Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

gateway/proto/edge/v1/edge.pb.go

@@ -0,0 +1,334 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: edge/v1/edge.proto
+
+// Package scrabble.edge.v1 is the client <-> gateway Connect-RPC contract. It is
+// deliberately minimal (ARCHITECTURE.md §2): a single unary Execute that routes
+// by message_type, and a server-streaming Subscribe for the in-app live channel.
+// The actual request/response and event bodies travel as FlatBuffers bytes in the
+// payload fields (pkg/fbs). The session token rides in the Authorization header,
+// not the envelope (no per-request signing — ARCHITECTURE.md §3).
+
+package edgev1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ExecuteRequest is the unary envelope. message_type selects the operation;
+// payload is its FlatBuffers-encoded request body; request_id is an optional
+// client correlation id echoed back.
+type ExecuteRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	MessageType   string                 `protobuf:"bytes,1,opt,name=message_type,json=messageType,proto3" json:"message_type,omitempty"`
+	Payload       []byte                 `protobuf:"bytes,2,opt,name=payload,proto3" json:"payload,omitempty"`
+	RequestId     string                 `protobuf:"bytes,3,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecuteRequest) Reset() {
+	*x = ExecuteRequest{}
+	mi := &file_edge_v1_edge_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecuteRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecuteRequest) ProtoMessage() {}
+
+func (x *ExecuteRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_edge_v1_edge_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecuteRequest.ProtoReflect.Descriptor instead.
+func (*ExecuteRequest) Descriptor() ([]byte, []int) {
+	return file_edge_v1_edge_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ExecuteRequest) GetMessageType() string {
+	if x != nil {
+		return x.MessageType
+	}
+	return ""
+}
+
+func (x *ExecuteRequest) GetPayload() []byte {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *ExecuteRequest) GetRequestId() string {
+	if x != nil {
+		return x.RequestId
+	}
+	return ""
+}
+
+// ExecuteResponse is the unary reply. result_code is "ok" on success or a stable
+// error code; payload is the FlatBuffers-encoded response body (empty on error).
+type ExecuteResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RequestId     string                 `protobuf:"bytes,1,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
+	ResultCode    string                 `protobuf:"bytes,2,opt,name=result_code,json=resultCode,proto3" json:"result_code,omitempty"`
+	Payload       []byte                 `protobuf:"bytes,3,opt,name=payload,proto3" json:"payload,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecuteResponse) Reset() {
+	*x = ExecuteResponse{}
+	mi := &file_edge_v1_edge_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecuteResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecuteResponse) ProtoMessage() {}
+
+func (x *ExecuteResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_edge_v1_edge_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecuteResponse.ProtoReflect.Descriptor instead.
+func (*ExecuteResponse) Descriptor() ([]byte, []int) {
+	return file_edge_v1_edge_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ExecuteResponse) GetRequestId() string {
+	if x != nil {
+		return x.RequestId
+	}
+	return ""
+}
+
+func (x *ExecuteResponse) GetResultCode() string {
+	if x != nil {
+		return x.ResultCode
+	}
+	return ""
+}
+
+func (x *ExecuteResponse) GetPayload() []byte {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+// SubscribeRequest opens the live stream. It is empty: the session is taken from
+// the Authorization header.
+type SubscribeRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SubscribeRequest) Reset() {
+	*x = SubscribeRequest{}
+	mi := &file_edge_v1_edge_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SubscribeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SubscribeRequest) ProtoMessage() {}
+
+func (x *SubscribeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_edge_v1_edge_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SubscribeRequest.ProtoReflect.Descriptor instead.
+func (*SubscribeRequest) Descriptor() ([]byte, []int) {
+	return file_edge_v1_edge_proto_rawDescGZIP(), []int{2}
+}
+
+// Event is one live event. kind is the notification catalog kind; payload is its
+// FlatBuffers-encoded body; event_id is a correlation id.
+type Event struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Kind          string                 `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	Payload       []byte                 `protobuf:"bytes,2,opt,name=payload,proto3" json:"payload,omitempty"`
+	EventId       string                 `protobuf:"bytes,3,opt,name=event_id,json=eventId,proto3" json:"event_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Event) Reset() {
+	*x = Event{}
+	mi := &file_edge_v1_edge_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Event) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Event) ProtoMessage() {}
+
+func (x *Event) ProtoReflect() protoreflect.Message {
+	mi := &file_edge_v1_edge_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Event.ProtoReflect.Descriptor instead.
