Merge pull request 'release: v1.4.0 — Telegram launch diagnostic + dynamic SDK load' (#127) from development into master

The diagnostic showed only sdk: yes/no (window.Telegram presence), not why the
SDK was absent. Capture how the dynamic telegram-web-app.js load resolved —
present / loaded / no-webapp / error / timeout — and surface it as
"sdk-load: <outcome>". error/timeout pinpoint a blocked or hanging telegram.org
(the prime suspect for an empty launch); no-webapp a loaded-but-broken script.

loadTelegramSDK records the outcome (telegramSdkOutcome); collectTelegramDiag
carries it into the screen. Unit tests cover each outcome; the blocked-script
e2e now asserts sdk-load: error.

backend/internal/account/account.go

@@ -119,6 +119,16 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
 	return s.provision(ctx, kind, externalID, provisionSeed{})
 }
 
+// ProvisionEmail returns the account owning the email identity externalID, creating
+// it (unconfirmed) on first contact with browserTZ — the client's detected "±HH:MM"
+// UTC offset — seeded into its time zone. Like ProvisionByIdentity it is race-safe
+// and leaves an existing account untouched, so a returning user's saved zone is never
+// overwritten. The email account is created here (the code-request step), not at the
+// later login, so this is where its zone is seeded.
+func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ string) (Account, error) {
+	return s.provision(ctx, KindEmail, externalID, provisionSeed{timeZone: seedZone(browserTZ)})
+}
+
 // ProvisionRobot provisions (or finds) the durable account backing a robot pool
 // member: a KindRobot identity carrying displayName, with chat blocked but friend
 // requests NOT blocked — a request to a robot is accepted as pending and, since the
@@ -160,7 +170,7 @@ func (s *Store) ProvisionRobot(ctx context.Context, externalID, displayName stri
 // is never overwritten. The created flag lets the auth handler re-evaluate moderated-
 // chat write access on first registration — the path of a user who joined the chat
 // before registering, whom no chat_member event covers.
-func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName string) (Account, bool, error) {
+func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName, browserTZ string) (Account, bool, error) {
 	// Pre-check whether the identity already exists so the caller can act on first
 	// contact. A race with a concurrent create only over- or under-reports created for
 	// that one call, which the idempotent chat-access re-evaluation tolerates.
@@ -169,7 +179,9 @@ func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode,
 	if err != nil && !created {
 		return Account{}, false, err
 	}
-	acc, err := s.provision(ctx, KindTelegram, externalID, telegramSeed(languageCode, username, firstName))
+	seed := telegramSeed(languageCode, username, firstName)
+	seed.timeZone = seedZone(browserTZ)
+	acc, err := s.provision(ctx, KindTelegram, externalID, seed)
 	return acc, created, err
 }
 
@@ -197,12 +209,24 @@ func (s *Store) provision(ctx context.Context, kind, externalID string, seed pro
 }
 
 // provisionSeed carries the optional create-time profile seed for a brand-new
-// account (Telegram first contact). Empty fields fall back to the accounts table
-// defaults, so an unknown language keeps the 'en' default and an empty name keeps
-// the ” default.
+// account (first contact). Empty fields fall back to the accounts table defaults,
+// so an unknown language keeps the 'en' default, an empty name keeps the ” default
+// and an empty time zone keeps the 'UTC' default.
 type provisionSeed struct {
 	preferredLanguage string
 	displayName       string
+	timeZone          string
+}
+
+// seedZone returns browserTZ when it is a well-formed zone to persist at account
+// creation (a "±HH:MM" offset or a loadable IANA name), else "" so the new account
+// falls back to the accounts table's 'UTC' default. The client reports the device's
+// detected offset deterministically; a bad value is dropped rather than guessed at.
+func seedZone(browserTZ string) string {
+	if validZone(browserTZ) {
+		return browserTZ
+	}
+	return ""
 }
 
 // telegramSeed derives the create-time seed from Telegram launch fields: a
@@ -368,16 +392,22 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 
 	var created Account
 	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Seed the new row's display name and language (Telegram first contact); an
-		// empty seed reproduces the table defaults ('' and 'en') the other callers
-		// relied on, so their behaviour is unchanged.
+		// Seed the new row's display name, language and time zone (first contact); an
+		// empty seed reproduces the table defaults ('', 'en' and 'UTC') the other callers
+		// relied on, so their behaviour is unchanged. time_zone is written explicitly (the
+		// detected offset, or 'UTC' equal to the column default) so a seeded zone lands at
+		// creation while an unseeded one stays UTC.
 		lang := seed.preferredLanguage
 		if lang == "" {
 			lang = "en"
 		}
+		tz := seed.timeZone
+		if tz == "" {
+			tz = "UTC"
+		}
 		insertAccount := table.Accounts.
-			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage).
-			VALUES(accountID, seed.displayName, lang).
+			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone).
+			VALUES(accountID, seed.displayName, lang, tz).
 			RETURNING(table.Accounts.AllColumns)
 
 		var row model.Accounts
@@ -416,15 +446,21 @@ const guestDisplayName = "Guest"
 // ProvisionGuest creates a fresh ephemeral guest account: a durable row carrying
 // no identity, flagged is_guest, so it can hold a session and a game seat (both
 // foreign-key the accounts table) while being excluded from statistics, friends
-// and history. Guests are not reused — each bootstrap mints a new account.
-func (s *Store) ProvisionGuest(ctx context.Context) (Account, error) {
+// and history. Guests are not reused — each bootstrap mints a new account. browserTZ
+// (the client's detected "±HH:MM" UTC offset) seeds the guest's time zone, falling
+// back to the 'UTC' default when empty or malformed.
+func (s *Store) ProvisionGuest(ctx context.Context, browserTZ string) (Account, error) {
 	accountID, err := uuid.NewV7()
 	if err != nil {
 		return Account{}, fmt.Errorf("account: new guest id: %w", err)
 	}
+	tz := seedZone(browserTZ)
+	if tz == "" {
+		tz = "UTC"
+	}
 	stmt := table.Accounts.
-		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest).
-		VALUES(accountID, guestDisplayName, true).
+		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest, table.Accounts.TimeZone).
+		VALUES(accountID, guestDisplayName, true, tz).
 		RETURNING(table.Accounts.AllColumns)
 
 	var row model.Accounts

backend/internal/account/email.go

@@ -131,13 +131,15 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 // the unauthenticated email-login entry point and, unlike RequestCode,
 // does not refuse an already-confirmed email — that is the ordinary returning-user
 // login. The code is mailed to the address, so only its real owner can complete
-// the login. It returns the target account id for the subsequent LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email string) (uuid.UUID, error) {
+// the login. On first contact browserTZ (the client's detected "±HH:MM" UTC offset)
+// seeds the new account's time zone. It returns the target account id for the
+// subsequent LoginWithCode.
+func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ string) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	acc, err := s.store.ProvisionByIdentity(ctx, KindEmail, addr)
+	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ)
 	if err != nil {
 		return uuid.UUID{}, err
 	}

backend/internal/inttest/account_test.go

@@ -110,15 +110,15 @@ func identityConfirmed(t *testing.T, kind, externalID string) bool {
 }
 
 // TestProvisionTelegramSeedsNewAccountOnly checks that Telegram first contact
-// seeds the new account's language and display name from the launch fields,
-// defaults the in-app-only flag on, and never overwrites an existing account on a
-// later login (language seeding).
+// seeds the new account's language, display name and time zone from the launch
+// fields / detected offset, defaults the in-app-only flag on, and never overwrites
+// an existing account on a later login (language and zone seeding).
 func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	ext := "tg-" + uuid.NewString()
 
-	acc, created, err := store.ProvisionTelegram(ctx, ext, "ru-RU", "thehandle", "Иван")
+	acc, created, err := store.ProvisionTelegram(ctx, ext, "ru-RU", "thehandle", "Иван", "+03:00")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -131,12 +131,15 @@ func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	if acc.DisplayName != "Иван" {
 		t.Errorf("DisplayName = %q, want Иван", acc.DisplayName)
 	}
+	if acc.TimeZone != "+03:00" {
+		t.Errorf("TimeZone = %q, want the seeded +03:00", acc.TimeZone)
+	}
 	if !acc.NotificationsInAppOnly {
 		t.Error("NotificationsInAppOnly should default to true")
 	}
 
 	// A later login with different fields returns the same account, unchanged.
-	again, created, err := store.ProvisionTelegram(ctx, ext, "en", "other", "Other")
+	again, created, err := store.ProvisionTelegram(ctx, ext, "en", "other", "Other", "+09:00")
 	if err != nil {
 		t.Fatalf("re-provision telegram: %v", err)
 	}
@@ -146,8 +149,53 @@ func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	if again.ID != acc.ID {
 		t.Errorf("re-provision id = %s, want %s", again.ID, acc.ID)
 	}
-	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван" {
-		t.Errorf("existing account overwritten: lang=%q name=%q", again.PreferredLanguage, again.DisplayName)
+	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван" || again.TimeZone != "+03:00" {
+		t.Errorf("existing account overwritten: lang=%q name=%q tz=%q", again.PreferredLanguage, again.DisplayName, again.TimeZone)
+	}
+}
+
+// TestProvisionSeedsTimeZone checks the create-time time-zone seed across paths: a
+// valid detected offset is stored verbatim (even "+00:00", which is deliberately
+// distinct from the unset "UTC" default), a guest is seeded the same way, and a
+// missing or malformed offset falls back to the "UTC" column default rather than
+// being guessed at.
+func TestProvisionSeedsTimeZone(t *testing.T) {
+	ctx := context.Background()
+	store := account.NewStore(testDB)
+
+	// A detected zero offset is written as "+00:00" — we record that the zone was
+	// detected (and equals UTC), distinct from the "UTC" default meaning "unknown".
+	utcDetected, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Zero", "+00:00")
+	if err != nil {
+		t.Fatalf("provision telegram +00:00: %v", err)
+	}
+	if utcDetected.TimeZone != "+00:00" {
+		t.Errorf("TimeZone = %q, want the seeded +00:00", utcDetected.TimeZone)
+	}
+
+	// A malformed offset is dropped: the account keeps the UTC default.
+	bad, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Bad", "not-a-zone")
+	if err != nil {
+		t.Fatalf("provision telegram bad tz: %v", err)
+	}
+	if bad.TimeZone != "UTC" {
+		t.Errorf("TimeZone = %q, want UTC fallback for a malformed offset", bad.TimeZone)
+	}
+
+	// A guest is seeded its detected offset; an empty one keeps the UTC default.
+	guest, err := store.ProvisionGuest(ctx, "-05:30")
+	if err != nil {
+		t.Fatalf("provision guest: %v", err)
+	}
+	if guest.TimeZone != "-05:30" {
+		t.Errorf("guest TimeZone = %q, want the seeded -05:30", guest.TimeZone)
+	}
+	plainGuest, err := store.ProvisionGuest(ctx, "")
+	if err != nil {
+		t.Fatalf("provision plain guest: %v", err)
+	}
+	if plainGuest.TimeZone != "UTC" {
+		t.Errorf("plain guest TimeZone = %q, want UTC default", plainGuest.TimeZone)
 	}
 }
 
@@ -156,7 +204,7 @@ func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 // language CHECK.
 func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 	ctx := context.Background()
-	acc, _, err := account.NewStore(testDB).ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "fr", "", "")
+	acc, _, err := account.NewStore(testDB).ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "fr", "", "", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -172,7 +220,7 @@ func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 func TestHighRateFlagRoundTrip(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
+	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -228,7 +276,7 @@ func TestIdentityExternalID(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	ext := "tg-" + uuid.NewString()
-	acc, _, err := store.ProvisionTelegram(ctx, ext, "en", "", "Tg User")
+	acc, _, err := store.ProvisionTelegram(ctx, ext, "en", "", "Tg User", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -253,7 +301,7 @@ func TestIdentityExternalID(t *testing.T) {
 func TestNotificationsInAppOnlyRoundTrip(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
+	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}

backend/internal/inttest/admin_test.go

@@ -222,7 +222,7 @@ func TestConsoleGameDetailRobotSchedule(t *testing.T) {
 func TestConsoleThrottledViewAndFlagClear(t *testing.T) {
 	ctx := context.Background()
 	accounts := account.NewStore(testDB)
-	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Throttled Player")
+	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Throttled Player", "")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}

backend/internal/inttest/chat_access_test.go

@@ -55,7 +55,7 @@ func TestChatAccessResolver(t *testing.T) {
 	srv := server.New(":0", server.Deps{Logger: zaptest.NewLogger(t), DB: testDB, Accounts: accounts})
 
 	ext := "tg-" + uuid.NewString()
-	acc, _, err := accounts.ProvisionTelegram(ctx, ext, "en", "", "Chatter")
+	acc, _, err := accounts.ProvisionTelegram(ctx, ext, "en", "", "Chatter", "")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}

backend/internal/inttest/email_test.go

@@ -206,7 +206,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	svc := account.NewEmailService(account.NewStore(testDB), mailer)
 	email := "login-" + uuid.NewString() + "@example.com"
 
