(t, correctedZoom, e.wp.CameraZoom)
-}
-
-func TestRenderRasterImage_DoesNotOverrideNewerBaseZoom(t *testing.T) {
-	t.Parallel()
-
-	e := newZoomSyncTestClient(t, 10, 10, 1.0)
-	p := *e.wp
-
-	// Simulate a newer UI update that happened after this render snapshot was taken.
-	e.wp.CameraZoom = 3.0
-
-	_ = e.renderRasterImage(100, 100, p)
-
-	require.Equal(t, 3.0, e.wp.CameraZoom)
-}
-
-func TestPanController_Dragged_AfterRenderZoomCorrection_UsesSyncedZoom(t *testing.T) {
-	t.Parallel()
-
-	e := newZoomSyncTestClient(t, 10, 10, 1.0)
-
-	// Initial render corrects zoom and syncs it into base params.
-	_ = e.renderRasterImage(100, 100, *e.wp)
-
-	syncedZoom := e.wp.CameraZoom
-	require.NotEqual(t, 1.0, syncedZoom)
-
-	zoomFp, err := world.CameraZoomToWorldFixed(syncedZoom)
-	require.NoError(t, err)
-
-	startX := e.wp.CameraXWorldFp
-	pan := NewPanController(e)
-	pan.Dragged(&fyne.DragEvent{
-		Dragged: fyne.Delta{DX: 1, DY: 0},
-	})
-
-	expectedShift := world.PixelSpanToWorldFixed(1, zoomFp)
-	require.Equal(t, startX-expectedShift, e.wp.CameraXWorldFp)
-}

client/updater/manager.go

@@ -1,367 +0,0 @@
-// Package updater manages standalone UI client artifacts, version selection,
-// and persisted update state shared by the loader and the UI process.
-package updater
-
-import (
-	"errors"
-	"fmt"
-	"path/filepath"
-	"runtime"
-	"slices"
-	"strings"
-
-	"galaxy/connector"
-	gerr "galaxy/error"
-	mc "galaxy/model/client"
-	"galaxy/storage"
-	"galaxy/util"
-)
-
-const (
-	// ArtifactDir keeps versioned UI executables isolated from user data files.
-	ArtifactDir = "ui"
-	// ArtifactPrefix is the file name prefix used for all managed UI artifacts.
-	ArtifactPrefix = "client-ui"
-)
-
-// LaunchTarget describes the executable artifact selected for the next UI run.
-type LaunchTarget struct {
-	Version string
-	Path    string
-	Pending bool
-}
-
-// Manager coordinates client update state, artifact downloads, and cleanup.
-type Manager struct {
-	storage   storage.Storage
-	connector connector.Connector
-	goos      string
-	goarch    string
-	kind      string
-}
-
-// Option customizes Manager construction.
-type Option func(*Manager)
-
-// WithPlatform overrides the runtime platform used for version matching.
-func WithPlatform(goos, goarch string) Option {
-	return func(m *Manager) {
-		if goos != "" {
-			m.goos = goos
-		}
-		if goarch != "" {
-			m.goarch = goarch
-		}
-	}
-}
-
-// WithArtifactKind overrides the artifact kind accepted by the manager.
-func WithArtifactKind(kind string) Option {
-	return func(m *Manager) {
-		if kind != "" {
-			m.kind = kind
-		}
-	}
-}
-
-// NewManager constructs an update manager for standalone executable artifacts.
-func NewManager(s storage.Storage, c connector.Connector, opts ...Option) *Manager {
-	m := &Manager{
-		storage:   s,
-		connector: c,
-		goos:      runtime.GOOS,
-		goarch:    runtime.GOARCH,
-		kind:      connector.ArtifactKindExecutable,
-	}
-	for _, opt := range opts {
-		opt(m)
-	}
-	return m
-}
-
-// ArtifactPath returns the deterministic local storage path for the given versioned artifact.
-func ArtifactPath(version, goos, goarch, kind string) string {
-	name := fmt.Sprintf("%s-%s-%s-%s-%s", ArtifactPrefix, version, goos, goarch, kind)
-	if goos == "windows" {
-		name += ".exe"
-	}
-	return filepath.Join(ArtifactDir, name)
-}
-
-// LatestCompatibleVersion returns the latest supported version for the selected platform and kind.