+func (*Event) Descriptor() ([]byte, []int) {
+	return file_edge_v1_edge_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *Event) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *Event) GetPayload() []byte {
+	if x != nil {
+		return x.Payload
+	}
+	return nil
+}
+
+func (x *Event) GetEventId() string {
+	if x != nil {
+		return x.EventId
+	}
+	return ""
+}
+
+var File_edge_v1_edge_proto protoreflect.FileDescriptor
+
+const file_edge_v1_edge_proto_rawDesc = "" +
+	"\n" +
+	"\x12edge/v1/edge.proto\x12\x10scrabble.edge.v1\"l\n" +
+	"\x0eExecuteRequest\x12!\n" +
+	"\fmessage_type\x18\x01 \x01(\tR\vmessageType\x12\x18\n" +
+	"\apayload\x18\x02 \x01(\fR\apayload\x12\x1d\n" +
+	"\n" +
+	"request_id\x18\x03 \x01(\tR\trequestId\"k\n" +
+	"\x0fExecuteResponse\x12\x1d\n" +
+	"\n" +
+	"request_id\x18\x01 \x01(\tR\trequestId\x12\x1f\n" +
+	"\vresult_code\x18\x02 \x01(\tR\n" +
+	"resultCode\x12\x18\n" +
+	"\apayload\x18\x03 \x01(\fR\apayload\"\x12\n" +
+	"\x10SubscribeRequest\"P\n" +
+	"\x05Event\x12\x12\n" +
+	"\x04kind\x18\x01 \x01(\tR\x04kind\x12\x18\n" +
+	"\apayload\x18\x02 \x01(\fR\apayload\x12\x19\n" +
+	"\bevent_id\x18\x03 \x01(\tR\aeventId2\xa5\x01\n" +
+	"\aGateway\x12N\n" +
+	"\aExecute\x12 .scrabble.edge.v1.ExecuteRequest\x1a!.scrabble.edge.v1.ExecuteResponse\x12J\n" +
+	"\tSubscribe\x12\".scrabble.edge.v1.SubscribeRequest\x1a\x17.scrabble.edge.v1.Event0\x01B'Z%scrabble/gateway/proto/edge/v1;edgev1b\x06proto3"
+
+var (
+	file_edge_v1_edge_proto_rawDescOnce sync.Once
+	file_edge_v1_edge_proto_rawDescData []byte
+)
+
+func file_edge_v1_edge_proto_rawDescGZIP() []byte {
+	file_edge_v1_edge_proto_rawDescOnce.Do(func() {
+		file_edge_v1_edge_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_edge_v1_edge_proto_rawDesc), len(file_edge_v1_edge_proto_rawDesc)))
+	})
+	return file_edge_v1_edge_proto_rawDescData
+}
+
+var file_edge_v1_edge_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_edge_v1_edge_proto_goTypes = []any{
+	(*ExecuteRequest)(nil),   // 0: scrabble.edge.v1.ExecuteRequest
+	(*ExecuteResponse)(nil),  // 1: scrabble.edge.v1.ExecuteResponse
+	(*SubscribeRequest)(nil), // 2: scrabble.edge.v1.SubscribeRequest
+	(*Event)(nil),            // 3: scrabble.edge.v1.Event
+}
+var file_edge_v1_edge_proto_depIdxs = []int32{
+	0, // 0: scrabble.edge.v1.Gateway.Execute:input_type -> scrabble.edge.v1.ExecuteRequest
+	2, // 1: scrabble.edge.v1.Gateway.Subscribe:input_type -> scrabble.edge.v1.SubscribeRequest
+	1, // 2: scrabble.edge.v1.Gateway.Execute:output_type -> scrabble.edge.v1.ExecuteResponse
+	3, // 3: scrabble.edge.v1.Gateway.Subscribe:output_type -> scrabble.edge.v1.Event
+	2, // [2:4] is the sub-list for method output_type
+	0, // [0:2] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_edge_v1_edge_proto_init() }
+func file_edge_v1_edge_proto_init() {
+	if File_edge_v1_edge_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_edge_v1_edge_proto_rawDesc), len(file_edge_v1_edge_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_edge_v1_edge_proto_goTypes,
+		DependencyIndexes: file_edge_v1_edge_proto_depIdxs,
+		MessageInfos:      file_edge_v1_edge_proto_msgTypes,
+	}.Build()
+	File_edge_v1_edge_proto = out.File
+	file_edge_v1_edge_proto_goTypes = nil
+	file_edge_v1_edge_proto_depIdxs = nil
+}

gateway/proto/edge/v1/edge.proto

@@ -0,0 +1,50 @@
+syntax = "proto3";
+
+// Package scrabble.edge.v1 is the client <-> gateway Connect-RPC contract. It is
+// deliberately minimal (ARCHITECTURE.md §2): a single unary Execute that routes
+// by message_type, and a server-streaming Subscribe for the in-app live channel.