-	accountID, err := svc.RequestLoginCode(ctx, email)
+	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00")
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -225,12 +225,15 @@ func TestEmailLoginFlow(t *testing.T) {
 	if acc.IsGuest {
 		t.Error("an email account must be durable, not a guest")
 	}
+	if acc.TimeZone != "+02:00" {
+		t.Errorf("TimeZone = %q, want the +02:00 seeded at the request step", acc.TimeZone)
+	}
 	if !identityConfirmed(t, account.KindEmail, email) {
 		t.Error("the email identity must be confirmed after login")
 	}
 
 	// A second login for the same email is the returning user: same account.
-	if _, err := svc.RequestLoginCode(ctx, email); err != nil {
+	if _, err := svc.RequestLoginCode(ctx, email, ""); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))

backend/internal/inttest/helpers.go

@@ -120,7 +120,7 @@ func provisionAccount(t *testing.T) uuid.UUID {
 // provisionGuest creates a fresh ephemeral guest account and returns its id.
 func provisionGuest(t *testing.T) uuid.UUID {
 	t.Helper()
-	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background())
+	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background(), "")
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}

backend/internal/inttest/suspension_gate_test.go

@@ -38,7 +38,7 @@ func TestSuspensionGate(t *testing.T) {
 		Accounts: accounts,
 	})
 
-	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "", "Blocked")
+	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "", "Blocked", "")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}

backend/internal/inttest/userlist_test.go

@@ -18,7 +18,7 @@ func TestUserListFilter(t *testing.T) {
 	st := account.NewStore(testDB)
 	uniq := uuid.NewString()
 
-	human, _, err := st.ProvisionTelegram(ctx, "tg-"+uniq, "en", "", "Zzqxhuman")
+	human, _, err := st.ProvisionTelegram(ctx, "tg-"+uniq, "en", "", "Zzqxhuman", "")
 	if err != nil {
 		t.Fatalf("provision human: %v", err)
 	}
@@ -26,7 +26,7 @@ func TestUserListFilter(t *testing.T) {
 	if err != nil {
 		t.Fatalf("provision robot: %v", err)
 	}
-	guest, err := st.ProvisionGuest(ctx)
+	guest, err := st.ProvisionGuest(ctx, "")
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}

backend/internal/server/handlers_auth.go

@@ -18,12 +18,14 @@ import (
 
 // telegramAuthRequest carries the identity the connector extracted from a
 // validated initData payload. Username, FirstName and LanguageCode seed a
-// brand-new account's display name and language (first contact only).
+// brand-new account's display name and language; BrowserTZ (the client's detected
+// "±HH:MM" UTC offset) seeds its time zone (first contact only).
 type telegramAuthRequest struct {
 	ExternalID   string `json:"external_id"`
 	Username     string `json:"username"`
 	FirstName    string `json:"first_name"`
 	LanguageCode string `json:"language_code"`
+	BrowserTZ    string `json:"browser_tz"`
 }
 
 // handleTelegramAuth provisions (or finds) the account bound to a Telegram
@@ -35,7 +37,7 @@ func (s *Server) handleTelegramAuth(c *gin.Context) {
 		abortBadRequest(c, "external_id is required")
 		return
 	}
-	acc, created, err := s.accounts.ProvisionTelegram(c.Request.Context(), req.ExternalID, req.LanguageCode, req.Username, req.FirstName)
+	acc, created, err := s.accounts.ProvisionTelegram(c.Request.Context(), req.ExternalID, req.LanguageCode, req.Username, req.FirstName, req.BrowserTZ)
 	if err != nil {
 		s.abortErr(c, err)
 		return
@@ -97,9 +99,21 @@ func (s *Server) handlePushTarget(c *gin.Context) {
 	})
 }
 
-// handleGuestAuth provisions a fresh ephemeral guest account and mints a session.
+// guestAuthRequest carries the guest bootstrap's optional time-zone seed: BrowserTZ
+// (the client's detected "±HH:MM" UTC offset) is written to the new guest account's
+// time zone, so robot timing is anchored to the player's zone from the first game.
+type guestAuthRequest struct {
+	BrowserTZ string `json:"browser_tz"`
+}
+
+// handleGuestAuth provisions a fresh ephemeral guest account and mints a session,
+// seeding its time zone from the optional detected browser offset.
 func (s *Server) handleGuestAuth(c *gin.Context) {
-	acc, err := s.accounts.ProvisionGuest(c.Request.Context())
+	// The body is optional: an absent or malformed one simply yields no time-zone seed
+	// (the account keeps the UTC default), so a bind error must not fail the bootstrap.
+	var req guestAuthRequest
+	_ = c.ShouldBindJSON(&req)
+	acc, err := s.accounts.ProvisionGuest(c.Request.Context(), req.BrowserTZ)
 	if err != nil {
 		s.abortErr(c, err)
 		return
@@ -107,9 +121,12 @@ func (s *Server) handleGuestAuth(c *gin.Context) {
 	s.mintSession(c, acc)
 }
 
-// emailRequest is an email-login code request.
+// emailRequest is an email-login code request. BrowserTZ (the client's detected
+// "±HH:MM" UTC offset) seeds the time zone of an account provisioned here on first
+// contact (the email account is created at the request step, not at login).
 type emailRequest struct {
-	Email string `json:"email"`
+	Email     string `json:"email"`
+	BrowserTZ string `json:"browser_tz"`
 }
 
 // handleEmailRequest issues a login confirm-code to the email. It always reports
@@ -121,7 +138,7 @@ func (s *Server) handleEmailRequest(c *gin.Context) {
 		abortBadRequest(c, "email is required")
 		return
 	}
-	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email); err != nil {
+	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ); err != nil {
 		s.abortErr(c, err)
 		return
 	}

deploy/README.md

@@ -150,7 +150,9 @@ Re-run `ansible/` after a host resize — it is idempotent.
 workflow manually (Gitea → Actions → prod-deploy → run from `master`, input
 `confirm=deploy`). It builds + pushes the images to the registry, ships the
 compose/config/certs/env over SSH, deploys the main host with `prod-deploy.sh` (rolling,
-health-gated, **auto-rollback to the previous tag**), then the bot host, then probes the
+health-gated, **auto-rollback to the previous tag**; caddy is force-recreated on its roll so
+a bind-mounted `Caddyfile` change applies — its image is pinned and admin is off, so neither a
+new tag nor a hot reload would pick it up), then the bot host, then probes the
 public site. After `master` is green this workflow is the **only** thing that touches
 prod — nothing auto-deploys there. It runs four visible jobs: **build → deploy-main →
 deploy-bot → verify** (the per-service rolling shows in the deploy-main log).

deploy/caddy/Caddyfile

@@ -21,6 +21,18 @@
 }
 
 {$CADDY_SITE_ADDRESS::80} {
+	# HTTP/3 is advertised by default whenever this caddy terminates TLS (prod:
+	# CADDY_SITE_ADDRESS is the domain). But UDP/443 is never reachable — the prod
+	# compose maps only "443:443" (TCP) and ufw opens 443/tcp — so a client that cached
+	# the `Alt-Svc: h3` advert (sticky for ma=2592000s) stalls on the dead QUIC path
+	# before falling back to h2, which surfaced as the Telegram Mini App intermittently
+	# hanging on load. `Alt-Svc: clear` actively drops any cached alternative and pins
+	# clients to h2/h1; it is applied site-wide so every route is covered. In the test
+	# contour this caddy serves plain :80 (no h3 to advertise) and the host caddy
+	# re-stamps its own Alt-Svc, so the live test fix lives in the host caddy — here it
+	# is the prod fix. Background + alternatives (incl. serving h3 for real): docs/EDGE_HTTP3.md.
+	header Alt-Svc clear
+
 	# Operator surfaces under /_gm: a single shared Basic-Auth, then route.
 	@gm path /_gm /_gm/*
 	handle @gm {

deploy/grafana/dashboards/resources.json

@@ -36,7 +36,21 @@
       "type": "stat",
       "title": "Database size",
       "gridPos": { "h": 5, "w": 6, "x": 18, "y": 0 },
-      "fieldConfig": { "defaults": { "unit": "bytes" }, "overrides": [] },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "bytes",
+          "color": { "mode": "thresholds" },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              { "color": "green", "value": null },
+              { "color": "yellow", "value": 8589934592 },
+              { "color": "red", "value": 17179869184 }
+            ]
+          }
+        },
+        "overrides": []
+      },
       "datasource": { "type": "prometheus", "uid": "prometheus" },
       "targets": [{ "refId": "A", "expr": "max(pg_database_size_bytes{datname=\"scrabble\"})" }]
     },

deploy/prod-deploy.sh

@@ -74,7 +74,13 @@ health_running() { # health_running <container>: running, not restarting, stable
 roll() { # roll <service> <health-cmd...>
   local svc="$1"; shift
   echo ">>> rolling $svc -> $TAG"
-  dc up -d --no-build --no-deps "$svc" || return 1
+  # caddy's image is pinned (caddy:2-alpine, no $TAG) and its Caddyfile is bind-mounted, so a
+  # config-only change leaves the compose definition unchanged: `up -d` treats the container as
+  # current and does not recreate it, and admin is off so there is no hot reload — the new
+  # Caddyfile would never load. Force a recreate for caddy so config changes always apply; every
+  # other service already recreates on its new $TAG image.
+  local recreate=(); [ "$svc" = caddy ] && recreate=(--force-recreate)
+  dc up -d --no-build --no-deps "${recreate[@]}" "$svc" || return 1
   "$@" || { echo "!!! $svc failed health check"; return 1; }
   echo "<<< $svc healthy"
 }

docs/ARCHITECTURE.md

@@ -158,7 +158,12 @@ arrive from a platform rather than completing a mandatory registration).
   rendered in the recipient's **interface language** (`preferred_language`, en/ru), not in
   any bot-scoped language, and the friend-invite **share link** (and its caption) point at
   that one bot. First Telegram contact seeds the new account's `preferred_language` from the
-  launch `language_code` (§4); the interface language is otherwise edited in Settings.
+  launch `language_code` (§4), but the **interface language follows the device** — the system
+  guess, or an explicit Settings choice saved locally — and the bot never dictates the UI.
+  `preferred_language` is then **reconciled to the active interface locale on every session
+  adopt** (not only on a Settings change; a no-op for guests and when already equal), so the
+  server-rendered language surfaces — this push and the ad banner — always match the UI rather
+  than stranding a user who never opened Settings on the creation-time seed.
 - **Variant preferences (New Game gating).** Which variants a player may be matched into is a
   per-user **profile** setting — `variant_preferences`, a set of `engine.Variant` labels
   (`scrabble_en`, `scrabble_ru`, `erudit_ru`) edited on the Settings/Profile screen. New
@@ -640,7 +645,7 @@ in either direction (the enqueue excludes the caller's `BlockedWith` set);
   **floats games with any unread entry to the top** of the your-turn and opponent-turn
   sections (the finished section keeps its activity order). On each clear the publish-to-read
   latency is recorded; the read time itself is not retained.
-- **Profile**: `preferred_language` (en/ru, edited in Settings), display name, email
+- **Profile**: `preferred_language` (en/ru; tracks the interface language — §4), display name, email
   (confirm-code binding, see §4), **timezone**, the daily **away window**, the
   **variant preferences** (`variant_preferences`, the matchable-variant set that gates New
   Game — §3, defaulting to Erudit only, at least one enforced) and the
@@ -649,7 +654,11 @@ in either direction (the enqueue excludes the caller's `BlockedWith` set);
   separators (no leading/trailing/adjacent separators, ≤ 32 runes); the timezone is a
   fixed `±HH:MM` **UTC offset** (or a legacy IANA name) resolved by `account.ResolveZone`
   for the sweeper and the robot's sleep (a fixed offset trades DST for a simple
-  picker); the away window is at most **12 h** (midnight-wrap aware). Linked platform
+  picker), and is **seeded at account creation** from the client's detected offset — sent
+  on the Telegram / guest / email first-contact request — so the robot's sleep and the
+  away-window sweeper are anchored to the player's real zone from the first game rather
+  than the `UTC` default (an undetected or malformed offset keeps the default); the away
+  window is at most **12 h** (midnight-wrap aware). Linked platform
   accounts and merge are covered in §4.
 
