feat(payments): chip wallet, store-compliance gate and benefit application

Stand up the internal chip/benefit mechanic behind the narrow payments interface:
context-aware balances and benefits, an atomic chip spend, admin grants as
zero-price value sales, the one-directional store-compliance gate (VK/TG same-
origin only, web draws direct→vk→tg, VK-iOS frozen, untrusted fail-closed), and
per-origin hint and no-ads application with term stacking. Reads are served from
an in-process, account-keyed write-through cache (mirroring the suspension gate),
so hot paths issue no query to the payments schema.

Flip the online-game hint wallet and the ad-banner suppression from the deprecated
accounts.hint_balance / paid_account columns to the payments benefit (a hint
balance no longer suppresses the banner — only a no-ads benefit does), and fold
chip segments and benefits by origin on account merge, inside the merge tx. Add
the GET/POST /api/v1/user/wallet edge chain (REST → Connect → FlatBuffers) plus
its codec unit test; no wallet UI yet.

Bring the frozen owner decisions log into the repo at
docs/PAYMENTS_DECISIONS_ru.md (it was untracked under .vscode) and reference it
from PLAN.md; record the read-cache design and the present-sources interface in
PLAN.md and docs/PAYMENTS.md (+ RU mirror).

backend/internal/inttest/banner_console_test.go

@@ -15,13 +15,15 @@ import (
 
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/ads"
+	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/server"
 )
 
 // bannerServer assembles a console-capable server with the ads domain wired.
-func bannerServer(t *testing.T) (*server.Server, *ads.Service) {
+func bannerServer(t *testing.T) (*server.Server, *ads.Service, *payments.Service) {
 	t.Helper()
 	adsSvc := ads.NewService(ads.NewStore(testDB))
+	paySvc := newPaymentsService()
 	srv := server.New(":0", server.Deps{
 		Logger:   zap.NewNop(),
 		Accounts: account.NewStore(testDB),
@@ -29,8 +31,9 @@ func bannerServer(t *testing.T) (*server.Server, *ads.Service) {
 		Registry: testRegistry,
 		DictDir:  dictDir(),
 		Ads:      adsSvc,
+		Payments: paySvc,
 	})
-	return srv, adsSvc
+	return srv, adsSvc, paySvc
 }
 
 // findCampaign returns the id of the campaign with the given name, or fails.
@@ -71,7 +74,7 @@ func defaultCampaign(t *testing.T, svc *ads.Service) ads.Campaign {
 // reorder/delete.
 func TestBannerConsoleCRUD(t *testing.T) {
 	ctx := context.Background()
-	srv, adsSvc := bannerServer(t)
+	srv, adsSvc, _ := bannerServer(t)
 	h := srv.Handler()
 	base := "http://admin.test/_gm"
 	const origin = "http://admin.test"
@@ -151,7 +154,7 @@ func TestBannerConsoleCRUD(t *testing.T) {
 // unrelated campaign's URL must be refused.
 func TestBannerMessageOwnership(t *testing.T) {
 	ctx := context.Background()
-	srv, adsSvc := bannerServer(t)
+	srv, adsSvc, _ := bannerServer(t)
 	h := srv.Handler()
 	base := "http://admin.test/_gm"
 	const origin = "http://admin.test"
@@ -207,10 +210,11 @@ type profileBanner struct {
 // wallet each suppress it.
 func TestBannerProfileEligibility(t *testing.T) {
 	ctx := context.Background()
-	srv, _ := bannerServer(t)
+	srv, _, pay := bannerServer(t)
 	accounts := account.NewStore(testDB)
 	id := provisionAccount(t)
 
