Stage 15: dual Telegram bots & language-gated variants

Service-agnostic refinement of the owner's idea: the sign-in service returns a
set of supported game languages with the user identity, and the lobby gates the
New Game variant choice by it (en -> English; ru -> Russian + Эрудит).

- Connector hosts two bots in one container (one per service language, each its
  own token + game channel; the same telegram_id spans both). ValidateInitData
  tries each token and returns the validating bot's service_language +
  supported_languages. Per-language config (TELEGRAM_BOT_TOKEN_EN/_RU, channels).
- supported_languages rides the Session (fbs, session-scoped, not persisted); the
  UI offers only the matching variants on New Game — gating only the START of a
  new game (auto-match + friend invite), not accept/open/play; backend does not
  enforce.
- service_language persisted (accounts.service_language, migration 00010, written
  every login, last-login-wins) and routes the user-facing Notify push back
  through the right bot (push-target coalesces with preferred_language).
- Admin SendToUser/SendToGameChannel gain an operator-chosen language selector in
  the console (unrelated to ValidateInitData).
- Non-Telegram logins carry the gateway default set
  (GATEWAY_DEFAULT_SUPPORTED_LANGUAGES, all variants).

Wire (committed regen): ValidateInitDataResponse +service_language
+supported_languages; Session +supported_languages; SendToUser/SendToGameChannel
+language. Docs (ARCHITECTURE/FUNCTIONAL/_ru/READMEs) + PLAN updated; stage marked done.

platform/telegram/internal/config/config.go

@@ -10,30 +10,44 @@ import (
 	pkgtel "scrabble/pkg/telemetry"
 )
 