+// The actual request/response and event bodies travel as FlatBuffers bytes in the
+// payload fields (pkg/fbs). The session token rides in the Authorization header,
+// not the envelope (no per-request signing — ARCHITECTURE.md §3).
+package scrabble.edge.v1;
+
+option go_package = "scrabble/gateway/proto/edge/v1;edgev1";
+
+// Gateway is the public edge service.
+service Gateway {
+  // Execute runs one unary operation identified by message_type. Auth operations
+  // (auth.*) are unauthenticated and return a minted session; all others require
+  // a valid session token in the Authorization header.
+  rpc Execute(ExecuteRequest) returns (ExecuteResponse);
+  // Subscribe opens the in-app live-event stream for the authenticated session.
+  rpc Subscribe(SubscribeRequest) returns (stream Event);
+}
+
+// ExecuteRequest is the unary envelope. message_type selects the operation;
+// payload is its FlatBuffers-encoded request body; request_id is an optional
+// client correlation id echoed back.
+message ExecuteRequest {
+  string message_type = 1;
+  bytes payload = 2;
+  string request_id = 3;
+}
+
+// ExecuteResponse is the unary reply. result_code is "ok" on success or a stable
+// error code; payload is the FlatBuffers-encoded response body (empty on error).
+message ExecuteResponse {
+  string request_id = 1;
+  string result_code = 2;
+  bytes payload = 3;
+}
+
+// SubscribeRequest opens the live stream. It is empty: the session is taken from
+// the Authorization header.
+message SubscribeRequest {}
+
+// Event is one live event. kind is the notification catalog kind; payload is its
+// FlatBuffers-encoded body; event_id is a correlation id.
+message Event {
+  string kind = 1;
+  bytes payload = 2;
+  string event_id = 3;
+}

gateway/proto/edge/v1/edgev1connect/edge.connect.go

@@ -0,0 +1,150 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: edge/v1/edge.proto
+
+// Package scrabble.edge.v1 is the client <-> gateway Connect-RPC contract. It is
+// deliberately minimal (ARCHITECTURE.md §2): a single unary Execute that routes
+// by message_type, and a server-streaming Subscribe for the in-app live channel.
+// The actual request/response and event bodies travel as FlatBuffers bytes in the
+// payload fields (pkg/fbs). The session token rides in the Authorization header,
+// not the envelope (no per-request signing — ARCHITECTURE.md §3).
+package edgev1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	http "net/http"
+	v1 "scrabble/gateway/proto/edge/v1"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// GatewayName is the fully-qualified name of the Gateway service.
+	GatewayName = "scrabble.edge.v1.Gateway"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// GatewayExecuteProcedure is the fully-qualified name of the Gateway's Execute RPC.
+	GatewayExecuteProcedure = "/scrabble.edge.v1.Gateway/Execute"
+	// GatewaySubscribeProcedure is the fully-qualified name of the Gateway's Subscribe RPC.
+	GatewaySubscribeProcedure = "/scrabble.edge.v1.Gateway/Subscribe"
+)
+
+// GatewayClient is a client for the scrabble.edge.v1.Gateway service.
+type GatewayClient interface {
+	// Execute runs one unary operation identified by message_type. Auth operations
+	// (auth.*) are unauthenticated and return a minted session; all others require
+	// a valid session token in the Authorization header.
+	Execute(context.Context, *connect.Request[v1.ExecuteRequest]) (*connect.Response[v1.ExecuteResponse], error)
+	// Subscribe opens the in-app live-event stream for the authenticated session.