+	// getBanner fetches the profile banner with no platform header (an untrusted context).
 	getBanner := func() profileBanner {
 		t.Helper()
 		rec := userGet(t, srv, "/api/v1/user/profile", id)
@@ -223,10 +227,27 @@ func TestBannerProfileEligibility(t *testing.T) {
 		}
 		return p
 	}
+	// getBannerTG fetches the profile banner in a trusted Telegram context — the account's
+	// telegram identity makes telegram the applicable origin for its benefits.
+	getBannerTG := func() profileBanner {
+		t.Helper()
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/user/profile", nil)
+		req.Header.Set("X-User-ID", id.String())
+		req.Header.Set("X-Platform", "telegram/android")
+		srv.Handler().ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("profile = %d, want 200", rec.Code)
+		}
+		var p profileBanner
+		if err := json.Unmarshal(rec.Body.Bytes(), &p); err != nil {
+			t.Fatalf("decode profile: %v", err)
+		}
+		return p
+	}
 
-	// A free account with an empty hint wallet and no role is eligible.
-	p := getBanner()
-	if p.Banner == nil || len(p.Banner.Campaigns) == 0 || p.Banner.Timings.HoldMs <= 0 {
+	// A free account with no role and no benefit is eligible.
+	if p := getBanner(); p.Banner == nil || len(p.Banner.Campaigns) == 0 || p.Banner.Timings.HoldMs <= 0 {
 		t.Fatalf("eligible account: banner=%v", p.Banner)
 	}
 
@@ -241,19 +262,31 @@ func TestBannerProfileEligibility(t *testing.T) {
 		t.Fatalf("revoke role: %v", err)
 	}
 
-	// A non-empty hint wallet suppresses it.
-	if _, err := accounts.GrantHints(ctx, id, 5); err != nil {
+	// A hint wallet no longer suppresses the banner — hints and no-ads are distinct benefits now.
+	if err := pay.Grant(ctx, id, payments.SourceTelegram, 5, 0, false); err != nil {
 		t.Fatalf("grant hints: %v", err)
 	}
-	if p := getBanner(); p.Banner != nil {
-		t.Fatal("a non-empty hint wallet still shows the banner")
+	if p := getBannerTG(); p.Banner == nil {
+		t.Fatal("a hint wallet must NOT suppress the banner")
+	}
+
+	// An active no-ads benefit applicable in the context suppresses the banner.
+	if err := pay.Grant(ctx, id, payments.SourceTelegram, 0, 30, false); err != nil {
+		t.Fatalf("grant no-ads: %v", err)
+	}
+	if p := getBannerTG(); p.Banner != nil {
+		t.Fatal("an active no-ads benefit must suppress the banner")
+	}
+	// Fail-closed: without a trusted platform the same benefit does not apply, so the banner shows.
+	if p := getBanner(); p.Banner == nil {
+		t.Fatal("an untrusted context must not apply the no-ads benefit (banner should show)")
 	}
 }
 
 // TestBannerSurvivesProfileUpdate guards that a profile update (e.g. a language switch) returns the
 // banner block too, so the client's profile keeps the banner instead of losing it until reload.
 func TestBannerSurvivesProfileUpdate(t *testing.T) {
-	srv, _ := bannerServer(t)
+	srv, _, _ := bannerServer(t)
 	id := provisionAccount(t)
 
 	body := `{"display_name":"Tester","preferred_language":"ru","time_zone":"UTC","away_start":"00:00",` +
@@ -283,7 +316,7 @@ func TestBannerSurvivesProfileUpdate(t *testing.T) {
 // default campaign stays plain (colours + urgent are ignored for it).
 func TestBannerConsoleColorsAndUrgent(t *testing.T) {
 	ctx := context.Background()
-	srv, adsSvc := bannerServer(t)
+	srv, adsSvc, _ := bannerServer(t)
 	h := srv.Handler()
 	base := "http://admin.test/_gm"
 	const origin = "http://admin.test"
@@ -351,7 +384,7 @@ func TestBannerConsoleColorsAndUrgent(t *testing.T) {
 // otherwise suppress the banner.
 func TestBannerUrgentBypassesEligibility(t *testing.T) {
 	ctx := context.Background()
-	srv, adsSvc := bannerServer(t)
+	srv, adsSvc, _ := bannerServer(t)
 	accounts := account.NewStore(testDB)
 	id := provisionAccount(t)
 

backend/internal/inttest/game_test.go

@@ -14,6 +14,8 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/payments"
+	"scrabble/backend/internal/session"
 )
 