+// Languages is the set of service languages a bot may be tagged with. Each is a
+// separate bot (own token + game channel) serving that audience; the same Telegram
+// user id spans them all (ARCHITECTURE.md §12).
+var Languages = []string{"en", "ru"}
+
+// BotConfig is one language-tagged bot's settings.
+type BotConfig struct {
+	// Token is the Telegram Bot API token (TELEGRAM_BOT_TOKEN_<LANG>). It both
+	// authenticates the Bot API client and is the HMAC secret for Mini App initData
+	// validation against this bot.
+	Token string
+	// GameChannelID is the chat id of this bot's game channel for SendToGameChannel
+	// (TELEGRAM_GAME_CHANNEL_ID_<LANG>, optional; 0 disables channel posts).
+	GameChannelID int64
+}
+
 // Config is the Telegram connector's runtime configuration, read from the
-// environment. The bot token lives only in this process (ARCHITECTURE.md §12).
+// environment. The bot tokens live only in this process (ARCHITECTURE.md §12).
 type Config struct {
-	// BotToken is the Telegram Bot API token (TELEGRAM_BOT_TOKEN, required). It
-	// both authenticates the Bot API client and is the HMAC secret for Mini App
-	// initData validation.
-	BotToken string
+	// Bots maps a service language (one of Languages) to that language's bot
+	// settings. A language is present when its TELEGRAM_BOT_TOKEN_<LANG> is set; at
+	// least one bot is required.
+	Bots map[string]BotConfig
 	// GRPCAddr is the listen address of the connector gRPC server that gateway and
 	// backend call (TELEGRAM_GRPC_ADDR, default :9091).
 	GRPCAddr string
 	// MiniAppURL is the HTTPS origin of the Mini App registered with BotFather; it
 	// is the base of every launch button, to which a deep-link adds a startapp
-	// query parameter (TELEGRAM_MINIAPP_URL, required).
+	// query parameter (TELEGRAM_MINIAPP_URL, required). It is shared by all bots
+	// (one gateway origin); initData is signed per bot token.
 	MiniAppURL string
 	// APIBaseURL overrides the Bot API host (TELEGRAM_API_BASE_URL, optional;
 	// default https://api.telegram.org) — used for a local mock or a self-hosted
-	// Bot API server.
+	// Bot API server. Shared by all bots.
 	APIBaseURL string
 	// TestEnv routes the Bot API client to Telegram's test environment
 	// (.../bot<token>/test/METHOD) (TELEGRAM_TEST_ENV=true, default false).
 	TestEnv bool
-	// GameChannelID is the chat id of the bot's game channel for SendToGameChannel
-	// (TELEGRAM_GAME_CHANNEL_ID, optional; 0 disables channel posts).
-	GameChannelID int64
 	// LogLevel is the zap log level (TELEGRAM_LOG_LEVEL, default info).
 	LogLevel string
 	// Telemetry configures the OpenTelemetry providers (shared bootstrap).
@@ -44,31 +58,40 @@ type Config struct {
 // and validating the required fields.
 func Load() (Config, error) {
 	cfg := Config{
-		BotToken:   os.Getenv("TELEGRAM_BOT_TOKEN"),
+		Bots:       map[string]BotConfig{},
 		GRPCAddr:   envOr("TELEGRAM_GRPC_ADDR", ":9091"),
 		MiniAppURL: os.Getenv("TELEGRAM_MINIAPP_URL"),
 		APIBaseURL: os.Getenv("TELEGRAM_API_BASE_URL"),
 		TestEnv:    os.Getenv("TELEGRAM_TEST_ENV") == "true",
 		LogLevel:   envOr("TELEGRAM_LOG_LEVEL", "info"),
 	}
+	for _, lang := range Languages {
+		suffix := strings.ToUpper(lang)
+		token := os.Getenv("TELEGRAM_BOT_TOKEN_" + suffix)
+		if token == "" {
+			continue
+		}
+		bot := BotConfig{Token: token}
+		if v := strings.TrimSpace(os.Getenv("TELEGRAM_GAME_CHANNEL_ID_" + suffix)); v != "" {
+			id, err := strconv.ParseInt(v, 10, 64)
+			if err != nil {
+				return Config{}, fmt.Errorf("config: TELEGRAM_GAME_CHANNEL_ID_%s %q: %w", suffix, v, err)
+			}
+			bot.GameChannelID = id
+		}
+		cfg.Bots[lang] = bot
+	}
 	tel := pkgtel.DefaultConfig("scrabble-telegram")
 	tel.ServiceName = envOr("TELEGRAM_SERVICE_NAME", tel.ServiceName)
 	tel.TracesExporter = envOr("TELEGRAM_OTEL_TRACES_EXPORTER", tel.TracesExporter)
 	tel.MetricsExporter = envOr("TELEGRAM_OTEL_METRICS_EXPORTER", tel.MetricsExporter)
 	cfg.Telemetry = tel
-	if cfg.BotToken == "" {
-		return Config{}, fmt.Errorf("config: TELEGRAM_BOT_TOKEN is required")
+	if len(cfg.Bots) == 0 {
+		return Config{}, fmt.Errorf("config: at least one TELEGRAM_BOT_TOKEN_<LANG> (LANG in %v) is required", Languages)
 	}
 	if cfg.MiniAppURL == "" {
 		return Config{}, fmt.Errorf("config: TELEGRAM_MINIAPP_URL is required")
 	}
-	if v := strings.TrimSpace(os.Getenv("TELEGRAM_GAME_CHANNEL_ID")); v != "" {
-		id, err := strconv.ParseInt(v, 10, 64)
-		if err != nil {
-			return Config{}, fmt.Errorf("config: TELEGRAM_GAME_CHANNEL_ID %q: %w", v, err)
-		}
-		cfg.GameChannelID = id
-	}
 	if err := cfg.Telemetry.Validate(); err != nil {
 		return Config{}, fmt.Errorf("config: %w", err)
 	}

platform/telegram/internal/config/config_test.go

@@ -6,14 +6,44 @@ import (
 	pkgtel "scrabble/pkg/telemetry"
 )
 
-// setRequired sets the two required connector variables so Load reaches the
-// telemetry checks.
+// setRequired sets the required connector variables (one bot + the Mini App URL)
+// so Load reaches the telemetry checks.
 func setRequired(t *testing.T) {
 	t.Helper()
-	t.Setenv("TELEGRAM_BOT_TOKEN", "test-token")
+	t.Setenv("TELEGRAM_BOT_TOKEN_EN", "test-token")
 	t.Setenv("TELEGRAM_MINIAPP_URL", "https://example.org/app")
 }
 