 ## 9. Persistence
@@ -1031,8 +1040,9 @@ a dedicated redeem sub-limit or a longer code is the hardening step if abuse app
 Single public origin, path-routed. The Vite build has two entries: a lightweight
 **landing page** and the game **SPA**. The gateway **embeds** the SPA build
 (`go:embed`, baked in by a node stage in `gateway/Dockerfile`) and serves it at
-`/app/` (web) and `/telegram/` (the Telegram Mini App; outside Telegram that path
-redirects to the root — the client-side guard); a stray hit on the gateway's `/`
+`/app/` (web) and `/telegram/` (the Telegram Mini App; on that path without sign-in data
+— no `initData` — the client renders a compact, shareable launch-diagnostic screen instead
+of redirecting away); a stray hit on the gateway's `/`
 308-redirects to `/app/`. The **landing** ships in its own static container: the
 `landing` target of `gateway/Dockerfile` (caddy:2-alpine + the same Vite build,
 `deploy/landing/Caddyfile`) serves it at `/`, so stray public traffic is absorbed by
@@ -1089,7 +1099,10 @@ Two contours, two secret/variable prefixes (`TEST_` / `PROD_`):
   the **main host** runs the full stack (`docker-compose.yml` + `docker-compose.prod.yml`),
   the **bot host** runs only the bot (`docker-compose.bot.yml`, no VPN — native Bot API
   egress, telemetry off). There is no host caddy, so the contour caddy terminates TLS —
-  `CADDY_SITE_ADDRESS` is the domain and caddy does its own ACME. The gateway **publishes**
+  `CADDY_SITE_ADDRESS` is the domain and caddy does its own ACME. Caddy advertises HTTP/3 by default, but UDP/443 is not exposed (the
+  compose maps only TCP and ufw opens 443/tcp), so the edge emits `Alt-Svc: clear` to keep
+  clients on h2/h1 rather than stall on a dead QUIC path — see [`EDGE_HTTP3.md`](EDGE_HTTP3.md).
+  The gateway **publishes**
   the bot-link `:9443`; the remote bot dials it over mTLS (certs from `PROD_BOTLINK_*`,
   ServerName `gateway`, so TLS validation is independent of the public dial address), holds
   no inbound port, and login is unaffected if that host or the link is down.

docs/EDGE_HTTP3.md

@@ -0,0 +1,111 @@
+# Edge HTTP/3 (`Alt-Svc`) policy
+
+## TL;DR
+
+The edge **advertises HTTP/3 but does not actually serve it** (UDP/443 is not exposed),
+so we suppress the advert with `Alt-Svc: clear`. Advertising QUIC on `:443/udp` while
+that port is unreachable makes clients — notably the Telegram Mini App webview — stall
+on a dead QUIC connection before falling back to h2, which shows up as the app "hanging
+on load".
+
+## Symptom
+
+Opening the Mini App intermittently hangs on load: from a barely-noticeable pause to
+several seconds, sometimes a blank window that never finishes downloading `index.html`.
+Intermittent, worse after the first successful visit, reproduced on both the test
+contour and prod.
+
+## Root cause
+
+Caddy enables HTTP/3 by default on any TLS listener and emits
+`Alt-Svc: h3=":443"; ma=2592000` — telling every client "reach me over QUIC/UDP 443"
+and to cache that for 30 days. But UDP/443 is **never reachable end to end**:
+
+- **Test contour**: the host caddy publishes only `:443/tcp` (`docker port caddy` shows
+  no `udp`); QUIC packets from the internet are dropped.
+- **Prod**: `deploy/docker-compose.prod.yml` maps `"443:443"` (Docker = **TCP only**)
+  and `deploy/ansible/roles/main/tasks/main.yml` opens 443 `proto: tcp`. UDP/443 is
+  dropped at both the publish and the firewall.
+
+Caddy *does* bind `udp/443` inside the container and h3 works container-to-container
+(verified `http=3 code=200`), so the listener is healthy — it is simply not exposed.
+
+A client that cached the advert tries QUIC first on later opens, gets no response, and
+waits for the QUIC attempt to time out before falling back to TCP/h2. That wait is the
+stall. The very first visit (no cached `Alt-Svc`) uses h2 and is fast.
+
+The h2/TCP serving path itself is healthy: 30 fresh-TLS requests through the full path
+(host caddy -> contour caddy -> gateway) measured TTFB ~9.5 ms, total ~9.8 ms, no tail;
+`index.html` is ~1 KB.
+
+## Fix in place (option A — suppress the advert)
+
+Emit `Alt-Svc: clear`, which actively drops any cached alternative (better than merely
+deleting the header, which leaves the sticky 30-day cache in place):
+
+- **Prod / repo**: `deploy/caddy/Caddyfile` — a site-level `header Alt-Svc clear` (this
+  caddy terminates TLS in prod).
+- **Test contour**: the host caddy terminates TLS, so the fix lives there (homelab
+  config, outside this repo): `header Alt-Svc clear` on the `scrabble.*` site. The
+  in-compose caddy serves plain `:80` in test and never advertises h3, so the repo
+  directive is a harmless no-op there (the host caddy re-stamps the header).
+
+`header Alt-Svc clear` overrides Caddy's auto-advert (verified) and is site-scoped.
+
+### Verify
+
+The runner/prod host shell cannot reach the Docker bridge IPs directly, so probe from a
+container on the relevant network, using `--resolve` to hit the TLS-terminating caddy by
+its bridge IP (this also bypasses the public-IP NAT hairpin):
+
+```sh
+# <edge-ip> = the TLS-terminating caddy's IP on its network (docker inspect ... )
+docker run --rm --network edge curlimages/curl:latest -sS -D - -o /dev/null \
+  --resolve <host>:443:<edge-ip> https://<host>/telegram/ | grep -iE '^HTTP|^alt-svc'
+# expect: HTTP/2 200, and NO `alt-svc: h3=...` (the header is absent or `alt-svc: clear`)
+```
+
+## If it recurs — alternatives to try
+
+So we do not re-derive the diagnosis from scratch:
+
+1. **Re-confirm the advert is actually suppressed** with the verify command above. A
+   redeploy or a Caddy upgrade could regress it, or a client may still hold a cached
+   `h3` entry that has not yet been replaced by a `clear` (it needs one successful h2
+   response to receive the `clear`).
+2. **Option B — serve HTTP/3 for real** instead of suppressing it. Worth it only if we
+   actually want QUIC (the benefit is marginal for a ~1 KB shell plus hash-immutable
+   cached assets, and it adds UDP/QUIC attack surface):
+   - Publish UDP: add `"443:443/udp"` next to the TCP map in
+     `deploy/docker-compose.prod.yml` (and publish udp/443 on the test host caddy too).
+   - Open the firewall: add a `443 proto: udp` rule in
+     `deploy/ansible/roles/main/tasks/main.yml`.
+   - Drop the `header Alt-Svc clear` so Caddy advertises h3 again.
+   - Verify with an h3 client from inside the network:
+     `docker run --rm --network edge ymuski/curl-http3 curl --http3-only ...` should
+     return `http=3 code=200`.
+3. **Look past the edge** if the advert is suppressed and stalls persist. The h2 path is
+   fast server-side, so a remaining stall is most likely the client network / RTT / the
+   provider, not our stack. Re-run the timing loop (below) to confirm the server is
+   still <~10 ms TTFB before chasing the client side.
+
+## How this was diagnosed (method, to repeat)
+
+- The runner/prod host shell cannot reach the Docker bridge subnets, so all probing runs
+  from a throwaway container on the target network (`docker run --network <net>
+  curlimages/curl`), using `--resolve <host>:443:<edge-ip>` to bypass the public-IP NAT
+  hairpin and exercise the real TLS path.
+- Compare a fresh-connection timing loop (worst case, full TLS each time) against a
+  keepalive batch to separate handshake cost from serving cost:
+
+  ```sh
+  docker run --rm --network edge curlimages/curl:latest sh -c '
+    for i in $(seq 1 30); do
+      curl -sS -o /dev/null --resolve <host>:443:<edge-ip> \
+        -w "http=%{http_version} code=%{http_code} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n" \
+        https://<host>/telegram/
+    done'
+  ```
+
+- `docker port <caddy>` shows whether `udp/443` is actually published; the response
+  `Alt-Svc` header shows what the edge advertises. The two disagreeing is the bug.

docs/FUNCTIONAL.md

@@ -213,6 +213,9 @@ block **overrides but does not delete** an existing friendship (so you may block
 they keep seeing you as one); active games are never interrupted — you can finish them, with
 the blocked opponent's chat composer hidden (only the log remains). Blocking from a game card
 mirrors the block in **Settings → Friends**; **unblock** and **unfriend** live there only.
+On Settings → Friends each friend is a one-line row whose right-hand kebab (⋮) slides open
+**block 🚫** and **remove ✖️** icon actions, and each action is gated by a confirmation
+that names the friend (*Block this player?* / *Remove from friends?*).
 Blocking an **auto-match opponent who is secretly a robot** behaves the same in that game
 (struck name, hidden composer) and lists the blocked opponent under the name you saw, but is
 recorded only against that game — the disguise holds, the shared robot is never globally
@@ -241,7 +244,8 @@ also clears the moment its recipient **takes their move**.
 Edit the display name (letters joined by a single space / "." / "_" separator, with an
 optional trailing "." or a trailing run of up to five digits, up to 32 characters and at most
 5 special characters — the "." / "_" punctuation, spaces and digits aside), the timezone
-(chosen as a UTC offset), the
+(chosen as a UTC offset, and pre-filled from your device's detected offset when the account
+is first created — so robot games are timed correctly before you ever open this form), the
 daily away window (on a 10-minute grid, at most 12 hours, wrapping midnight) and the
 block toggles. The profile form is edited inline (no separate edit mode). Linking
 an email or Telegram and merging accounts are covered under "Accounts, linking &

docs/FUNCTIONAL_ru.md

@@ -218,6 +218,9 @@ _Вход сейчас только через провайдера, поэто
 заблокированного соперника «подвал» чата скрыт (остаётся только лог). Блокировка с карточки в
 партии повторяет блокировку в **Настройках → Друзья**; **разблокировка** и **удаление из друзей**
 есть только там.
+В **Настройках → Друзья** каждый друг — однострочник, чей правый кебаб (⋮) выдвигает
+иконки-действия **заблокировать 🚫** и **удалить ✖️**, и каждое действие подтверждается
+диалогом с именем друга (*Заблокировать?* / *Удалить из друзей?*).
 Блокировка **авто-матч соперника, который втайне робот**, в этой партии ведёт себя так же
 (зачёркнутое имя, скрытый «подвал») и в списке заблокированных показывается под тем именем,
 которое ты видел, но записывается только для этой партии — маскировка сохраняется, общий
@@ -248,8 +251,9 @@ _Вход сейчас только через провайдера, поэто
 Редактирование отображаемого имени (буквы, разделённые одиночным пробелом / «.» /
 «_», с необязательной завершающей «.» или хвостом до пяти цифр, до 32 символов и не
 более 5 спецсимволов — пунктуации «.» / «_», пробелы и цифры не в счёт), таймзоны (выбор смещения от
-UTC), суточного окна отсутствия (away; сетка по 10 минут, не более 12 часов, с
-переходом через полночь) и переключателей блокировок. Форма профиля редактируется
+UTC; при создании аккаунта она подставляется из определённого смещения устройства — чтобы
+игры с роботом таймились правильно ещё до открытия этой формы), суточного окна отсутствия
+(away; сетка по 10 минут, не более 12 часов, с переходом через полночь) и переключателей блокировок. Форма профиля редактируется
 сразу (без отдельного режима редактирования). Привязка email и Telegram, а также
 слияние аккаунтов вынесены в раздел «Аккаунты, привязка и слияние».
 

docs/UI_DESIGN.md

@@ -8,7 +8,13 @@ emoji glyphs. Tokens are CSS custom properties (`ui/src/app.css`), light/dark vi
 `prefers-color-scheme` or an explicit Settings choice, and **Telegram-themed**:
 on a Telegram Mini App launch — the app is served under `/telegram/` and detects the
 launch by `Telegram.WebApp.initData` — the SDK's `themeParams` override the tokens at
-runtime; opened outside Telegram, the `/telegram/` path redirects to the site root.
+runtime; on that path without sign-in data (no `initData` — outside Telegram, or a Mini App
+launch that delivered none, as seen on some Android clients) the app renders a compact,
+shareable launch-diagnostic screen (`screens/TelegramLaunchError.svelte`) rather than
+redirecting to the site root. `telegram-web-app.js` is loaded **dynamically with a timeout**,
+only on a Telegram entry — not a render-blocking `<script>` in the shared `index.html` shell —
+so a network that blocks `telegram.org` cannot hang the page; `/app/` (web) and the native build
+never load it.
 