 // TestListForAccount checks the lobby "my games" query: it returns exactly the
@@ -401,8 +403,13 @@ func gameStatus(t *testing.T, svc *game.Service, id uuid.UUID) (status, endReaso
 // TestHintPolicy exercises the per-game allowance, the profile wallet and the
 // disabled switch.
 func TestHintPolicy(t *testing.T) {
-	ctx := context.Background()
+	// A trusted platform context so the online hint wallet (payments) is reachable; a provisioned
+	// account carries a telegram identity, so the telegram origin is the applicable one here.
+	ctx := session.WithPlatform(context.Background(),
+		session.Platform{Kind: session.PlatformKindTelegram, Subtype: session.SubtypeAndroid})
 	svc := newGameService()
+	pay := newPaymentsService()
+	svc.SetHintWallet(pay) // share the handle so a grant invalidates the wallet the game reads
 	seats := []uuid.UUID{provisionAccount(t), provisionAccount(t)}
 	seed := openingSeed(t)
 	g, err := svc.Create(ctx, game.CreateParams{
@@ -428,7 +435,11 @@ func TestHintPolicy(t *testing.T) {
 	if _, err := svc.Hint(ctx, g.ID, seats[0]); !errors.Is(err, game.ErrNoHintsLeft) {
 		t.Fatalf("second hint = %v, want ErrNoHintsLeft", err)
 	}
-	setHintBalance(t, seats[0], 2)
+	// Grant 2 hints on the telegram origin through the service so its read cache is invalidated
+	// (a raw insert would leave the cache warmed at zero by the allowance hint above).
+	if err := pay.Grant(ctx, seats[0], payments.SourceTelegram, 2, 0, false); err != nil {
+		t.Fatalf("grant hints: %v", err)
+	}
 	res, err := svc.Hint(ctx, g.ID, seats[0]) // spends the wallet
 	if err != nil {
 		t.Fatalf("wallet hint: %v", err)
@@ -603,14 +614,6 @@ func setAway(t *testing.T, id uuid.UUID, tz, start, end string) {
 	}
 }
 
-func setHintBalance(t *testing.T, id uuid.UUID, n int) {
-	t.Helper()
-	if _, err := testDB.ExecContext(context.Background(),
-		`UPDATE backend.accounts SET hint_balance = $1 WHERE account_id = $2`, n, id); err != nil {
-		t.Fatalf("set hint balance: %v", err)
-	}
-}
-
 func equalStrings(a, b []string) bool {
 	if len(a) != len(b) {
 		return false

backend/internal/inttest/helpers.go

@@ -17,6 +17,7 @@ import (
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
+	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/social"
 )
@@ -42,9 +43,42 @@ func newGameService() *game.Service {
 		zap.NewNop(),
 	)
 	svc.SetFirstMoveEntropy(seatZeroFirstMove)
+	svc.SetHintWallet(newPaymentsService())
 	return svc
 }
 
+// newPaymentsService builds a payments service over the shared pool (its own in-process read
+// cache), for wiring the game hint wallet and the account-merge fold in the integration suite.
+func newPaymentsService() *payments.Service {
+	return payments.NewService(payments.NewStore(testDB))
+}
+
+// seedBenefit writes a payments benefit row for an account+origin directly (bypassing the
+// service), used to stand up wallet state a test then spends or merges. A non-zero hints count
+// and/or the forever flag are set; a caller wanting a no-ads term sets it via seedBenefitUntil.
+func seedBenefit(t *testing.T, id uuid.UUID, origin string, hints int, forever bool) {
+	t.Helper()
+	if _, err := testDB.ExecContext(context.Background(),
+		`INSERT INTO payments.benefits (account_id, origin, hints, ads_forever) VALUES ($1,$2,$3,$4)
+		 ON CONFLICT (account_id, origin) DO UPDATE SET hints = EXCLUDED.hints, ads_forever = EXCLUDED.ads_forever`,
+		id, origin, hints, forever); err != nil {
+		t.Fatalf("seed benefit: %v", err)
+	}
+}
+
+// readBenefit reads an account's benefit row for an origin: the hint count and the forever flag
+// (both zero/false when the row is absent).
+func readBenefit(t *testing.T, id uuid.UUID, origin string) (hints int, forever bool) {
+	t.Helper()
+	err := testDB.QueryRowContext(context.Background(),
+		`SELECT hints, ads_forever FROM payments.benefits WHERE account_id=$1 AND origin=$2`, id, origin).
+		Scan(&hints, &forever)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("read benefit: %v", err)
+	}
+	return hints, forever
+}
+
 // seatZeroFirstMove is a first-move-draw entropy factory that always elects the first
 // listed account as the leader, keeping the integration suite's turn order stable
 // despite the real draw's randomness: the first contender draws a blank — the best