+// TestLoadBots verifies the per-language bot parsing: a present token enables a
+// language, its channel id is optional, and the result is keyed by language.
+func TestLoadBots(t *testing.T) {
+	t.Setenv("TELEGRAM_MINIAPP_URL", "https://example.org/app")
+	t.Setenv("TELEGRAM_BOT_TOKEN_EN", "en-token")
+	t.Setenv("TELEGRAM_GAME_CHANNEL_ID_EN", "-100111")
+	t.Setenv("TELEGRAM_BOT_TOKEN_RU", "ru-token")
+	c, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if len(c.Bots) != 2 {
+		t.Fatalf("Bots = %d, want 2", len(c.Bots))
+	}
+	if c.Bots["en"].Token != "en-token" || c.Bots["en"].GameChannelID != -100111 {
+		t.Errorf("en bot = %+v", c.Bots["en"])
+	}
+	if c.Bots["ru"].Token != "ru-token" || c.Bots["ru"].GameChannelID != 0 {
+		t.Errorf("ru bot = %+v, want token ru-token / channel 0", c.Bots["ru"])
+	}
+}
+
+// TestLoadRequiresBot verifies Load fails when no bot token is configured.
+func TestLoadRequiresBot(t *testing.T) {
+	t.Setenv("TELEGRAM_MINIAPP_URL", "https://example.org/app")
+	if _, err := Load(); err == nil {
+		t.Fatal("Load: expected an error when no bot token is set, got nil")
+	}
+}
+
 // TestLoadTelemetryDefaults verifies the connector telemetry defaults: the
 // "scrabble-telegram" service name and both exporters off.
 func TestLoadTelemetryDefaults(t *testing.T) {

platform/telegram/internal/connector/server.go

@@ -1,12 +1,18 @@
 // Package connector implements the Telegram gRPC service (pkg/proto/telegram/v1):
 // the gateway calls ValidateInitData (Mini App auth) and Notify (out-of-app push);
-// the admin surface (Stage 10) will call SendToUser and SendToGameChannel. The
-// generic methods address a recipient by the identity external_id, so a future
-// platform connector can implement the same service.
+// the admin surface (Stage 10) calls SendToUser and SendToGameChannel. The generic
+// methods address a recipient by the identity external_id, so a future platform
+// connector can implement the same service.
+//
+// The connector hosts one bot per configured service language (en/ru); the same
+// Telegram user id spans them all. ValidateInitData tries each bot's token in turn
+// and reports which bot validated (its service language); the push and admin
+// methods route to the bot the request selects by language.
 package connector
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strconv"
 
@@ -28,59 +34,103 @@ type Sender interface {
 	SendText(ctx context.Context, chatID int64, text string) error
 }
 
-// Server implements telegramv1.TelegramServer.
-type Server struct {
-	telegramv1.UnimplementedTelegramServer
-	validator       initdata.Validator
-	widgetValidator loginwidget.Validator
-	sender          Sender
-	channelID       int64
-	log             *zap.Logger
+// BotRuntime is one configured language-tagged bot: its sender, game channel id,
+// and the two HMAC validators bound to its token.
+type BotRuntime struct {
+	// Language is the bot's service language (en/ru).
+	Language string
+	// Sender delivers messages through this bot.
+	Sender Sender
+	// ChannelID is this bot's game channel (0 disables channel posts).
+	ChannelID int64
+	// InitValidator verifies Mini App initData signed by this bot's token.
+	InitValidator initdata.Validator
+	// WidgetValidator verifies Login Widget data signed by this bot's token.
+	WidgetValidator loginwidget.Validator
 }
 
-// NewServer builds the gRPC service from the Mini App initData validator, the Login
-// Widget validator (Stage 11), a sender (the bot), and the configured game channel
-// id (0 disables channel posts).
-func NewServer(validator initdata.Validator, widgetValidator loginwidget.Validator, sender Sender, channelID int64, log *zap.Logger) *Server {
+// Server implements telegramv1.TelegramServer over one or more language-tagged bots.
+type Server struct {
+	telegramv1.UnimplementedTelegramServer
+	bots  map[string]BotRuntime // keyed by service language
+	order []string              // stable iteration order for validation
+	log   *zap.Logger
+}
+
+// NewServer builds the gRPC service from the configured bots (at least one).
+func NewServer(bots []BotRuntime, log *zap.Logger) *Server {
 	if log == nil {
 		log = zap.NewNop()
 	}
-	return &Server{validator: validator, widgetValidator: widgetValidator, sender: sender, channelID: channelID, log: log}
+	m := make(map[string]BotRuntime, len(bots))
+	order := make([]string, 0, len(bots))
+	for _, b := range bots {
+		m[b.Language] = b
+		order = append(order, b.Language)
+	}
+	return &Server{bots: m, order: order, log: log}
 }
 