 ## Layout shell (`components/Screen.svelte`)
 

gateway/internal/backendclient/api.go

@@ -184,8 +184,10 @@ type ChatResp struct {
 }
 
 // TelegramAuth provisions/finds the Telegram account and mints a session, seeding a
-// brand-new account's display name and language from the validated launch fields.
-func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, username, firstName string) (SessionResp, error) {
+// brand-new account's display name and language from the validated launch fields and
+// its time zone from browserTz (the client's detected "±HH:MM" UTC offset; first
+// contact only).
+func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, username, firstName, browserTz string) (SessionResp, error) {
 	var out SessionResp
 	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/telegram", "", "",
 		map[string]string{
@@ -193,6 +195,7 @@ func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, use
 			"language_code": languageCode,
 			"username":      username,
 			"first_name":    firstName,
+			"browser_tz":    browserTz,
 		}, &out)
 	return out, err
 }
@@ -243,17 +246,21 @@ func (c *Client) ChatAccessByUser(ctx context.Context, userID string) (ChatAcces
 	return out, err
 }
 
-// GuestAuth provisions a guest account and mints a session.
-func (c *Client) GuestAuth(ctx context.Context) (SessionResp, error) {
+// GuestAuth provisions a guest account and mints a session, seeding its time zone
+// from browserTz (the client's detected "±HH:MM" UTC offset).
+func (c *Client) GuestAuth(ctx context.Context, browserTz string) (SessionResp, error) {
 	var out SessionResp
-	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/guest", "", "", struct{}{}, &out)
+	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/guest", "", "",
+		map[string]string{"browser_tz": browserTz}, &out)
 	return out, err
 }
 
-// EmailRequest asks the backend to mail a login code.
-func (c *Client) EmailRequest(ctx context.Context, email string) error {
+// EmailRequest asks the backend to mail a login code, provisioning the account on
+// first contact; browserTz (the client's detected "±HH:MM" UTC offset) seeds the new
+// account's time zone, since the email account is created here, not at login.
+func (c *Client) EmailRequest(ctx context.Context, email, browserTz string) error {
 	return c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/email/request", "", "",
-		map[string]string{"email": email}, nil)
+		map[string]string{"email": email, "browser_tz": browserTz}, nil)
 }
 
 // EmailLogin verifies a login code and mints a session.

gateway/internal/transcode/transcode.go

@@ -158,7 +158,7 @@ func authTelegramHandler(backend *backendclient.Client, tg TelegramValidator) Ha
 		if err != nil {
 			return nil, err
 		}
-		sess, err := backend.TelegramAuth(ctx, user.ExternalID, user.LanguageCode, user.Username, user.FirstName)
+		sess, err := backend.TelegramAuth(ctx, user.ExternalID, user.LanguageCode, user.Username, user.FirstName, string(in.BrowserTz()))
 		if err != nil {
 			return nil, err
 		}
@@ -167,8 +167,15 @@ func authTelegramHandler(backend *backendclient.Client, tg TelegramValidator) Ha
 }
 
 func authGuestHandler(backend *backendclient.Client) Handler {
-	return func(ctx context.Context, _ Request) ([]byte, error) {
-		sess, err := backend.GuestAuth(ctx)
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		// The guest bootstrap historically carried no payload; the detected zone is
+		// optional, so an absent or empty one simply yields no time-zone seed (rather
+		// than panicking in GetRootAs* on a zero-length buffer).
+		var browserTz string
+		if len(req.Payload) > 0 {
+			browserTz = string(fb.GetRootAsGuestLoginRequest(req.Payload, 0).BrowserTz())
+		}
+		sess, err := backend.GuestAuth(ctx, browserTz)
 		if err != nil {
 			return nil, err
 		}
@@ -179,7 +186,7 @@ func authGuestHandler(backend *backendclient.Client) Handler {
 func authEmailRequestHandler(backend *backendclient.Client) Handler {
 	return func(ctx context.Context, req Request) ([]byte, error) {
 		in := fb.GetRootAsEmailRequestRequest(req.Payload, 0)
-		if err := backend.EmailRequest(ctx, string(in.Email())); err != nil {
+		if err := backend.EmailRequest(ctx, string(in.Email()), string(in.BrowserTz())); err != nil {
 			return nil, err
 		}
 		return encodeAck(true), nil

pkg/fbs/scrabble.fbs

@@ -99,24 +99,33 @@ table MoveRecord {
 // --- auth (unauthenticated) ---
 
 // TelegramLoginRequest carries the platform launch data; the gateway validates
-// its HMAC before forwarding the extracted identity to the backend.
+// its HMAC before forwarding the extracted identity to the backend. browser_tz is
+// the client's detected UTC offset ("±HH:MM"), seeded into a brand-new account's
+// time zone so the robot's sleep window and the turn-timeout away window are
+// anchored to the player's real zone from first contact (first contact only).
 table TelegramLoginRequest {
   init_data:string;
+  browser_tz:string;
 }
 
 // GuestLoginRequest bootstraps an ephemeral guest session. locale is an optional
-// preferred-language hint.
+// preferred-language hint; browser_tz is the detected UTC offset seeded into the
+// guest account's time zone (see TelegramLoginRequest.browser_tz).
 table GuestLoginRequest {
   locale:string;
+  browser_tz:string;
 }
 
-// EmailRequestRequest asks the backend to send a login confirm-code to email.
+// EmailRequestRequest asks the backend to send a login confirm-code to email. It
+// also provisions the account on first contact, so browser_tz (the detected UTC
+// offset) is seeded into its time zone here, not at the later login step.
 table EmailRequestRequest {
   email:string;
+  browser_tz:string;
 }
 
-// EmailLoginRequest logs in (or provisions) the account owning email, verifying
-// the confirm-code.
+// EmailLoginRequest logs in to the account owning email (provisioned at the
+// request step), verifying the confirm-code.
 table EmailLoginRequest {
   email:string;
   code:string;

pkg/fbs/scrabblefb/EmailRequestRequest.go

@@ -49,12 +49,23 @@ func (rcv *EmailRequestRequest) Email() []byte {
 	return nil
 }
 
+func (rcv *EmailRequestRequest) BrowserTz() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
 func EmailRequestRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(1)
+	builder.StartObject(2)
 }
 func EmailRequestRequestAddEmail(builder *flatbuffers.Builder, email flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(email), 0)
 }
+func EmailRequestRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(browserTz), 0)
+}
 func EmailRequestRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

pkg/fbs/scrabblefb/GuestLoginRequest.go

@@ -49,12 +49,23 @@ func (rcv *GuestLoginRequest) Locale() []byte {
 	return nil
 }
 
+func (rcv *GuestLoginRequest) BrowserTz() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
 func GuestLoginRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(1)
+	builder.StartObject(2)
 }
 func GuestLoginRequestAddLocale(builder *flatbuffers.Builder, locale flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(locale), 0)
 }
+func GuestLoginRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(browserTz), 0)
+}
 func GuestLoginRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

pkg/fbs/scrabblefb/TelegramLoginRequest.go

@@ -49,12 +49,23 @@ func (rcv *TelegramLoginRequest) InitData() []byte {
 	return nil
 }
 
+func (rcv *TelegramLoginRequest) BrowserTz() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
 func TelegramLoginRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(1)
+	builder.StartObject(2)
 }
 func TelegramLoginRequestAddInitData(builder *flatbuffers.Builder, initData flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(initData), 0)
 }
+func TelegramLoginRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(browserTz), 0)
+}
 func TelegramLoginRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

platform/telegram/README.md

@@ -38,10 +38,17 @@ Telegram identity to an account from a browser. Both map a rejection to gRPC
   operator-chosen for broadcasts) with a Mini App launch button and sends it. It replies
   with an `Ack` per command (`delivered` mirrors the former connector semantics —
   false when the kind is not rendered out-of-app or the user never started the bot).
-- **Bot chat.** `/start <payload>` (and the chat menu button) reply with a Mini App
-  launch button; a deep-link payload routes the launch to a game / invitation / friend
-  code. This is **self-contained** — the bot never calls back into the game, so `/start`
-  onboarding works even when the game is down.
+- **Bot chat.** `/start <payload>` (and the chat menu button) reply with a localized
+  welcome and a Mini App launch button; a deep-link payload routes the launch to a game /
+  invitation / friend code. The welcome is **Russian or English** by the sender's reported
+  Telegram language (`Message.from.language_code`, which the Bot API carries on the message
+  itself — no separate user-update event — English fallback) and links the game channel and
+  discussion chat by their public `@username`, **resolved once at startup** from
+  `TELEGRAM_GAME_CHANNEL_ID` / `TELEGRAM_CHAT_ID` via `getChat` (a chat that is unset,
+  private, or unreadable degrades that link to a generic noun — "the channel" / "our
+  chat" — rather than a dangling "@"). This is otherwise **self-contained**
+  — the bot never calls back into the game, so `/start` onboarding works even when the game
+  is down.
 - **Moderated-chat gating.** When `TELEGRAM_CHAT_ID` names a channel's linked discussion
   group, the bot gates who may write there. The group **allows sending by default** (a
   human setting) and the bot only **restricts** — Telegram intersects the chat default with

platform/telegram/cmd/bot/main.go

@@ -72,6 +72,7 @@ func run(ctx context.Context, cfg config.BotConfig, logger *zap.Logger) error {
 		MiniAppURL:        cfg.MiniAppURL,
 		SendRatePerSecond: cfg.SendRatePerSecond,
 		ChatID:            cfg.ChatID,
+		GameChannelID:     cfg.GameChannelID,
 	}, logger)
 	if err != nil {
 		return err

platform/telegram/internal/bot/bot.go

@@ -33,8 +33,12 @@ type Config struct {
 	SendRatePerSecond int
 	// ChatID is the moderated discussion chat the bot gates write access in; 0
 	// disables chat gating (and the chat_member long-poll subscription). Gating needs
-	// the bot to be an administrator there with the restrict-members right.
+	// the bot to be an administrator there with the restrict-members right. Its public
+	// @username is also resolved at startup for the /start welcome's discussion link.
 	ChatID int64
+	// GameChannelID is the game channel whose public @username the /start welcome links
+	// to (resolved from this id via getChat at startup); 0 omits that follow link.
+	GameChannelID int64
 }
 
 // EligibilityResolver answers whether the Telegram user identified by externalID
@@ -54,6 +58,13 @@ type Bot struct {
 	limiter *rate.Limiter
 	// chatID is the moderated discussion chat (0 disables gating).
 	chatID int64
+	// channelID is the game channel (0 omits its welcome follow link).
+	channelID int64
+	// channelUsername and chatUsername are the public @usernames (without the leading
+	// @) of the game channel and the discussion chat, resolved once at startup
+	// (resolveWelcomeHandles) for the /start welcome's follow links; "" when unresolved.
+	channelUsername string
+	chatUsername    string
 	// botID is the bot's own Telegram user id (resolved at startup); it skips the
 	// chat_member updates the bot's own restrict actions generate — the grant loop guard.
 	botID int64
@@ -69,7 +80,7 @@ func New(cfg Config, log *zap.Logger) (*Bot, error) {
 	if log == nil {
 		log = zap.NewNop()
 	}
-	t := &Bot{miniAppURL: cfg.MiniAppURL, log: log, chatID: cfg.ChatID}
+	t := &Bot{miniAppURL: cfg.MiniAppURL, log: log, chatID: cfg.ChatID, channelID: cfg.GameChannelID}
 	if cfg.SendRatePerSecond > 0 {
 		t.limiter = rate.NewLimiter(rate.Limit(cfg.SendRatePerSecond), cfg.SendRatePerSecond)
 	}
@@ -123,9 +134,43 @@ func (t *Bot) Run(ctx context.Context) {
 	if t.chatID != 0 {
 		t.logChatAdminStatus(ctx)
 	}
+	t.resolveWelcomeHandles(ctx)
 	t.api.Start(ctx)
 }
 