-func LatestCompatibleVersion(versions []connector.VersionInfo, goos, goarch, kind string) (connector.VersionInfo, bool, error) {
-	platformMatches := make([]connector.VersionInfo, 0, len(versions))
-	for _, version := range versions {
-		if version.OS == goos && version.Arch == goarch {
-			platformMatches = append(platformMatches, version)
-		}
-	}
-	if len(platformMatches) == 0 {
-		return connector.VersionInfo{}, false, nil
-	}
-
-	candidates := make([]connector.VersionInfo, 0, len(platformMatches))
-	unsupportedKinds := make(map[string]struct{})
-	seenVersion := make(map[string]struct{})
-	for _, version := range platformMatches {
-		if version.Kind != kind {
-			unsupportedKinds[version.Kind] = struct{}{}
-			continue
-		}
-		if _, ok := seenVersion[version.Version]; ok {
-			return connector.VersionInfo{}, false, gerr.WrapService(
-				fmt.Errorf("ambiguous client artifact version %q for %s/%s", version.Version, goos, goarch),
-			)
-		}
-		seenVersion[version.Version] = struct{}{}
-		candidates = append(candidates, version)
-	}
-	if len(candidates) == 0 {
-		kinds := make([]string, 0, len(unsupportedKinds))
-		for kind := range unsupportedKinds {
-			kinds = append(kinds, kind)
-		}
-		slices.Sort(kinds)
-		return connector.VersionInfo{}, false, gerr.WrapService(
-			fmt.Errorf("unsupported client artifact kind(s) for %s/%s: %s", goos, goarch, strings.Join(kinds, ", ")),
-		)
-	}
-
-	type semVersion struct {
-		info connector.VersionInfo
-		sem  util.SemVer
-	}
-	semvers := make([]semVersion, len(candidates))
-	for i, candidate := range candidates {
-		semver, err := util.ParseSemver(candidate.Version)
-		if err != nil {
-			return connector.VersionInfo{}, false, gerr.WrapService(
-				fmt.Errorf("parse client version %q: %w", candidate.Version, err),
-			)
-		}
-		semvers[i] = semVersion{info: candidate, sem: semver}
-	}
-
-	slices.SortFunc(semvers, func(a, b semVersion) int {
-		return util.CompareSemver(a.sem, b.sem)
-	})
-	return semvers[0].info, true, nil
-}
-
-// EnsureLaunchTarget returns the versioned executable that should be launched next.
-// On the very first run, when no current or pending version exists yet, it downloads
-// the latest compatible artifact and marks it as pending.
-func (m *Manager) EnsureLaunchTarget() (LaunchTarget, error) {
-	state, err := m.ensureState()
-	if err != nil {
-		return LaunchTarget{}, err
-	}
-
-	if state.ClientNextVersion != nil {
-		return m.launchTargetForVersion(*state.ClientNextVersion, true)
-	}
-	if state.ClientCurrentVersion != "" {
-		return m.launchTargetForVersion(state.ClientCurrentVersion, false)
-	}
-	if err := m.CheckAndPrepareLatest(); err != nil {
-		return LaunchTarget{}, err
-	}
-
-	state, err = m.ensureState()
-	if err != nil {
-		return LaunchTarget{}, err
-	}
-	if state.ClientNextVersion == nil {
-		return LaunchTarget{}, gerr.WrapService(errors.New("latest client version was not prepared for launch"))
-	}
-
-	return m.launchTargetForVersion(*state.ClientNextVersion, true)
-}
-
-// CheckAndPrepareLatest checks the backend manifest and downloads a newer compatible
-// artifact when one exists.