-// ValidateInitData verifies Mini App launch data and returns the user identity.
+// ValidateInitData verifies Mini App launch data against each bot's token in turn
+// and returns the user identity plus the validating bot's service language (which
+// routes the user's later push) and its set of offered game languages.
 func (s *Server) ValidateInitData(ctx context.Context, req *telegramv1.ValidateInitDataRequest) (*telegramv1.ValidateInitDataResponse, error) {
-	u, err := s.validator.Validate(req.GetInitData())
-	if err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
+	var lastErr error
+	for _, lang := range s.order {
+		u, err := s.bots[lang].InitValidator.Validate(req.GetInitData())
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		return &telegramv1.ValidateInitDataResponse{
+			ExternalId:         u.ExternalID,
+			Username:           u.Username,
+			FirstName:          u.FirstName,
+			LanguageCode:       u.LanguageCode,
+			ServiceLanguage:    lang,
+			SupportedLanguages: []string{lang},
+		}, nil
 	}
-	return &telegramv1.ValidateInitDataResponse{
-		ExternalId:   u.ExternalID,
-		Username:     u.Username,
-		FirstName:    u.FirstName,
-		LanguageCode: u.LanguageCode,
-	}, nil
+	if lastErr == nil {
+		lastErr = errors.New("no bot configured")
+	}
+	return nil, status.Error(codes.InvalidArgument, lastErr.Error())
 }
 
-// ValidateLoginWidget verifies Login Widget authorization data and returns the user
-// identity, for attaching a Telegram identity to an existing account (Stage 11).
+// ValidateLoginWidget verifies Login Widget authorization data against each bot's
+// token in turn and returns the user identity, for attaching a Telegram identity to
+// an existing account (Stage 11).
 func (s *Server) ValidateLoginWidget(ctx context.Context, req *telegramv1.ValidateLoginWidgetRequest) (*telegramv1.ValidateLoginWidgetResponse, error) {
-	u, err := s.widgetValidator.Validate(req.GetData())
-	if err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
+	var lastErr error
+	for _, lang := range s.order {
+		u, err := s.bots[lang].WidgetValidator.Validate(req.GetData())
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		return &telegramv1.ValidateLoginWidgetResponse{
+			ExternalId: u.ExternalID,
+			Username:   u.Username,
+			FirstName:  u.FirstName,
+		}, nil
 	}
-	return &telegramv1.ValidateLoginWidgetResponse{
-		ExternalId: u.ExternalID,
-		Username:   u.Username,
-		FirstName:  u.FirstName,
-	}, nil
+	if lastErr == nil {
+		lastErr = errors.New("no bot configured")
+	}
+	return nil, status.Error(codes.InvalidArgument, lastErr.Error())
 }
 
-// Notify renders and delivers an out-of-app notification. It reports
-// delivered=false (without an error) for a kind that is not pushed out-of-app or a
-// delivery the bot could not complete (e.g. the user never started the bot), so the
-// gateway treats a fallback miss as best-effort.
+// Notify renders and delivers an out-of-app notification through the bot selected by
+// the recipient's service language. It reports delivered=false (without an error)
+// when no bot serves that language, the kind is not pushed out-of-app, or the bot
+// could not deliver (e.g. the user never started it), so the gateway treats a
+// fallback miss as best-effort.
 func (s *Server) Notify(ctx context.Context, req *telegramv1.NotifyRequest) (*telegramv1.NotifyResponse, error) {
+	bot, ok := s.bots[req.GetLanguage()]
+	if !ok {
+		s.log.Warn("notify: no bot for language", zap.String("language", req.GetLanguage()), zap.String("kind", req.GetKind()))
+		return &telegramv1.NotifyResponse{Delivered: false}, nil
+	}
 	msg, ok := render.Render(req.GetKind(), req.GetPayload(), req.GetLanguage())
 	if !ok {
 		return &telegramv1.NotifyResponse{Delivered: false}, nil
@@ -89,38 +139,58 @@ func (s *Server) Notify(ctx context.Context, req *telegramv1.NotifyRequest) (*te
 	if err != nil {
 		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
-	if err := s.sender.Notify(ctx, chat, msg.Text, msg.ButtonText, msg.StartParam); err != nil {
+	if err := bot.Sender.Notify(ctx, chat, msg.Text, msg.ButtonText, msg.StartParam); err != nil {
 		s.log.Warn("notify delivery failed", zap.String("kind", req.GetKind()), zap.Error(err))
 		return &telegramv1.NotifyResponse{Delivered: false}, nil
 	}
 	return &telegramv1.NotifyResponse{Delivered: true}, nil
 }
 