backend/internal/inttest/merge_test.go

@@ -58,14 +58,6 @@ func bestMoveCount(t *testing.T, id uuid.UUID) int {
 	return n
 }
 
-func setWallet(t *testing.T, id uuid.UUID, hints int, paid bool) {
-	t.Helper()
-	if _, err := testDB.ExecContext(context.Background(),
-		`UPDATE backend.accounts SET hint_balance=$2, paid_account=$3 WHERE account_id=$1`, id, hints, paid); err != nil {
-		t.Fatalf("set wallet: %v", err)
-	}
-}
-
 func bindEmailIdentity(t *testing.T, acc uuid.UUID, email string) {
 	t.Helper()
 	if _, err := testDB.ExecContext(context.Background(),
@@ -131,6 +123,7 @@ func TestAccountMergeCore(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	merger := accountmerge.NewMerger(testDB)
+	merger.SetPayments(newPaymentsService())
 
 	primary := provisionAccount(t)
 	secondary := provisionAccount(t)
@@ -140,8 +133,8 @@ func TestAccountMergeCore(t *testing.T) {
 	setStats(t, secondary, 3, 1, 2, 400, 80)
 	setStatsCounts(t, primary, 100, 5)
 	setStatsCounts(t, secondary, 50, 8)
-	setWallet(t, primary, 2, false)
-	setWallet(t, secondary, 5, true)
+	seedBenefit(t, primary, "telegram", 2, false)
+	seedBenefit(t, secondary, "telegram", 5, true) // hints sum, forever OR-s on merge
 	// Best moves: secondary's scrabble_en (80) beats primary's (50) and is kept; secondary's
 	// scrabble_ru (30) is new to primary and carried over.
 	setBestMove(t, primary, "scrabble_en", 50)
@@ -165,15 +158,13 @@ func TestAccountMergeCore(t *testing.T) {
 		t.Error("secondary stats row should be deleted after merge")
 	}
 
-	acc, err := store.GetByID(ctx, primary)
-	if err != nil {
-		t.Fatalf("get primary: %v", err)
+	// The payments wallet merged by origin: hints sum (2+5) and the forever flag OR-s; the
+	// deprecated accounts.hint_balance / paid_account columns are no longer touched by a merge.
+	if hints, forever := readBenefit(t, primary, "telegram"); hints != 7 || !forever {
+		t.Errorf("merged telegram benefit = hints %d forever %v, want 7/true", hints, forever)
 	}
-	if acc.HintBalance != 7 {
-		t.Errorf("hint balance = %d, want 7", acc.HintBalance)
-	}
-	if !acc.PaidAccount {
-		t.Error("paid_account should be true (ORed from secondary)")
+	if hints, _ := readBenefit(t, secondary, "telegram"); hints != 0 {
+		t.Errorf("secondary benefit should be cleared after merge, got hints %d", hints)
 	}
 
 	if owner, ok, _ := store.AccountIDByIdentity(ctx, account.KindEmail, email); !ok || owner != primary {