-func (m *Manager) CheckAndPrepareLatest() error {
-	if m.connector == nil {
-		return gerr.WrapService(errors.New("client updater connector is not configured"))
-	}
-
-	versions, err := m.connector.CheckVersion()
-	if err != nil {
-		return err
-	}
-	latest, ok, err := LatestCompatibleVersion(versions, m.goos, m.goarch, m.kind)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return gerr.WrapService(
-			fmt.Errorf("server did not provide a compatible %s client for %s/%s", m.kind, m.goos, m.goarch),
-		)
-	}
-
-	state, err := m.ensureState()
-	if err != nil {
-		return err
-	}
-
-	latestSemver, err := util.ParseSemver(latest.Version)
-	if err != nil {
-		return gerr.WrapService(fmt.Errorf("parse latest client version %q: %w", latest.Version, err))
-	}
-
-	if state.ClientCurrentVersion != "" {
-		currentSemver, err := util.ParseSemver(state.ClientCurrentVersion)
-		if err != nil {
-			return gerr.WrapService(fmt.Errorf("parse current client version %q: %w", state.ClientCurrentVersion, err))
-		}
-		if util.CompareSemver(currentSemver, latestSemver) >= 0 {
-			return nil
-		}
-	}
-	if state.ClientNextVersion != nil {
-		nextSemver, err := util.ParseSemver(*state.ClientNextVersion)
-		if err != nil {
-			return gerr.WrapService(fmt.Errorf("parse pending client version %q: %w", *state.ClientNextVersion, err))
-		}
-		if util.CompareSemver(nextSemver, latestSemver) >= 0 {
-			return nil
-		}
-	}
-
-	if err := m.downloadArtifact(latest); err != nil {
-		return err
-	}
-
-	state.ClientNextVersion = &latest.Version
-	return m.saveState(state)
-}
-
-// MarkLaunchResult records the outcome of a launched artifact and promotes
-// pending versions to current only after a successful run.
-func (m *Manager) MarkLaunchResult(version string, exitCode int, runErr error) error {
-	state, err := m.ensureState()
-	if err != nil {
-		return err
-	}
-
-	if state.ClientNextVersion != nil && *state.ClientNextVersion == version {
-		if runErr == nil && exitCode == 0 {
-			state.ClientCurrentVersion = version
-		}
-		state.ClientNextVersion = nil
-		if err := m.saveState(state); err != nil {
-			return err
-		}
-		return m.cleanupArtifacts(state)
-	}
-
-	if runErr == nil && exitCode == 0 {
-		return m.cleanupArtifacts(state)
-	}
-	return nil
-}
-
-func (m *Manager) launchTargetForVersion(version string, pending bool) (LaunchTarget, error) {
-	path := ArtifactPath(version, m.goos, m.goarch, m.kind)
-	exists, absPath, err := m.storage.FileExists(path)
-	if err != nil {
-		return LaunchTarget{}, err
-	}
-	if !exists {
-		return LaunchTarget{}, gerr.WrapStorage(
-			fmt.Errorf("client artifact for version %q not found at %q", version, path),
-		)
-	}
-	return LaunchTarget{
-		Version: version,
-		Path:    absPath,
-		Pending: pending,
-	}, nil
-}
-
-func (m *Manager) ensureState() (mc.State, error) {
-	if m.storage == nil {
-		return mc.State{}, gerr.WrapStorage(errors.New("client updater storage is not configured"))
-	}
-
-	exists, err := m.storage.StateExists()
-	if err != nil {
-		return mc.State{}, err
-	}
-	if !exists {
-		state := mc.State{}
-		if err := m.storage.SaveState(state); err != nil {
-			return mc.State{}, err
-		}
-		return state, nil
-	}
-	return m.storage.LoadState()
-}
-
-func (m *Manager) saveState(state mc.State) error {
-	return m.storage.SaveState(state)
-}
-
-func (m *Manager) downloadArtifact(version connector.VersionInfo) error {
-	data, err := m.connector.DownloadVersion(version.URL)
-	if err != nil {
-		return err
-	}
-	digest := connector.NewSHA256Digest(data)