-// SendToUser sends an arbitrary admin message to one user.
+// SendToUser sends an arbitrary admin message to one user through the bot selected
+// by language (an operator choice in the admin console).
 func (s *Server) SendToUser(ctx context.Context, req *telegramv1.SendToUserRequest) (*telegramv1.SendResponse, error) {
+	bot, err := s.botFor(req.GetLanguage())
+	if err != nil {
+		return nil, err
+	}
 	chat, err := parseChatID(req.GetExternalId())
 	if err != nil {
 		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
-	if err := s.sender.SendText(ctx, chat, req.GetText()); err != nil {
+	if err := bot.Sender.SendText(ctx, chat, req.GetText()); err != nil {
 		s.log.Warn("send to user failed", zap.Error(err))
 		return &telegramv1.SendResponse{Delivered: false}, nil
 	}
 	return &telegramv1.SendResponse{Delivered: true}, nil
 }
 
-// SendToGameChannel posts an admin message to the configured game channel.
+// SendToGameChannel posts an arbitrary admin message to the game channel of the bot
+// selected by language (an operator choice in the admin console).
 func (s *Server) SendToGameChannel(ctx context.Context, req *telegramv1.SendToGameChannelRequest) (*telegramv1.SendResponse, error) {
-	if s.channelID == 0 {
-		return nil, status.Error(codes.FailedPrecondition, "game channel is not configured")
+	bot, err := s.botFor(req.GetLanguage())
+	if err != nil {
+		return nil, err
 	}
-	if err := s.sender.SendText(ctx, s.channelID, req.GetText()); err != nil {
+	if bot.ChannelID == 0 {
+		return nil, status.Error(codes.FailedPrecondition, fmt.Sprintf("game channel is not configured for language %q", req.GetLanguage()))
+	}
+	if err := bot.Sender.SendText(ctx, bot.ChannelID, req.GetText()); err != nil {
 		s.log.Warn("send to channel failed", zap.Error(err))
 		return &telegramv1.SendResponse{Delivered: false}, nil
 	}
 	return &telegramv1.SendResponse{Delivered: true}, nil
 }
 
+// botFor returns the bot tagged with language, or a FailedPrecondition error when no
+// bot serves it (admin broadcasts choose the language explicitly).
+func (s *Server) botFor(language string) (BotRuntime, error) {
+	bot, ok := s.bots[language]
+	if !ok {
+		return BotRuntime{}, status.Error(codes.FailedPrecondition, fmt.Sprintf("no bot configured for language %q", language))
+	}
+	return bot, nil
+}
+
 // parseChatID converts a Telegram identity external_id into a numeric chat id.
 func parseChatID(externalID string) (int64, error) {
 	id, err := strconv.ParseInt(externalID, 10, 64)

platform/telegram/internal/connector/server_test.go

@@ -56,6 +56,11 @@ func (f *fakeSender) SendText(_ context.Context, chatID int64, text string) erro
 	return f.err
 }
 