backend/internal/inttest/payments_wallet_test.go

@@ -0,0 +1,279 @@
+//go:build integration
+
+package inttest
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"scrabble/backend/internal/payments"
+)
+
+// seedBalance writes a chip balance for an account+source directly (payments has no FK to
+// accounts, so a bare uuid is a valid account id here).
+func seedBalance(t *testing.T, id uuid.UUID, source string, chips int) {
+	t.Helper()
+	if _, err := testDB.ExecContext(context.Background(),
+		`INSERT INTO payments.balances (account_id, source, chips) VALUES ($1,$2,$3)
+		 ON CONFLICT (account_id, source) DO UPDATE SET chips = EXCLUDED.chips`,
+		id, source, chips); err != nil {
+		t.Fatalf("seed balance: %v", err)
+	}
+}
+
+// readBalance reads an account's chip balance for a source (0 when the row is absent).
+func readBalance(t *testing.T, id uuid.UUID, source string) int {
+	t.Helper()
+	var chips int
+	err := testDB.QueryRowContext(context.Background(),
+		`SELECT chips FROM payments.balances WHERE account_id=$1 AND source=$2`, id, source).Scan(&chips)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("read balance: %v", err)
+	}
+	return chips
+}
+
+// benefitUntil reads an account's no-ads term end for an origin (nil when none).
+func benefitUntil(t *testing.T, id uuid.UUID, origin string) *time.Time {
+	t.Helper()
+	var until *time.Time
+	err := testDB.QueryRowContext(context.Background(),
+		`SELECT ads_paid_until FROM payments.benefits WHERE account_id=$1 AND origin=$2`, id, origin).Scan(&until)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("read benefit until: %v", err)
+	}
+	return until
+}
+
+// ledgerRows counts an account's ledger rows of a given kind.
+func ledgerRows(t *testing.T, id uuid.UUID, kind string) int {
+	t.Helper()
+	var n int
+	if err := testDB.QueryRowContext(context.Background(),
+		`SELECT count(*) FROM payments.ledger WHERE account_id=$1 AND kind=$2`, id, kind).Scan(&n); err != nil {
+		t.Fatalf("ledger count: %v", err)
+	}
+	return n
+}
+
+// seedValueProduct creates an active chip-priced value: a product with a CHIP price (method
+// NULL) and the given hint / no-ads-day atoms. It returns the product id.
+func seedValueProduct(t *testing.T, priceChips, hints, noAdsDays int) uuid.UUID {
+	t.Helper()
+	ctx := context.Background()
+	prod := uuid.New()
+	if _, err := testDB.ExecContext(ctx,
+		`INSERT INTO payments.product (product_id, title, active) VALUES ($1,'test value',true)`, prod); err != nil {
+		t.Fatalf("seed product: %v", err)
+	}
+	if _, err := testDB.ExecContext(ctx,
+		`INSERT INTO payments.product_price (product_id, method, currency, amount) VALUES ($1, NULL, 'CHIP', $2)`,
+		prod, priceChips); err != nil {
+		t.Fatalf("seed price: %v", err)
+	}
+	if hints > 0 {
+		if _, err := testDB.ExecContext(ctx,
+			`INSERT INTO payments.product_item (product_id, atom_type, quantity) VALUES ($1,'hints',$2)`, prod, hints); err != nil {
+			t.Fatalf("seed hints item: %v", err)
+		}
+	}
+	if noAdsDays > 0 {
+		if _, err := testDB.ExecContext(ctx,
+			`INSERT INTO payments.product_item (product_id, atom_type, quantity) VALUES ($1,'noads_days',$2)`, prod, noAdsDays); err != nil {
+			t.Fatalf("seed noads item: %v", err)
+		}
+	}
+	return prod
+}
+
+// TestPaymentsSpendAppliesAtomically verifies a chip spend writes the ledger row, decrements the
+// balance and applies the benefit together over Postgres.
+func TestPaymentsSpendAppliesAtomically(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	seedBalance(t, acc, "direct", 100)