+// resolveWelcomeHandles resolves, once at startup, the public @usernames of the game
+// channel and the discussion chat from their configured ids (getChat), caching them for
+// the /start welcome's follow links. It runs before the update loop, so the handles are
+// set before any /start is handled; a chat that is unset, private (no public username)
+// or unreadable simply leaves its handle empty and the welcome omits that follow link.
+func (t *Bot) resolveWelcomeHandles(ctx context.Context) {
+	t.channelUsername = t.resolveUsername(ctx, t.channelID, "game channel")
+	t.chatUsername = t.resolveUsername(ctx, t.chatID, "discussion chat")
+}
+
+// resolveUsername returns the public @username (without the leading @) of the chat with
+// the given id, or "" when id is 0, the chat has no public username, or getChat fails —
+// logging the reason, since a missing handle silently drops a welcome follow link.
+func (t *Bot) resolveUsername(ctx context.Context, id int64, label string) string {
+	if id == 0 {
+		return ""
+	}
+	chat, err := t.api.GetChat(ctx, &tgbot.GetChatParams{ChatID: id})
+	if err != nil {
+		t.log.Warn("welcome: getChat failed; follow link omitted",
+			zap.String("chat", label), zap.Int64("id", id), zap.Error(err))
+		return ""
+	}
+	if chat.Username == "" {
+		t.log.Warn("welcome: chat has no public @username; follow link omitted",
+			zap.String("chat", label), zap.Int64("id", id))
+		return ""
+	}
+	t.log.Info("welcome: resolved follow link",
+		zap.String("chat", label), zap.String("username", chat.Username))
+	return chat.Username
+}
+
 // logChatAdminStatus checks, at startup, whether the bot can actually gate the
 // moderated chat — it must be an administrator there with the restrict-members
 // ("Ban users") right, or Telegram delivers no chat_member updates and restricts
@@ -198,11 +243,19 @@ func (t *Bot) handleStart(ctx context.Context, api *tgbot.Bot, update *models.Up
 	if update.Message.Chat.Type != models.ChatTypePrivate {
 		return
 	}
+	// The sender's Telegram language rides on the message itself (Message.from.language_code
+	// in the Bot API — there is no separate user-update event); fall back to English when it
+	// is absent.
+	lang := ""
+	if update.Message.From != nil {
+		lang = update.Message.From.LanguageCode
+	}
+	text, button := startText(lang, t.channelUsername, t.chatUsername)
 	startParam := startPayload(update.Message.Text)
 	if _, err := api.SendMessage(ctx, &tgbot.SendMessageParams{
 		ChatID:      update.Message.Chat.ID,
-		Text:        "Tap to open Scrabble.",
-		ReplyMarkup: t.launchMarkup("Open Scrabble", startParam),
+		Text:        text,
+		ReplyMarkup: t.launchMarkup(button, startParam),
 	}); err != nil {
 		t.log.Warn("reply to start failed", zap.Error(err))
 	}

platform/telegram/internal/bot/bot_test.go

@@ -29,6 +29,10 @@ func (f *fakeBotAPI) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		f.text = r.FormValue("text")
 		f.replyMarkup = r.FormValue("reply_markup")
 		io.WriteString(w, `{"ok":true,"result":{"message_id":1}}`)
+	case strings.HasSuffix(r.URL.Path, "/getChat"):
+		// Echo the requested id into the username so a resolver test can tell the
+		// channel lookup from the chat lookup.
+		io.WriteString(w, `{"ok":true,"result":{"id":-100,"type":"channel","username":"u`+r.FormValue("chat_id")+`"}}`)
 	default:
 		io.WriteString(w, `{"ok":true,"result":true}`)
 	}
@@ -105,7 +109,7 @@ func TestTestEnvironmentRoutesGetMe(t *testing.T) {
 }
 
 func TestHandleStartRepliesPrivateOnly(t *testing.T) {
-	t.Run("private replies", func(t *testing.T) {
+	t.Run("private replies in english by default", func(t *testing.T) {
 		api := &fakeBotAPI{}
 		b := newTestBot(t, api)
 		b.handleStart(context.Background(), b.api, &models.Update{Message: &models.Message{
@@ -114,6 +118,35 @@ func TestHandleStartRepliesPrivateOnly(t *testing.T) {
 		if api.chatID != "42" || !strings.Contains(api.replyMarkup, "web_app") {
 			t.Errorf("private /start: chat=%q markup=%q, want a web_app reply", api.chatID, api.replyMarkup)
 		}
+		// No reported language -> English welcome + English button.
+		if !strings.Contains(api.text, "Hi!") {
+			t.Errorf("text = %q, want the English welcome", api.text)
+		}
+		if !strings.Contains(api.replyMarkup, "Open") {
+			t.Errorf("reply_markup = %q, want the English button", api.replyMarkup)
+		}
+	})
+	t.Run("uses the sender's reported language", func(t *testing.T) {
+		api := &fakeBotAPI{}
+		b := newTestBot(t, api)
+		b.handleStart(context.Background(), b.api, &models.Update{Message: &models.Message{
+			Chat: models.Chat{ID: 42, Type: models.ChatTypePrivate}, Text: "/start",
+			From: &models.User{ID: 7, LanguageCode: "ru"},
+		}})
+		if !strings.Contains(api.text, "Привет!") {
+			t.Errorf("text = %q, want the Russian welcome for a ru sender", api.text)
+		}
+	})
+	t.Run("embeds resolved follow handles", func(t *testing.T) {
+		api := &fakeBotAPI{}
+		b := newTestBot(t, api)
+		b.channelUsername, b.chatUsername = "erudit", "erudite_chat"
+		b.handleStart(context.Background(), b.api, &models.Update{Message: &models.Message{
+			Chat: models.Chat{ID: 42, Type: models.ChatTypePrivate}, Text: "/start",
+		}})
+		if !strings.Contains(api.text, "@erudit") || !strings.Contains(api.text, "@erudite_chat") {
+			t.Errorf("text = %q, want the follow handles", api.text)
+		}
 	})
 	t.Run("group ignored", func(t *testing.T) {
 		api := &fakeBotAPI{}
@@ -127,6 +160,26 @@ func TestHandleStartRepliesPrivateOnly(t *testing.T) {
 	})
 }
 
+func TestResolveWelcomeHandles(t *testing.T) {
+	api := &fakeBotAPI{}
+	b := newTestBot(t, api)
+	b.channelID, b.chatID = 111, 222
+	b.resolveWelcomeHandles(context.Background())
+	// The fake echoes the requested id into the username, so each lookup is independent.
+	if b.channelUsername != "u111" {
+		t.Errorf("channelUsername = %q, want u111", b.channelUsername)
+	}
+	if b.chatUsername != "u222" {
+		t.Errorf("chatUsername = %q, want u222", b.chatUsername)
+	}
+	// An unset id resolves to no handle (and makes no getChat call).
+	b.channelID = 0
+	b.resolveWelcomeHandles(context.Background())
+	if b.channelUsername != "" {
+		t.Errorf("channelUsername = %q, want empty for id 0", b.channelUsername)
+	}
+}
+
 func TestStartPayload(t *testing.T) {
 	cases := map[string]string{
 		"/start g123":  "g123",

platform/telegram/internal/bot/welcome.go

@@ -0,0 +1,60 @@
+package bot
+
+import "strings"
+
+// startText returns the localized /start welcome body and the launch-button label.
+// Russian is used when lang (the IETF language tag the Telegram client reports on the
+// message's sender) starts with "ru", English otherwise and when it is absent — so a
+// user with no reported language still gets a sensible message. channel and chat are
+// the resolved public @usernames (without the leading @) of the game channel and the
+// discussion chat; when either is empty its follow link degrades to a generic noun
+// (e.g. "the channel" / "our chat") rather than rendering a dangling "@", since the
+// bot's own info screen still lists the real links.
+func startText(lang, channel, chat string) (text, button string) {
+	if strings.HasPrefix(strings.ToLower(lang), "ru") {
+		return ruWelcome(channel, chat), "Открыть «Эрудит»"
+	}
+	return enWelcome(channel, chat), "Open “Erudite”"
+}
+
+// ruWelcome builds the Russian welcome. A known handle is named as "@<username>"; an
+// unresolved one degrades to a plain noun.
+func ruWelcome(channel, chat string) string {
+	ch := "канал"
+	if channel != "" {
+		ch = "@" + channel
+	}
+	ct := "чате"
+	if chat != "" {
+		ct = "@" + chat
+	}
+	return strings.Join([]string{
+		"Привет! 👋",
+		"Здесь можно сражаться в «Эрудит» со случайными игроками или в компании друзей.",
+		"Подписывайтесь на " + ch + ", чтобы быть в курсе последних игровых событий и вовремя " +
+			"получать важные уведомления. Игроки могут обсуждать игру и просто общаться в нашем " +
+			ct + "! 💬",
+		"Ни слова больше.\nПервая партия сама себя не сыграет 😊",
+	}, "\n\n")
+}
+
+// enWelcome builds the English welcome (the fallback for any non-Russian or missing
+// language). A known handle is named as "@<username>"; an unresolved one degrades to a
+// plain noun.
+func enWelcome(channel, chat string) string {
+	ch := "the channel"
+	if channel != "" {
+		ch = "@" + channel
+	}
+	ct := "group chat"
+	if chat != "" {
+		ct = "@" + chat
+	}
+	return strings.Join([]string{
+		"Hi! 👋",
+		"Play Scrabble against random players — or with a group of friends.",
+		"Follow " + ch + " to stay up to date with the latest game events and receive important " +
+			"notifications in time. Players can discuss the game and simply chat in our " + ct + "! 💬",
+		"Okay, no more talking.\nFirst game won't play itself 😊",
+	}, "\n\n")
+}

platform/telegram/internal/bot/welcome_test.go

@@ -0,0 +1,73 @@
+package bot
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestStartTextLocalizesByLanguage(t *testing.T) {
+	cases := []struct {
+		name       string
+		lang       string
+		wantButton string
+		wantSubstr string // a phrase unique to the chosen language body
+	}{
+		{"russian", "ru", "Открыть «Эрудит»", "Привет!"},
+		{"russian region tag", "ru-RU", "Открыть «Эрудит»", "Первая партия"},
+		{"english", "en", "Open “Erudite”", "Hi!"},
+		{"other language falls back to english", "de", "Open “Erudite”", "Hi!"},
+		{"absent language falls back to english", "", "Open “Erudite”", "no more talking"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			text, button := startText(tc.lang, "erudit", "erudite_chat")
+			if button != tc.wantButton {
+				t.Errorf("button = %q, want %q", button, tc.wantButton)
+			}
+			if !strings.Contains(text, tc.wantSubstr) {
+				t.Errorf("text %q does not contain %q", text, tc.wantSubstr)
+			}
+		})
+	}
+}
+
+func TestStartTextEmbedsFollowHandles(t *testing.T) {
+	for _, lang := range []string{"ru", "en"} {
+		text, _ := startText(lang, "erudit", "erudite_chat")
+		if !strings.Contains(text, "@erudit") || !strings.Contains(text, "@erudite_chat") {
+			t.Errorf("lang %q: follow paragraph missing the handles: %q", lang, text)
+		}
+	}
+}
+
+func TestStartTextFallsBackToGenericWhenHandleMissing(t *testing.T) {
+	// An unresolved handle degrades to a generic noun rather than a dangling "@" — and
+	// only that slot degrades; a resolved sibling still shows its "@username".
+	t.Run("both missing leaves no @", func(t *testing.T) {
+		for _, lang := range []string{"ru", "en"} {
+			text, _ := startText(lang, "", "")
+			if strings.Contains(text, "@") {
+				t.Errorf("lang %q: text shows a dangling @: %q", lang, text)
+			}
+		}
+		// The generic nouns are present in each language.
+		ru, _ := startText("ru", "", "")
+		if !strings.Contains(ru, "на канал") || !strings.Contains(ru, "в нашем чате") {
+			t.Errorf("russian generic fallback missing: %q", ru)
+		}
+		en, _ := startText("en", "", "")
+		if !strings.Contains(en, "Follow the channel") || !strings.Contains(en, "in our group chat") {
+			t.Errorf("english generic fallback missing: %q", en)
+		}
+	})
+	t.Run("only the missing slot degrades", func(t *testing.T) {
+		// Channel resolved, chat missing: the channel keeps its @handle, the chat is generic.
+		en, _ := startText("en", "erudit", "")
+		if !strings.Contains(en, "@erudit") || strings.Contains(en, "@erudite") {
+			t.Errorf("channel handle not shown / chat handle leaked: %q", en)
+		}
+		if !strings.Contains(en, "in our group chat") {
+			t.Errorf("chat slot did not degrade to a generic noun: %q", en)
+		}
+	})
+}

ui/e2e/fixtures.ts

@@ -1,13 +1,13 @@
 import { test as base } from '@playwright/test';
 
 // All e2e specs run hermetically against the mock transport. Neutralise the real
-// telegram-web-app.js (loaded from the CDN in index.html) so the suite never blocks
-// on telegram.org — it is unreachable from the CI runner, and a render-blocking
-// <script> to it would hang every page load. Specs that exercise the Telegram launch
-// inject their own window.Telegram via addInitScript before navigating.
+// telegram-web-app.js (the app loads it dynamically — see lib/telegram.ts loadTelegramSDK) so the
+// suite never reaches telegram.org, which is unreachable from the CI runner. Specs that exercise
+// the Telegram launch inject their own window.Telegram via addInitScript before navigating, so the
+// dynamic load short-circuits on the already-present SDK.
 export const test = base.extend({
   page: async ({ page }, use) => {
-    await page.route('**/telegram-web-app.js', (route) =>
+    await page.route('**/telegram-web-app.js*', (route) =>
       route.fulfill({ status: 200, contentType: 'application/javascript', body: '' }),
     );
     await use(page);

ui/e2e/social.spec.ts

@@ -44,6 +44,60 @@ test('friends: issue a code, accept an incoming request, redeem a code', async (
   await expect(page.locator('.who', { hasText: 'Friend 111111' })).toBeVisible();
 });
 