+// botRT assembles one language-tagged bot runtime for a test.
+func botRT(lang string, sender Sender, channelID int64, iv initdata.Validator, wv loginwidget.Validator) BotRuntime {
+	return BotRuntime{Language: lang, Sender: sender, ChannelID: channelID, InitValidator: iv, WidgetValidator: wv}
+}
+
 func yourTurnPayload(gameID string) []byte {
 	b := flatbuffers.NewBuilder(0)
 	gid := b.CreateString(gameID)
@@ -66,25 +71,45 @@ func yourTurnPayload(gameID string) []byte {
 }
 
 func TestValidateInitData(t *testing.T) {
-	want := initdata.User{ExternalID: "42", Username: "neo", FirstName: "Thomas", LanguageCode: "ru"}
-	srv := NewServer(stubValidator{user: want}, stubWidgetValidator{}, &fakeSender{}, 0, nil)
+	want := initdata.User{ExternalID: "42", Username: "neo", FirstName: "Thomas", LanguageCode: "en-GB"}
+	srv := NewServer([]BotRuntime{botRT("en", &fakeSender{}, 0, stubValidator{user: want}, stubWidgetValidator{})}, nil)
 	resp, err := srv.ValidateInitData(context.Background(), &telegramv1.ValidateInitDataRequest{InitData: "x"})
 	if err != nil {
 		t.Fatalf("validate: %v", err)
 	}
-	if resp.GetExternalId() != "42" || resp.GetUsername() != "neo" || resp.GetFirstName() != "Thomas" || resp.GetLanguageCode() != "ru" {
+	if resp.GetExternalId() != "42" || resp.GetUsername() != "neo" || resp.GetFirstName() != "Thomas" || resp.GetLanguageCode() != "en-GB" {
 		t.Errorf("resp = %+v, want %+v", resp, want)
 	}
+	if resp.GetServiceLanguage() != "en" || len(resp.GetSupportedLanguages()) != 1 || resp.GetSupportedLanguages()[0] != "en" {
+		t.Errorf("service_language=%q supported=%v, want en / [en]", resp.GetServiceLanguage(), resp.GetSupportedLanguages())
+	}
 
-	bad := NewServer(stubValidator{err: initdata.ErrInvalidInitData}, stubWidgetValidator{}, &fakeSender{}, 0, nil)
+	bad := NewServer([]BotRuntime{botRT("en", &fakeSender{}, 0, stubValidator{err: initdata.ErrInvalidInitData}, stubWidgetValidator{})}, nil)
 	if _, err := bad.ValidateInitData(context.Background(), &telegramv1.ValidateInitDataRequest{}); status.Code(err) != codes.InvalidArgument {
 		t.Errorf("err code = %v, want InvalidArgument", status.Code(err))
 	}
 }
 
+// TestValidateInitDataPicksValidatingBot proves the second bot's token validates and
+// its service language is reported when the first bot rejects the data.
+func TestValidateInitDataPicksValidatingBot(t *testing.T) {
+	want := initdata.User{ExternalID: "7", Username: "ru_user", FirstName: "Иван", LanguageCode: "ru"}
+	srv := NewServer([]BotRuntime{
+		botRT("en", &fakeSender{}, 0, stubValidator{err: initdata.ErrInvalidInitData}, stubWidgetValidator{}),
+		botRT("ru", &fakeSender{}, 0, stubValidator{user: want}, stubWidgetValidator{}),
+	}, nil)
+	resp, err := srv.ValidateInitData(context.Background(), &telegramv1.ValidateInitDataRequest{InitData: "x"})
+	if err != nil {
+		t.Fatalf("validate: %v", err)
+	}
+	if resp.GetExternalId() != "7" || resp.GetServiceLanguage() != "ru" || resp.GetSupportedLanguages()[0] != "ru" {
+		t.Errorf("resp = %+v, want external 7 / service ru", resp)
+	}
+}
+
 func TestValidateLoginWidget(t *testing.T) {
 	want := loginwidget.User{ExternalID: "42", Username: "neo", FirstName: "Thomas"}
-	srv := NewServer(stubValidator{}, stubWidgetValidator{user: want}, &fakeSender{}, 0, nil)
+	srv := NewServer([]BotRuntime{botRT("en", &fakeSender{}, 0, stubValidator{}, stubWidgetValidator{user: want})}, nil)
 	resp, err := srv.ValidateLoginWidget(context.Background(), &telegramv1.ValidateLoginWidgetRequest{Data: "x"})
 	if err != nil {
 		t.Fatalf("validate: %v", err)
@@ -93,7 +118,7 @@ func TestValidateLoginWidget(t *testing.T) {
 		t.Errorf("resp = %+v, want %+v", resp, want)
 	}
 