+	prod := seedValueProduct(t, 60, 3, 30)
+
+	if err := svc.Spend(ctx, acc, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod); err != nil {
+		t.Fatalf("spend: %v", err)
+	}
+	if got := readBalance(t, acc, "direct"); got != 40 {
+		t.Errorf("balance after spend = %d, want 40", got)
+	}
+	if hints, _ := readBenefit(t, acc, "direct"); hints != 3 {
+		t.Errorf("hints after spend = %d, want 3", hints)
+	}
+	if benefitUntil(t, acc, "direct") == nil {
+		t.Error("no-ads term not applied by the spend")
+	}
+	if n := ledgerRows(t, acc, "spend"); n != 1 {
+		t.Errorf("spend ledger rows = %d, want 1", n)
+	}
+}
+
+// TestPaymentsSpendInsufficientNoWrite verifies an under-funded spend is refused and writes
+// nothing (the balance, benefit and ledger are untouched).
+func TestPaymentsSpendInsufficientNoWrite(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	seedBalance(t, acc, "direct", 10)
+	prod := seedValueProduct(t, 60, 3, 0)
+
+	if err := svc.Spend(ctx, acc, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod); !errors.Is(err, payments.ErrInsufficientChips) {
+		t.Fatalf("spend = %v, want ErrInsufficientChips", err)
+	}
+	if got := readBalance(t, acc, "direct"); got != 10 {
+		t.Errorf("balance changed to %d, want 10 (no write)", got)
+	}
+	if h, _ := readBenefit(t, acc, "direct"); h != 0 {
+		t.Errorf("benefit applied on a refused spend: hints %d", h)
+	}
+	if ledgerRows(t, acc, "spend") != 0 {
+		t.Error("spend ledger row written on a refused spend")
+	}
+}
+
+// TestPaymentsSpendGuardRollsBack forces the in-transaction guard to bite: with a stale read
+// cache the draw plan looks affordable, but the guarded decrement matches no row and the whole
+// transaction rolls back — no ledger row, no benefit, balance unchanged.
+func TestPaymentsSpendGuardRollsBack(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	seedBalance(t, acc, "direct", 100)
+	present := []payments.Source{payments.SourceDirect}
+	cxt := payments.NewContext("direct", "web")
+	if _, err := svc.Wallet(ctx, acc, cxt, present); err != nil { // warm the cache at 100
+		t.Fatalf("warm: %v", err)
+	}
+	// Drain the real balance behind the cache's back (no invalidation), so the plan over-commits.
+	if _, err := testDB.ExecContext(ctx, `UPDATE payments.balances SET chips = 10 WHERE account_id=$1 AND source='direct'`, acc); err != nil {
+		t.Fatalf("drain: %v", err)
+	}
+	prod := seedValueProduct(t, 60, 3, 0)
+
+	if err := svc.Spend(ctx, acc, cxt, present, prod); !errors.Is(err, payments.ErrInsufficientChips) {
+		t.Fatalf("spend = %v, want ErrInsufficientChips", err)
+	}
+	if got := readBalance(t, acc, "direct"); got != 10 {
+		t.Errorf("balance = %d, want 10 (rolled back)", got)
+	}
+	if ledgerRows(t, acc, "spend") != 0 {
+		t.Error("spend ledger row written despite the rollback")
+	}
+	if h, _ := readBenefit(t, acc, "direct"); h != 0 {
+		t.Error("benefit applied despite the rollback")
+	}
+}
+
+// TestPaymentsGrantCreditsValuesNotChips verifies admin_grant applies a benefit at price 0
+// without ever crediting chips (D16).
+func TestPaymentsGrantCreditsValuesNotChips(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+
+	if err := svc.Grant(ctx, acc, payments.SourceDirect, 5, 0, true); err != nil {
+		t.Fatalf("grant: %v", err)
+	}
+	if hints, forever := readBenefit(t, acc, "direct"); hints != 5 || !forever {
+		t.Errorf("granted benefit = hints %d forever %v, want 5/true", hints, forever)
+	}
+	if readBalance(t, acc, "direct") != 0 {
+		t.Error("a grant must not credit chips")