-	if !digest.Equal(version.Checksum) {
-		return gerr.WrapService(fmt.Errorf("downloaded client artifact checksum mismatch for version %s", version.Version))
-	}
-
-	path := ArtifactPath(version.Version, version.OS, version.Arch, version.Kind)
-	exists, _, err := m.storage.FileExists(path)
-	if err != nil {
-		return err
-	}
-	if exists {
-		storedData, err := m.storage.ReadFile(path)
-		if err != nil {
-			return err
-		}
-		if connector.NewSHA256Digest(storedData).Equal(version.Checksum) {
-			return nil
-		}
-		if err := m.storage.DeleteFile(path); err != nil {
-			return err
-		}
-	}
-
-	return m.storage.WriteFile(path, data)
-}
-
-func (m *Manager) cleanupArtifacts(state mc.State) error {
-	files, err := m.storage.ListFiles()
-	if err != nil {
-		return err
-	}
-
-	retain := make(map[string]struct{}, 2)
-	if state.ClientCurrentVersion != "" {
-		retain[ArtifactPath(state.ClientCurrentVersion, m.goos, m.goarch, m.kind)] = struct{}{}
-	}
-	if state.ClientNextVersion != nil {
-		retain[ArtifactPath(*state.ClientNextVersion, m.goos, m.goarch, m.kind)] = struct{}{}
-	}
-
-	prefix := filepath.ToSlash(ArtifactDir) + "/"
-	for _, file := range files {
-		slashed := filepath.ToSlash(file)
-		if !strings.HasPrefix(slashed, prefix) {
-			continue
-		}
-		if !strings.HasPrefix(filepath.Base(file), ArtifactPrefix+"-") {
-			continue
-		}
-		if _, ok := retain[file]; ok {
-			continue
-		}
-		if err := m.storage.DeleteFile(file); err != nil {
-			return err
-		}
-	}
-	return nil
-}

client/updater/manager_test.go

@@ -1,60 +0,0 @@
-package updater
-
-import (
-	"testing"
-
-	"galaxy/connector"
-	gerr "galaxy/error"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestArtifactPathWindowsAddsExe(t *testing.T) {
-	t.Parallel()
-
-	got := ArtifactPath("1.2.3", "windows", "amd64", connector.ArtifactKindExecutable)
-	require.Equal(t, `ui\client-ui-1.2.3-windows-amd64-executable.exe`, got)
-}
-
-func TestLatestCompatibleVersionSelectsPlatformExecutable(t *testing.T) {
-	t.Parallel()
-
-	versions := []connector.VersionInfo{
-		{OS: "linux", Arch: "amd64", Kind: connector.ArtifactKindExecutable, Version: "1.0.0"},
-		{OS: "windows", Arch: "amd64", Kind: connector.ArtifactKindExecutable, Version: "1.2.0"},
-		{OS: "windows", Arch: "amd64", Kind: connector.ArtifactKindExecutable, Version: "1.3.0"},
-		{OS: "windows", Arch: "arm64", Kind: connector.ArtifactKindExecutable, Version: "9.9.9"},
-	}
-
-	got, ok, err := LatestCompatibleVersion(versions, "windows", "amd64", connector.ArtifactKindExecutable)
-	require.NoError(t, err)
-	require.True(t, ok)
-	require.Equal(t, "1.3.0", got.Version)
-}
-
-func TestLatestCompatibleVersionRejectsUnsupportedKinds(t *testing.T) {
-	t.Parallel()
-
-	versions := []connector.VersionInfo{
-		{OS: "windows", Arch: "amd64", Kind: "shared-library", Version: "1.0.0"},
-	}
-
-	_, ok, err := LatestCompatibleVersion(versions, "windows", "amd64", connector.ArtifactKindExecutable)
-	require.False(t, ok)
-	require.Error(t, err)
-	require.True(t, gerr.IsService(err))
-}
-
-func TestLatestCompatibleVersionRejectsAmbiguousVersions(t *testing.T) {
-	t.Parallel()
-
-	versions := []connector.VersionInfo{
-		{OS: "windows", Arch: "amd64", Kind: connector.ArtifactKindExecutable, Version: "1.0.0"},
-		{OS: "windows", Arch: "amd64", Kind: connector.ArtifactKindExecutable, Version: "1.0.0"},
-	}
-
-	_, ok, err := LatestCompatibleVersion(versions, "windows", "amd64", connector.ArtifactKindExecutable)
-	require.False(t, ok)
-	require.Error(t, err)
-	require.True(t, gerr.IsService(err))
-}