-	bad := NewServer(stubValidator{}, stubWidgetValidator{err: loginwidget.ErrInvalidLoginWidget}, &fakeSender{}, 0, nil)
+	bad := NewServer([]BotRuntime{botRT("en", &fakeSender{}, 0, stubValidator{}, stubWidgetValidator{err: loginwidget.ErrInvalidLoginWidget})}, nil)
 	if _, err := bad.ValidateLoginWidget(context.Background(), &telegramv1.ValidateLoginWidgetRequest{}); status.Code(err) != codes.InvalidArgument {
 		t.Errorf("err code = %v, want InvalidArgument", status.Code(err))
 	}
@@ -102,7 +127,7 @@ func TestValidateLoginWidget(t *testing.T) {
 func TestNotifyDelivers(t *testing.T) {
 	const gameID = "7c9e6679-7425-40de-944b-e07fc1f90ae7"
 	sender := &fakeSender{}
-	srv := NewServer(stubValidator{}, stubWidgetValidator{}, sender, 0, nil)
+	srv := NewServer([]BotRuntime{botRT("en", sender, 0, stubValidator{}, stubWidgetValidator{})}, nil)
 	resp, err := srv.Notify(context.Background(), &telegramv1.NotifyRequest{
 		ExternalId: "12345", Kind: "your_turn", Payload: yourTurnPayload(gameID), Language: "en",
 	})
@@ -120,9 +145,44 @@ func TestNotifyDelivers(t *testing.T) {
 	}
 }
 
+// TestNotifyRoutesByLanguage proves the push goes through the bot for the recipient's
+// service language, not the other bot.
+func TestNotifyRoutesByLanguage(t *testing.T) {
+	en, ru := &fakeSender{}, &fakeSender{}
+	srv := NewServer([]BotRuntime{
+		botRT("en", en, 0, stubValidator{}, stubWidgetValidator{}),
+		botRT("ru", ru, 0, stubValidator{}, stubWidgetValidator{}),
+	}, nil)
+	resp, err := srv.Notify(context.Background(), &telegramv1.NotifyRequest{
+		ExternalId: "12345", Kind: "your_turn", Payload: yourTurnPayload("7c9e6679-7425-40de-944b-e07fc1f90ae7"), Language: "ru",
+	})
+	if err != nil || !resp.GetDelivered() {
+		t.Fatalf("notify: %v delivered=%v", err, resp.GetDelivered())
+	}
+	if len(ru.notify) != 1 || len(en.notify) != 0 {
+		t.Errorf("routing wrong: ru=%d en=%d, want 1/0", len(ru.notify), len(en.notify))
+	}
+}
+
+// TestNotifyUnknownLanguage proves a push for a language with no bot is a best-effort
+// miss (delivered=false, no delivery attempt), not an error.
+func TestNotifyUnknownLanguage(t *testing.T) {
+	en := &fakeSender{}
+	srv := NewServer([]BotRuntime{botRT("en", en, 0, stubValidator{}, stubWidgetValidator{})}, nil)
+	resp, err := srv.Notify(context.Background(), &telegramv1.NotifyRequest{
+		ExternalId: "12345", Kind: "your_turn", Payload: yourTurnPayload("g"), Language: "ru",
+	})
+	if err != nil {
+		t.Fatalf("notify: %v", err)
+	}
+	if resp.GetDelivered() || len(en.notify) != 0 {
+		t.Errorf("delivered=%v en calls=%d, want false / 0", resp.GetDelivered(), len(en.notify))
+	}
+}
+
 func TestNotifySkipsUnrenderedKind(t *testing.T) {
 	sender := &fakeSender{}
-	srv := NewServer(stubValidator{}, stubWidgetValidator{}, sender, 0, nil)
+	srv := NewServer([]BotRuntime{botRT("en", sender, 0, stubValidator{}, stubWidgetValidator{})}, nil)
 	resp, err := srv.Notify(context.Background(), &telegramv1.NotifyRequest{
 		ExternalId: "12345", Kind: "opponent_moved", Language: "en",
 	})
@@ -138,7 +198,7 @@ func TestNotifySkipsUnrenderedKind(t *testing.T) {
 }
 