+test('friends: the row kebab reveals block/remove and an outside tap closes it', async ({ page }) => {
+  await loginLobby(page);
+  await openFriends(page);
+
+  // A friend row slides open on its kebab (like the lobby), exposing two icon actions.
+  const kaya = page.locator('.rowwrap', { hasText: 'Kaya' });
+  await kaya.locator('.kebab').click();
+  await expect(kaya).toHaveClass(/revealed/);
+  await expect(kaya.locator('.acts').getByRole('button', { name: 'Block' })).toBeVisible();
+  await expect(kaya.locator('.acts').getByRole('button', { name: 'Remove' })).toBeVisible();
+
+  // A tap anywhere outside the action buttons collapses the row again.
+  await page.getByRole('heading', { name: 'Your friends' }).click();
+  await expect(kaya).not.toHaveClass(/revealed/);
+});
+
+test('friends: blocking from the list confirms (naming the friend) and moves them to Blocked', async ({ page }) => {
+  await loginLobby(page);
+  await openFriends(page);
+
+  const kaya = page.locator('.rowwrap', { hasText: 'Kaya' });
+  await kaya.locator('.kebab').click();
+  await kaya.locator('.acts').getByRole('button', { name: 'Block' }).click();
+
+  // The confirmation keeps a generic title and names the friend in the body.
+  const dialog = page.getByRole('dialog');
+  await expect(dialog.getByText('Block this player?')).toBeVisible();
+  await expect(dialog.locator('.confirm-name')).toHaveText('Kaya');
+  await dialog.getByRole('button', { name: 'Block' }).click();
+
+  // The block applied: Kaya leaves the friends list and shows under Blocked players.
+  await expect(page.getByText('No friends yet.')).toBeVisible();
+  const blocked = page.locator('.rowwrap', { hasText: 'Kaya' });
+  await expect(blocked.getByRole('button', { name: 'Unblock' })).toBeVisible();
+});
+
+test('friends: removing from the list confirms (naming the friend) and drops them', async ({ page }) => {
+  await loginLobby(page);
+  await openFriends(page);
+
+  const kaya = page.locator('.rowwrap', { hasText: 'Kaya' });
+  await kaya.locator('.kebab').click();
+  await kaya.locator('.acts').getByRole('button', { name: 'Remove' }).click();
+
+  const dialog = page.getByRole('dialog');
+  await expect(dialog.getByText('Remove from friends?')).toBeVisible();
+  await expect(dialog.locator('.confirm-name')).toHaveText('Kaya');
+  await dialog.getByRole('button', { name: 'Remove' }).click();
+
+  // Unfriending just drops the friendship — Kaya is gone and not blocked.
+  await expect(page.getByText('No friends yet.')).toBeVisible();
+  await expect(page.locator('.rowwrap', { hasText: 'Kaya' })).toHaveCount(0);
+});
+
 test('invitations: the lobby shows an invitation and accepting clears it', async ({ page }) => {
   await loginLobby(page);
   await expect(page.getByText('Invitations')).toBeVisible();

ui/e2e/telegram.spec.ts

@@ -107,11 +107,30 @@ test('inside Telegram, a failed launch shows the retry screen, not the web login
   await expect(page.getByRole('button', { name: /guest/i })).toHaveCount(0);
 });
 
-test('outside Telegram, the /telegram/ entry redirects to the site root', async ({ page }) => {
+test('outside Telegram, the /telegram/ entry shows the launch diagnostic, not a redirect', async ({
+  page,
+}) => {
   await page.goto('/telegram/');
 
-  // The guard sends a non-Telegram visitor back to the root, where the normal
-  // (guest / email) login is shown.
-  await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
-  await expect(page).not.toHaveURL(/\/telegram\//);
+  // The entry no longer bounces a visitor without Telegram sign-in data to the marketing landing;
+  // it shows a compact diagnostic screen (Share + Retry) that helps pinpoint why initData was
+  // absent — notably the Android empty-initData failure.
+  await expect(page.getByRole('button', { name: 'Share' })).toBeVisible();
+  await expect(page.getByRole('button', { name: 'Retry' })).toBeVisible();
+  // It stays on /telegram/ (no redirect) and never shows the web (guest) login.
+  await expect(page).toHaveURL(/\/telegram\//);
+  await expect(page.getByRole('button', { name: /guest/i })).toHaveCount(0);
+});
+
+test('a blocked telegram-web-app.js does not hang the diagnostic screen', async ({ page }) => {
+  // Simulate a network where telegram.org is unreachable: the SDK fetch fails. Because the SPA
+  // loads the SDK dynamically with a timeout (not a render-blocking <script>), a failed/blocked
+  // fetch must not strand the page — the diagnostic screen still renders, reporting no SDK. (This
+  // route overrides the fixture's empty-body fulfill; the later registration wins.)
+  await page.route('**/telegram-web-app.js*', (route) => route.abort());
+  await page.goto('/telegram/');
+
+  await expect(page.getByRole('button', { name: 'Share' })).toBeVisible();
+  // The diagnostic names the load outcome: a failed fetch reads as sdk-load: error.
+  await expect(page.getByText('sdk-load: error')).toBeVisible();
 });

ui/index.html

@@ -2,9 +2,11 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <!-- Telegram Mini App SDK: defines window.Telegram.WebApp. Harmless outside
-         Telegram (initData is empty), so it loads on every entry. -->
-    <script src="https://telegram.org/js/telegram-web-app.js"></script>
+    <!-- The Telegram Mini App SDK (window.Telegram.WebApp) is deliberately NOT loaded here: a
+         render-blocking <script> to telegram.org hangs the whole page on a network that blocks
+         telegram.org (common where Telegram itself reaches users only over a proxy), stranding even
+         the launch-diagnostic screen. The app loads it dynamically, with a timeout, only on a
+         Telegram entry — see lib/telegram.ts loadTelegramSDK and lib/app.svelte.ts bootstrap. -->
     <!-- user-scalable=no: the board owns zoom; we do not want the browser's pinch
          to fight our two-state zoom. viewport-fit=cover for native (Capacitor). -->
     <meta

ui/src/App.svelte

@@ -19,6 +19,7 @@
   import Feedback from './screens/Feedback.svelte';
   import Blocked from './screens/Blocked.svelte';
   import BootError from './screens/BootError.svelte';
+  import TelegramLaunchError from './screens/TelegramLaunchError.svelte';
 
   onMount(() => {
     void bootstrap();
@@ -84,6 +85,11 @@
   {#if !routeIsLobby}
     <div class="splash">{t('common.loading')}</div>
   {/if}
+{:else if app.launchError}
+  <!-- The /telegram/ entry without sign-in data: a compact, shareable diagnostic screen instead
+       of bouncing to the marketing landing (also the probe for the empty-initData failure on
+       some Android clients). -->
+  <TelegramLaunchError />
 {:else if app.bootError}
   <!-- A Mini App launch that failed to authenticate (e.g. the backend was down mid-deploy):
        show the retry screen instead of falling back to the web login. -->
@@ -128,7 +134,7 @@
 <StaleInviteModal />
 <WelcomeRedeemModal />
 
-{#if routeIsLobby && !app.splashDone && !app.blocked && !app.bootError}
+{#if routeIsLobby && !app.splashDone && !app.blocked && !app.bootError && !app.launchError}
   <Splash />
 {/if}
 

ui/src/gen/fbs/scrabblefb/email-request-request.ts

@@ -27,22 +27,34 @@ email(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+browserTz():string|null
+browserTz(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+browserTz(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startEmailRequestRequest(builder:flatbuffers.Builder) {
-  builder.startObject(1);
+  builder.startObject(2);
 }
 
 static addEmail(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset) {
   builder.addFieldOffset(0, emailOffset, 0);
 }
 
+static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, browserTzOffset, 0);
+}
+
 static endEmailRequestRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
   EmailRequestRequest.startEmailRequestRequest(builder);
   EmailRequestRequest.addEmail(builder, emailOffset);
+  EmailRequestRequest.addBrowserTz(builder, browserTzOffset);
   return EmailRequestRequest.endEmailRequestRequest(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/guest-login-request.ts

@@ -27,22 +27,34 @@ locale(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+browserTz():string|null
+browserTz(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+browserTz(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startGuestLoginRequest(builder:flatbuffers.Builder) {
-  builder.startObject(1);
+  builder.startObject(2);
 }
 
 static addLocale(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset) {
   builder.addFieldOffset(0, localeOffset, 0);
 }
 
+static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, browserTzOffset, 0);
+}
+
 static endGuestLoginRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createGuestLoginRequest(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createGuestLoginRequest(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
   GuestLoginRequest.startGuestLoginRequest(builder);
   GuestLoginRequest.addLocale(builder, localeOffset);
+  GuestLoginRequest.addBrowserTz(builder, browserTzOffset);
   return GuestLoginRequest.endGuestLoginRequest(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/telegram-login-request.ts

@@ -27,22 +27,34 @@ initData(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+browserTz():string|null
+browserTz(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+browserTz(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startTelegramLoginRequest(builder:flatbuffers.Builder) {
-  builder.startObject(1);
+  builder.startObject(2);
 }
 
 static addInitData(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset) {
   builder.addFieldOffset(0, initDataOffset, 0);
 }
 
+static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, browserTzOffset, 0);
+}
+
 static endTelegramLoginRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createTelegramLoginRequest(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createTelegramLoginRequest(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
   TelegramLoginRequest.startTelegramLoginRequest(builder);
   TelegramLoginRequest.addInitData(builder, initDataOffset);
+  TelegramLoginRequest.addBrowserTz(builder, browserTzOffset);
   return TelegramLoginRequest.endTelegramLoginRequest(builder);
 }
 }

ui/src/lib/app.svelte.ts

@@ -12,7 +12,11 @@ import { languageNeedsServerSync } from './language';
 import { applyReduceMotion, applyTelegramTheme, applyTheme, type ThemePref } from './theme';
 import {
   insideTelegram,
+  collectTelegramDiag,
+  type TelegramDiag,
   onTelegramPath,
+  hasLaunchFragment,
+  loadTelegramSDK,
   telegramColorScheme,
   telegramContentSafeAreaTop,
   telegramSafeAreaTop,
@@ -47,6 +51,11 @@ export const app = $state<{
    *  backend was down during a deploy). App.svelte then renders the boot-error retry screen
    *  instead of the web login — a Mini App has no manual sign-in to fall back to. */
   bootError: boolean;
+  /** On the dedicated /telegram/ entry, set to a privacy-safe diagnostic snapshot when a Mini App
+   *  launch carried no sign-in data (empty initData). App.svelte then renders the compact
+   *  launch-error screen (screens/TelegramLaunchError) — a shareable probe for why Telegram
+   *  delivered no initData (seen on some Android clients) — instead of bouncing to the landing. */
+  launchError: TelegramDiag | null;
   /** Whether the lobby's first cold load has settled (success or error). The loading splash
    *  (components/Splash.svelte) watches it to know when to dismiss; set by screens/Lobby. */
   lobbyReady: boolean;
@@ -68,7 +77,6 @@ export const app = $state<{
   locale: Locale;
   reduceMotion: boolean;
   boardLabels: BoardLabelMode;
-  localeLocked: boolean;
   /** Pending incoming friend requests, for the lobby ⚙️ badge and the Settings Friends tab. */
   notifications: number;
   /** Per-game flag: the player has at least one unread chat entry (message or nudge) in that
@@ -97,6 +105,7 @@ export const app = $state<{
 }>({
   ready: false,
   bootError: false,
+  launchError: null,
   lobbyReady: false,
   splashDone: false,
   streamAlive: false,
@@ -109,7 +118,6 @@ export const app = $state<{
   locale: 'en',
   reduceMotion: false,
   boardLabels: 'beginner',
-  localeLocked: false,
   notifications: 0,
   chatUnread: {},
   messageUnread: {},
@@ -451,18 +459,20 @@ async function adoptSession(s: Session): Promise<void> {
   await saveSession(s);
   try {
     app.profile = await gateway.profileGet();
-    // The live interface language follows the device — the explicit local choice (locked, saved
-    // in prefs) or the system guess made at bootstrap — and is no longer overridden from the
-    // account here. preferred_language stays the user's saved choice (written from Settings,
-    // and used for out-of-app push routing), but the Telegram bot a user signs in through must
-    // not dictate the UI: a ru-bot launch on an English system stays English.
+    // The live interface language follows the device — the explicit local choice (saved in
+    // prefs) or the system guess made at bootstrap — and is no longer overridden from the
+    // account here: the Telegram bot a user signs in through must not dictate the UI, so a
+    // ru-bot launch on an English system stays English.
     //
-    // But the banner and out-of-app push routing ARE resolved from preferred_language, so an
-    // explicit device choice the account has not recorded yet (picked while a guest, or
-    // differing from the Telegram system-language seed) would otherwise leave them in the wrong
-    // language until the next Settings change. Reconcile the account to the saved local choice
-    // here; persistLanguageToServer no-ops for guests and when already equal.
-    if (app.localeLocked) void persistLanguageToServer(app.locale);
+    // The banner and out-of-app push are resolved server-side from preferred_language, so it
+    // must track whatever language the UI actually shows — the explicit choice AND the system
+    // guess. Reconcile it to the active locale on every adopt, not only after an explicit
+    // Settings choice: a user who never opened Settings would otherwise be stuck on the
+    // creation-time seed — e.g. an English banner under a Russian UI. This keeps every
+    // server-rendered, language-dependent surface (banner, out-of-app push) aligned with the
+    // interface, not just one. persistLanguageToServer self-gates (a no-op for guests and when
+    // already equal), so there is no write in the steady state.
+    void persistLanguageToServer(app.locale);
   } catch (err) {
     handleError(err);
   }
@@ -483,9 +493,10 @@ export async function applyLinkResult(r: LinkResult): Promise<void> {
     return;
   }
   app.profile = await gateway.profileGet();
-  // A guest who chose a language and then linked in place now has a durable account: push the
-  // saved choice so the banner + push routing follow it (see adoptSession).
-  if (app.localeLocked) void persistLanguageToServer(app.locale);
+  // A guest who linked in place now has a durable account: push the active interface language
+  // so the banner + push routing follow it (see adoptSession — reconciled regardless of an
+  // explicit Settings choice).
+  void persistLanguageToServer(app.locale);
 }
 