+	Subscribe(context.Context, *connect.Request[v1.SubscribeRequest]) (*connect.ServerStreamForClient[v1.Event], error)
+}
+
+// NewGatewayClient constructs a client for the scrabble.edge.v1.Gateway service. By default, it
+// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
+// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewGatewayClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) GatewayClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	gatewayMethods := v1.File_edge_v1_edge_proto.Services().ByName("Gateway").Methods()
+	return &gatewayClient{
+		execute: connect.NewClient[v1.ExecuteRequest, v1.ExecuteResponse](
+			httpClient,
+			baseURL+GatewayExecuteProcedure,
+			connect.WithSchema(gatewayMethods.ByName("Execute")),
+			connect.WithClientOptions(opts...),
+		),
+		subscribe: connect.NewClient[v1.SubscribeRequest, v1.Event](
+			httpClient,
+			baseURL+GatewaySubscribeProcedure,
+			connect.WithSchema(gatewayMethods.ByName("Subscribe")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// gatewayClient implements GatewayClient.
+type gatewayClient struct {
+	execute   *connect.Client[v1.ExecuteRequest, v1.ExecuteResponse]
+	subscribe *connect.Client[v1.SubscribeRequest, v1.Event]
+}
+
+// Execute calls scrabble.edge.v1.Gateway.Execute.
+func (c *gatewayClient) Execute(ctx context.Context, req *connect.Request[v1.ExecuteRequest]) (*connect.Response[v1.ExecuteResponse], error) {
+	return c.execute.CallUnary(ctx, req)
+}
+
+// Subscribe calls scrabble.edge.v1.Gateway.Subscribe.
+func (c *gatewayClient) Subscribe(ctx context.Context, req *connect.Request[v1.SubscribeRequest]) (*connect.ServerStreamForClient[v1.Event], error) {
+	return c.subscribe.CallServerStream(ctx, req)
+}
+
+// GatewayHandler is an implementation of the scrabble.edge.v1.Gateway service.
+type GatewayHandler interface {
+	// Execute runs one unary operation identified by message_type. Auth operations
+	// (auth.*) are unauthenticated and return a minted session; all others require
+	// a valid session token in the Authorization header.
+	Execute(context.Context, *connect.Request[v1.ExecuteRequest]) (*connect.Response[v1.ExecuteResponse], error)
+	// Subscribe opens the in-app live-event stream for the authenticated session.
+	Subscribe(context.Context, *connect.Request[v1.SubscribeRequest], *connect.ServerStream[v1.Event]) error
+}
+
+// NewGatewayHandler builds an HTTP handler from the service implementation. It returns the path on
+// which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewGatewayHandler(svc GatewayHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	gatewayMethods := v1.File_edge_v1_edge_proto.Services().ByName("Gateway").Methods()
+	gatewayExecuteHandler := connect.NewUnaryHandler(
+		GatewayExecuteProcedure,
+		svc.Execute,
+		connect.WithSchema(gatewayMethods.ByName("Execute")),
+		connect.WithHandlerOptions(opts...),
+	)
+	gatewaySubscribeHandler := connect.NewServerStreamHandler(
+		GatewaySubscribeProcedure,
+		svc.Subscribe,
+		connect.WithSchema(gatewayMethods.ByName("Subscribe")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/scrabble.edge.v1.Gateway/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case GatewayExecuteProcedure:
+			gatewayExecuteHandler.ServeHTTP(w, r)
+		case GatewaySubscribeProcedure:
+			gatewaySubscribeHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedGatewayHandler returns CodeUnimplemented from all methods.
+type UnimplementedGatewayHandler struct{}
+
+func (UnimplementedGatewayHandler) Execute(context.Context, *connect.Request[v1.ExecuteRequest]) (*connect.Response[v1.ExecuteResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("scrabble.edge.v1.Gateway.Execute is not implemented"))
+}
+
+func (UnimplementedGatewayHandler) Subscribe(context.Context, *connect.Request[v1.SubscribeRequest], *connect.ServerStream[v1.Event]) error {
+	return connect.NewError(connect.CodeUnimplemented, errors.New("scrabble.edge.v1.Gateway.Subscribe is not implemented"))
+}