 func TestNotifyInvalidExternalID(t *testing.T) {
-	srv := NewServer(stubValidator{}, stubWidgetValidator{}, &fakeSender{}, 0, nil)
+	srv := NewServer([]BotRuntime{botRT("en", &fakeSender{}, 0, stubValidator{}, stubWidgetValidator{})}, nil)
 	_, err := srv.Notify(context.Background(), &telegramv1.NotifyRequest{
 		ExternalId: "not-a-number", Kind: "your_turn", Payload: yourTurnPayload("g"), Language: "en",
 	})
@@ -149,8 +209,8 @@ func TestNotifyInvalidExternalID(t *testing.T) {
 
 func TestSendToUser(t *testing.T) {
 	sender := &fakeSender{}
-	srv := NewServer(stubValidator{}, stubWidgetValidator{}, sender, 0, nil)
-	resp, err := srv.SendToUser(context.Background(), &telegramv1.SendToUserRequest{ExternalId: "999", Text: "hi"})
+	srv := NewServer([]BotRuntime{botRT("en", sender, 0, stubValidator{}, stubWidgetValidator{})}, nil)
+	resp, err := srv.SendToUser(context.Background(), &telegramv1.SendToUserRequest{ExternalId: "999", Text: "hi", Language: "en"})
 	if err != nil {
 		t.Fatalf("send to user: %v", err)
 	}
@@ -159,23 +219,36 @@ func TestSendToUser(t *testing.T) {
 	}
 }
 
+// TestSendToUserUnknownLanguage proves the admin broadcast errors when no bot serves
+// the operator-chosen language.
+func TestSendToUserUnknownLanguage(t *testing.T) {
+	srv := NewServer([]BotRuntime{botRT("en", &fakeSender{}, 0, stubValidator{}, stubWidgetValidator{})}, nil)
+	_, err := srv.SendToUser(context.Background(), &telegramv1.SendToUserRequest{ExternalId: "999", Text: "hi", Language: "ru"})
+	if status.Code(err) != codes.FailedPrecondition {
+		t.Errorf("err code = %v, want FailedPrecondition", status.Code(err))
+	}
+}
+
 func TestSendToGameChannel(t *testing.T) {
 	t.Run("unconfigured", func(t *testing.T) {
-		srv := NewServer(stubValidator{}, stubWidgetValidator{}, &fakeSender{}, 0, nil)
-		_, err := srv.SendToGameChannel(context.Background(), &telegramv1.SendToGameChannelRequest{Text: "x"})
+		srv := NewServer([]BotRuntime{botRT("en", &fakeSender{}, 0, stubValidator{}, stubWidgetValidator{})}, nil)
+		_, err := srv.SendToGameChannel(context.Background(), &telegramv1.SendToGameChannelRequest{Text: "x", Language: "en"})
 		if status.Code(err) != codes.FailedPrecondition {
 			t.Errorf("err code = %v, want FailedPrecondition", status.Code(err))
 		}
 	})
-	t.Run("configured", func(t *testing.T) {
-		sender := &fakeSender{}
-		srv := NewServer(stubValidator{}, stubWidgetValidator{}, sender, 555, nil)
-		resp, err := srv.SendToGameChannel(context.Background(), &telegramv1.SendToGameChannelRequest{Text: "news"})
+	t.Run("configured routes by language", func(t *testing.T) {
+		en, ru := &fakeSender{}, &fakeSender{}
+		srv := NewServer([]BotRuntime{
+			botRT("en", en, 111, stubValidator{}, stubWidgetValidator{}),
+			botRT("ru", ru, 555, stubValidator{}, stubWidgetValidator{}),
+		}, nil)
+		resp, err := srv.SendToGameChannel(context.Background(), &telegramv1.SendToGameChannelRequest{Text: "news", Language: "ru"})
 		if err != nil {
 			t.Fatalf("send to channel: %v", err)
 		}
-		if !resp.GetDelivered() || len(sender.text) != 1 || sender.text[0].chatID != 555 {
-			t.Errorf("send to channel calls = %+v", sender.text)
+		if !resp.GetDelivered() || len(ru.text) != 1 || ru.text[0].chatID != 555 || len(en.text) != 0 {
+			t.Errorf("send to channel: ru=%+v en=%+v", ru.text, en.text)
 		}
 	})
 }