 /**
@@ -529,6 +540,35 @@ function syncViewportHeight(): void {
   if (h > 0) document.documentElement.style.setProperty('--vvh', `${h}px`);
 }
 
+/**
+ * applyTelegramChrome applies a Mini App launch's visual integration: Telegram's authoritative
+ * colour scheme and theme, the matching header / background / bottom chrome, the safe-area insets,
+ * the swipe-down guard, and immersive fullscreen on mobile. It is idempotent, so both the initial
+ * bootstrap and a manual launch retry call it.
+ */
+function applyTelegramChrome(launch: TelegramLaunch): void {
+  if (launch.theme) applyTelegramTheme(launch.theme);
+  // Inside Telegram the colour scheme is Telegram's to decide; force it explicitly so the OS
+  // prefers-color-scheme (which leaks into the Telegram Desktop webview) cannot fight it. Falls
+  // back to the stored preference when the SDK omits it.
+  applyTheme(telegramColorScheme() ?? app.theme);
+  // Match Telegram's chrome to the app and stop its swipe-down-to-minimise from fighting tile
+  // drag / board scroll.
+  syncTelegramChrome();
+  syncTelegramSafeArea();
+  telegramDisableVerticalSwipes();
+  // On mobile, go immersive fullscreen like Telegram's own Mini Apps; the fullscreenChanged
+  // listener (registered at bootstrap) then re-syncs the safe-area insets. Desktop keeps the bot's
+  // full-size window. No-op on clients predating Bot API 8.0.
+  telegramRequestFullscreen();
+}
+
+/** How long to wait for the dynamically loaded Telegram Mini App SDK before giving up and showing
+ *  the launch-error screen. A network that blocks telegram.org makes the script hang rather than
+ *  fail fast (a connection refusal resolves immediately via the script's error event), so this only
+ *  bounds a true hang; it is generous enough not to misfire on a slow but working network. */
+const TELEGRAM_SDK_TIMEOUT_MS = 10000;
+
 export async function bootstrap(): Promise<void> {
   const prefs = await loadPrefs();
   app.theme = prefs.theme ?? 'auto';
@@ -538,7 +578,6 @@ export async function bootstrap(): Promise<void> {
   applyReduceMotion(app.reduceMotion);
   if (prefs.locale) {
     app.locale = prefs.locale;
-    app.localeLocked = true;
     setLocale(prefs.locale);
   } else {
     const guess = localeFrom(typeof navigator !== 'undefined' ? navigator.language : 'en');
@@ -553,33 +592,30 @@ export async function bootstrap(): Promise<void> {
     window.visualViewport.addEventListener('scroll', syncViewportHeight);
   }
 
-  // Telegram Mini App launch: apply the platform theme, authenticate via initData,
-  // and route any deep-link start parameter. On the dedicated /telegram/ entry path
-  // outside Telegram (no initData), refuse to render and send the visitor to the
-  // site root.
+  // Load the Telegram Mini App SDK dynamically, with a timeout, on a Telegram entry — it is no
+  // longer a render-blocking <script> in index.html, so a network that blocks telegram.org (common
+  // where Telegram itself reaches users only over a proxy) cannot hang the page and strand the app
+  // or the diagnostic screen below. Skipped on a plain web / native entry, which never needs it.
+  if (onTelegramPath() || hasLaunchFragment()) {
+    await loadTelegramSDK(TELEGRAM_SDK_TIMEOUT_MS);
+  }
+  // Telegram Mini App launch: apply the platform theme, authenticate via initData, and route any
+  // deep-link start parameter. On the dedicated /telegram/ entry without sign-in data (no/empty
+  // initData — outside Telegram, or a Mini App launch that delivered none, as seen on some Android
+  // clients), render the compact launch-error screen with a diagnostic snapshot the user can share
+  // with the developer, instead of bouncing the visitor to the marketing landing.
   if (onTelegramPath() && !insideTelegram()) {
-    if (typeof location !== 'undefined') location.replace('/');
+    app.launchError = collectTelegramDiag();
+    app.ready = true;
     return;
   }
   if (insideTelegram()) {
     const launch = telegramLaunch();
-    if (launch.theme) applyTelegramTheme(launch.theme);
-    // Inside Telegram the colour scheme is Telegram's to decide; force it explicitly
-    // so the OS prefers-color-scheme (which leaks into the Telegram Desktop webview)
-    // cannot fight it. Falls back to the stored preference when the SDK omits it.
-    applyTheme(telegramColorScheme() ?? app.theme);
-    // Match Telegram's chrome to the app and stop its swipe-down-to-minimise from
-    // fighting tile drag / board scroll.
-    syncTelegramChrome();
-    syncTelegramSafeArea();
+    applyTelegramChrome(launch);
+    // Re-sync the safe-area insets whenever Telegram's chrome changes (registered once per load).
     telegramOnEvent('contentSafeAreaChanged', syncTelegramSafeArea);
     telegramOnEvent('safeAreaChanged', syncTelegramSafeArea);
     telegramOnEvent('fullscreenChanged', syncTelegramSafeArea);
-    telegramDisableVerticalSwipes();
-    // On mobile, go immersive fullscreen like Telegram's own Mini Apps; the fullscreenChanged
-    // listener above then re-syncs the safe-area insets. Desktop keeps the bot's full-size
-    // window. No-op on clients predating Bot API 8.0.
-    telegramRequestFullscreen();
     await bootTelegram(launch);
     app.ready = true;
     return;
@@ -646,6 +682,28 @@ export async function retryTelegramBoot(): Promise<void> {
   app.ready = true;
 }
 
+/**
+ * retryTelegramLaunch re-attempts a Mini App launch from the launch-error screen's Retry button. If
+ * sign-in data is present now (e.g. it arrived late on a slow client) it clears the error and runs
+ * the normal launch; otherwise it refreshes the diagnostic snapshot so the screen reflects the
+ * current state. It never reloads — telegram-web-app.js consumes the launch fragment on first load,
+ * so a reload could discard the very data we are waiting for.
+ */
+export async function retryTelegramLaunch(): Promise<void> {
+  // Re-attempt the SDK load — the network may have recovered since the launch-error screen showed.
+  await loadTelegramSDK(TELEGRAM_SDK_TIMEOUT_MS);
+  if (!insideTelegram()) {
+    app.launchError = collectTelegramDiag();
+    return;
+  }
+  app.launchError = null;
+  app.ready = false;
+  const launch = telegramLaunch();
+  applyTelegramChrome(launch);
+  await bootTelegram(launch);
+  app.ready = true;
+}
+
 /**
  * routeStartParam navigates a Telegram deep-link start parameter to its target: a
  * specific game, the friends screen with a friend-code redemption, or the lobby
@@ -754,7 +812,6 @@ export function setTheme(theme: ThemePref): void {
 
 export function setLocalePref(locale: Locale): void {
   app.locale = locale;
-  app.localeLocked = true;
   setLocale(locale);
   persistPrefs();
   void persistLanguageToServer(locale);

ui/src/lib/codec.test.ts

@@ -19,13 +19,16 @@ import {
   decodeStateView,
   decodeStats,
   encodeCheckWord,
+  encodeEmailRequest,
   encodeFeedbackSubmit,
   encodeDraftSave,
   encodeEnqueue,
   encodeExchange,
+  encodeGuestLogin,
   encodeStateRequest,
   encodeSubmitPlay,
   encodeTarget,
+  encodeTelegramLogin,
   encodeUpdateProfile,
 } from './codec';
 
@@ -73,6 +76,26 @@ describe('codec', () => {
     });
   });
 
+  it('carries the detected browser zone on every account-creating auth request', () => {
+    const tg = fb.TelegramLoginRequest.getRootAsTelegramLoginRequest(
+      new ByteBuffer(encodeTelegramLogin('init-data-blob', '+03:00')),
+    );
+    expect(tg.initData()).toBe('init-data-blob');
+    expect(tg.browserTz()).toBe('+03:00');
+
+    const guest = fb.GuestLoginRequest.getRootAsGuestLoginRequest(
+      new ByteBuffer(encodeGuestLogin('ru', '-05:30')),
+    );
+    expect(guest.locale()).toBe('ru');
+    expect(guest.browserTz()).toBe('-05:30');
+
+    const email = fb.EmailRequestRequest.getRootAsEmailRequestRequest(
+      new ByteBuffer(encodeEmailRequest('a@example.com', '+00:00')),
+    );
+    expect(email.email()).toBe('a@example.com');
+    expect(email.browserTz()).toBe('+00:00');
+  });
+
   it('round-trips a feedback submit and decodes state + unread', () => {
     const att = new Uint8Array([1, 2, 3, 4]);
     const req = fb.FeedbackSubmitRequest.getRootAsFeedbackSubmitRequest(

ui/src/lib/codec.ts

@@ -179,27 +179,33 @@ export function encodeChatPost(gameId: string, body: string): Uint8Array {
   return finish(b, fb.ChatPostRequest.endChatPostRequest(b));
 }
 
-export function encodeTelegramLogin(initData: string): Uint8Array {
+export function encodeTelegramLogin(initData: string, browserTz: string): Uint8Array {
   const b = new Builder(512);
   const d = b.createString(initData);
+  const tz = b.createString(browserTz);
   fb.TelegramLoginRequest.startTelegramLoginRequest(b);
   fb.TelegramLoginRequest.addInitData(b, d);
+  fb.TelegramLoginRequest.addBrowserTz(b, tz);
   return finish(b, fb.TelegramLoginRequest.endTelegramLoginRequest(b));
 }
 
-export function encodeGuestLogin(locale: string): Uint8Array {
+export function encodeGuestLogin(locale: string, browserTz: string): Uint8Array {
   const b = new Builder(64);
   const l = b.createString(locale);
+  const tz = b.createString(browserTz);
   fb.GuestLoginRequest.startGuestLoginRequest(b);
   fb.GuestLoginRequest.addLocale(b, l);
+  fb.GuestLoginRequest.addBrowserTz(b, tz);
   return finish(b, fb.GuestLoginRequest.endGuestLoginRequest(b));
 }
 
-export function encodeEmailRequest(email: string): Uint8Array {
+export function encodeEmailRequest(email: string, browserTz: string): Uint8Array {
   const b = new Builder(128);
   const e = b.createString(email);
+  const tz = b.createString(browserTz);
   fb.EmailRequestRequest.startEmailRequestRequest(b);
   fb.EmailRequestRequest.addEmail(b, e);
+  fb.EmailRequestRequest.addBrowserTz(b, tz);
   return finish(b, fb.EmailRequestRequest.endEmailRequestRequest(b));
 }
 

ui/src/lib/i18n/en.ts

@@ -14,6 +14,11 @@ export const en = {
   'boot.errorTitle': "Couldn't load the game",
   'boot.errorBody': 'Please try again in a moment.',
 