+	}
+	if ledgerRows(t, acc, "admin_grant") != 1 {
+		t.Error("admin_grant ledger row missing")
+	}
+	if ledgerRows(t, acc, "spend") != 0 || ledgerRows(t, acc, "fund") != 0 {
+		t.Error("a grant wrote a non-grant ledger row")
+	}
+}
+
+// TestPaymentsSpendHintByContext verifies a hint is drawn from an applicable origin, and that a
+// direct-origin hint is not usable inside a VK context (the compliance wall for hints).
+func TestPaymentsSpendHintByContext(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	seedBenefit(t, acc, "direct", 2, false)
+	present := []payments.Source{payments.SourceDirect, payments.SourceVK}
+
+	if spent, err := svc.SpendHint(ctx, acc, payments.NewContext("direct", "web"), present); err != nil || !spent {
+		t.Fatalf("web spend hint = %v (err %v), want true", spent, err)
+	}
+	if h, _ := readBenefit(t, acc, "direct"); h != 1 {
+		t.Errorf("hints after spend = %d, want 1", h)
+	}
+	// Inside VK the applicable origins are {vk} only, so the direct-origin hint is untouched.
+	if spent, _ := svc.SpendHint(ctx, acc, payments.NewContext("vk", "android"), present); spent {
+		t.Error("direct-origin hint spent inside VK — compliance wall breached")
+	}
+	if h, _ := readBenefit(t, acc, "direct"); h != 1 {
+		t.Errorf("direct hints changed inside VK = %d, want 1 (untouched)", h)
+	}
+}
+
+// TestPaymentsComplianceGateOverPostgres is the named compliance regression at the integration
+// layer: a direct-origin no-ads benefit applies on the web but never inside a store wrapper.
+func TestPaymentsComplianceGateOverPostgres(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	if err := svc.Grant(ctx, acc, payments.SourceDirect, 0, 30, false); err != nil {
+		t.Fatalf("grant: %v", err)
+	}
+	present := []payments.Source{payments.SourceDirect, payments.SourceVK}
+
+	if adFree, _ := svc.AdFree(ctx, acc, payments.NewContext("direct", "web"), present); !adFree {
+		t.Error("direct no-ads should apply on web")
+	}
+	if adFree, _ := svc.AdFree(ctx, acc, payments.NewContext("vk", "android"), present); adFree {
+		t.Error("direct no-ads must NOT apply inside VK (compliance wall)")
+	}
+	if adFree, _ := svc.AdFree(ctx, acc, payments.NewContext("telegram", "web"), present); adFree {
+		t.Error("direct no-ads must NOT apply inside Telegram (compliance wall)")
+	}
+}
+
+// TestPaymentsMergeFoldsSegmentsAndBenefits verifies the merge folds chip segments (sum) and
+// benefits (hints sum, forever OR) by origin, and clears the secondary's rows, over Postgres.
+func TestPaymentsMergeFoldsSegmentsAndBenefits(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	primary, secondary := uuid.New(), uuid.New()
+	seedBalance(t, primary, "vk", 10)
+	seedBalance(t, secondary, "vk", 25)
+	seedBenefit(t, primary, "vk", 1, false)
+	seedBenefit(t, secondary, "vk", 4, true)
+
+	tx, err := testDB.BeginTx(ctx, nil)
+	if err != nil {
+		t.Fatalf("begin: %v", err)
+	}
+	if err := svc.MergeTx(ctx, tx, primary, secondary); err != nil {
+		_ = tx.Rollback()
+		t.Fatalf("merge: %v", err)
+	}
+	if err := tx.Commit(); err != nil {
+		t.Fatalf("commit: %v", err)
+	}
+	svc.Invalidate(primary, secondary)
+
+	if got := readBalance(t, primary, "vk"); got != 35 {
+		t.Errorf("merged chips = %d, want 35", got)
+	}
+	if h, forever := readBenefit(t, primary, "vk"); h != 5 || !forever {
+		t.Errorf("merged benefit = hints %d forever %v, want 5/true", h, forever)
+	}
+	if readBalance(t, secondary, "vk") != 0 {
+		t.Error("secondary balance not cleared after merge")
+	}
+}