+  'launch.errorTitle': "Can't open in Telegram",
+  'launch.errorBody': 'Screenshot or share this with the developer.',
+  'launch.share': 'Share',
+  'launch.copied': 'Copied',
+
   'common.back': 'Back',
   'common.cancel': 'Cancel',
   'common.ok': 'OK',
@@ -227,6 +232,9 @@ export const en = {
   'friends.decline': 'Decline',
   'friends.unfriend': 'Remove',
   'friends.block': 'Block',
+  'friends.actions': 'Actions',
+  'friends.blockConfirm': 'Block this player?',
+  'friends.unfriendConfirm': 'Remove from friends?',
   'friends.add': 'Add a friend',
   'friends.addFromGame': 'Add to friends',
   'friends.blockFromGame': 'Block player',

ui/src/lib/i18n/ru.ts

@@ -15,6 +15,11 @@ export const ru: Record<MessageKey, string> = {
   'boot.errorTitle': 'Не удалось загрузить игру',
   'boot.errorBody': 'Попробуйте ещё раз или зайдите позже.',
 
+  'launch.errorTitle': 'Не открывается в Telegram',
+  'launch.errorBody': 'Сделайте скриншот или поделитесь с разработчиком.',
+  'launch.share': 'Поделиться',
+  'launch.copied': 'Скопировано',
+
   'common.back': 'Назад',
   'common.cancel': 'Отмена',
   'common.ok': 'ОК',
@@ -228,6 +233,9 @@ export const ru: Record<MessageKey, string> = {
   'friends.decline': 'Отклонить',
   'friends.unfriend': 'Удалить',
   'friends.block': 'Заблокировать',
+  'friends.actions': 'Действия',
+  'friends.blockConfirm': 'Заблокировать?',
+  'friends.unfriendConfirm': 'Удалить из друзей?',
   'friends.add': 'Добавить друга',
   'friends.addFromGame': 'В друзья',
   'friends.blockFromGame': 'Заблокировать',

ui/src/lib/share.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
-import { pickGcgDelivery, shareOrDownloadGcg } from './share';
+import { pickGcgDelivery, pickTextShare, shareOrDownloadGcg, shareText } from './share';
 import type { GcgExport } from './model';
 
 const file = {} as File;
@@ -60,3 +60,42 @@ describe('shareOrDownloadGcg', () => {
     expect(anchor.click).toHaveBeenCalledOnce();
   });
 });
+
+describe('pickTextShare', () => {
+  it('shares when Web Share is available', () => {
+    expect(pickTextShare({ share: async () => {}, canShare: () => true })).toBe('share');
+  });
+
+  it('shares when share exists without canShare (text needs no file capability check)', () => {
+    expect(pickTextShare({ share: async () => {} })).toBe('share');
+  });
+
+  it('copies when there is no Web Share (desktop)', () => {
+    expect(pickTextShare(undefined)).toBe('copy');
+    expect(pickTextShare({} as never)).toBe('copy');
+  });
+});
+
+describe('shareText', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('uses the OS share sheet when available', async () => {
+    const share = vi.fn().mockResolvedValue(undefined);
+    vi.stubGlobal('navigator', { share, canShare: () => true });
+    expect(await shareText('diag', 'title')).toBe('shared');
+    expect(share).toHaveBeenCalledWith({ title: 'title', text: 'diag' });
+  });
+
+  it('copies to the clipboard when Web Share is absent (desktop)', async () => {
+    const writeText = vi.fn().mockResolvedValue(undefined);
+    vi.stubGlobal('navigator', { clipboard: { writeText } });
+    expect(await shareText('diag', 'title')).toBe('copied');
+    expect(writeText).toHaveBeenCalledWith('diag');
+  });
+
+  it('reports failure without a fallback when the share is cancelled', async () => {
+    const share = vi.fn().mockRejectedValue(new DOMException('cancelled', 'AbortError'));
+    vi.stubGlobal('navigator', { share, canShare: () => true });
+    expect(await shareText('diag', 'title')).toBe('failed');
+  });
+});

ui/src/lib/share.ts

@@ -51,3 +51,42 @@ function downloadFile(content: string, filename: string): void {
   a.remove();
   URL.revokeObjectURL(url);
 }
+
+type TextShareNav = Pick<Navigator, 'share'> & { canShare?: Navigator['canShare'] };
+
+/**
+ * pickTextShare decides how to deliver a plain-text payload: through the OS share sheet (Web Share,
+ * available on mobile including the Telegram Mini App) or, on a desktop browser without it, a
+ * clipboard copy. Pure, so it is unit-tested with a mock navigator.
+ */
+export function pickTextShare(nav: TextShareNav | undefined): 'share' | 'copy' {
+  if (nav && typeof nav.share === 'function' && (typeof nav.canShare !== 'function' || nav.canShare({ text: 'x' }))) {
+    return 'share';
+  }
+  return 'copy';
+}
+
+/**
+ * shareText delivers text through the OS share sheet where supported, else copies it to the
+ * clipboard. It reports the path taken — 'shared', 'copied', or 'failed' (a cancelled share or an
+ * unavailable clipboard) — so the caller can confirm a silent copy to the user. Like
+ * shareOrDownloadGcg it never strands the webview: a cancelled share simply does nothing.
+ */
+export async function shareText(text: string, title: string): Promise<'shared' | 'copied' | 'failed'> {
+  const nav = typeof navigator !== 'undefined' ? navigator : undefined;
+  if (!nav) return 'failed';
+  if (pickTextShare(nav) === 'share') {
+    try {
+      await nav.share({ title, text });
+      return 'shared';
+    } catch {
+      return 'failed';
+    }
+  }
+  try {
+    await nav.clipboard.writeText(text);
+    return 'copied';
+  } catch {
+    return 'failed';
+  }
+}

ui/src/lib/telegram.test.ts

@@ -1,6 +1,9 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
+  collectTelegramDiag,
   insideTelegram,
+  loadTelegramSDK,
+  telegramSdkOutcome,
   routeExternalLinkInTelegram,
   telegramClosingConfirmation,
   telegramLaunch,
@@ -155,3 +158,106 @@ describe('routeExternalLinkInTelegram', () => {
     expect(routeExternalLinkInTelegram({ href: 'https://x.io', target: '_blank' })).toBe(false);
   });
 });
+
+describe('collectTelegramDiag', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('reports a missing SDK outside Telegram', () => {
+    const d = collectTelegramDiag();
+    expect(d.hasSDK).toBe(false);
+    expect(d.hasWebApp).toBe(false);
+    expect(d.initDataLen).toBe(0);
+    expect(d.fieldsPresent).toEqual([]);
+    expect(d.fieldsMissing).toEqual(['user', 'auth_date', 'hash', 'signature']);
+  });
+
+  it('reads field NAMES (never values) from a non-empty initData', () => {
+    stubWebApp('query_id=abc&user=%7B%7D&auth_date=1&hash=deadbeef');
+    const d = collectTelegramDiag();
+    expect(d.hasSDK).toBe(true);
+    expect(d.hasWebApp).toBe(true);
+    expect(d.initDataLen).toBeGreaterThan(0);
+    expect(d.fieldsPresent).toEqual(['query_id', 'user', 'auth_date', 'hash']);
+    expect(d.fieldsMissing).toEqual(['signature']);
+  });
+
+  it('recovers field names from the URL fragment when the SDK left initData empty', () => {
+    // Telegram passed launch data in the fragment, but WebApp.initData is empty (the Android
+    // failure this screen diagnoses): the names come from the raw fragment instead, and
+    // hashHadTgData flags that the data did arrive in the URL.
+    vi.stubGlobal('window', { Telegram: { WebApp: { initData: '', platform: 'android' } } });
+    vi.stubGlobal('location', {
+      hash: '#tgWebAppData=user%3D%257B%257D%26auth_date%3D1%26hash%3Ddeadbeef&tgWebAppVersion=7.0',
+      pathname: '/telegram/',
+    });
+    const d = collectTelegramDiag();
+    expect(d.hasSDK).toBe(true);
+    expect(d.platform).toBe('android');
+    expect(d.initDataLen).toBe(0);
+    expect(d.hashHadTgData).toBe(true);
+    expect(d.fieldsPresent).toEqual(['user', 'auth_date', 'hash']);
+    expect(d.fieldsMissing).toEqual(['signature']);
+  });
+});
+
+describe('loadTelegramSDK', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.useRealTimers();
+  });
+
+  it('resolves true and records "present" when the SDK is already there', async () => {
+    vi.stubGlobal('window', { Telegram: { WebApp: { initData: '' } } });
+    vi.stubGlobal('document', { createElement: vi.fn(), head: { appendChild: vi.fn() } });
+    await expect(loadTelegramSDK(10000)).resolves.toBe(true);
+    expect(telegramSdkOutcome()).toBe('present');
+  });
+
+  it('records "loaded" when the script defines the WebApp', async () => {
+    const script: Record<string, unknown> = {};
+    vi.stubGlobal('window', {});
+    vi.stubGlobal('document', {
+      createElement: () => script,
+      head: {
+        appendChild: () => {
+          (window as unknown as { Telegram: unknown }).Telegram = { WebApp: { initData: '' } };
+          (script.onload as () => void)();
+        },
+      },
+    });
+    await expect(loadTelegramSDK(10000)).resolves.toBe(true);
+    expect(telegramSdkOutcome()).toBe('loaded');
+  });
+
+  it('records "no-webapp" when the script loads but defines nothing', async () => {
+    const script: Record<string, unknown> = {};
+    vi.stubGlobal('window', {});
+    vi.stubGlobal('document', {
+      createElement: () => script,
+      head: { appendChild: () => (script.onload as () => void)() },
+    });
+    await expect(loadTelegramSDK(10000)).resolves.toBe(false);
+    expect(telegramSdkOutcome()).toBe('no-webapp');
+  });
+
+  it('records "error" when the script fails to load (telegram.org unreachable)', async () => {
+    const script: Record<string, unknown> = {};
+    vi.stubGlobal('window', {});
+    vi.stubGlobal('document', {
+      createElement: () => script,
+      head: { appendChild: () => (script.onerror as () => void)() },
+    });
+    await expect(loadTelegramSDK(10000)).resolves.toBe(false);
+    expect(telegramSdkOutcome()).toBe('error');
+  });
+
+  it('records "timeout" when the script neither loads nor fails in time', async () => {
+    vi.useFakeTimers();
+    vi.stubGlobal('window', {});
+    vi.stubGlobal('document', { createElement: () => ({}), head: { appendChild: vi.fn() } });
+    const p = loadTelegramSDK(10000);
+    await vi.advanceTimersByTimeAsync(10000);
+    await expect(p).resolves.toBe(false);
+    expect(telegramSdkOutcome()).toBe('timeout');
+  });
+});

ui/src/lib/telegram.ts

@@ -1,6 +1,7 @@
-// Telegram Mini App SDK access. The official telegram-web-app.js (loaded in
-// index.html) exposes window.Telegram.WebApp; this wraps the subset the app uses:
-// launch detection, initData (for auth.telegram), the deep-link start parameter,
+// Telegram Mini App SDK access. The official telegram-web-app.js (loaded dynamically with a
+// timeout by loadTelegramSDK — not a render-blocking <script> in index.html, so a network that
+// blocks telegram.org cannot hang the page) exposes window.Telegram.WebApp; this wraps the subset
+// the app uses: launch detection, initData (for auth.telegram), the deep-link start parameter,
 // theme params, and ready()/expand(). Every helper is safe to call outside Telegram.
 
 import type { TelegramThemeParams } from './theme';
@@ -9,6 +10,7 @@ interface TelegramWebApp {
   initData: string;
   initDataUnsafe?: { start_param?: string };
   platform?: string;
+  version?: string;
   themeParams?: TelegramThemeParams;
   colorScheme?: 'light' | 'dark';
   isFullscreen?: boolean;
@@ -53,6 +55,72 @@ export function insideTelegram(): boolean {
   return !!w && typeof w.initData === 'string' && w.initData.length > 0;
 }
 
+// The ?NN suffix pins the Bot API SDK version Telegram serves (and busts the cache); keep it at the
+// version the official Mini Apps page currently recommends so newer client features (fullscreen,
+// safe-area insets, vertical-swipe guard, …) are available. Bump it when Telegram bumps theirs.
+const sdkScriptSrc = 'https://telegram.org/js/telegram-web-app.js?62';
+
+/**
+ * TelegramSdkOutcome records how the dynamic telegram-web-app.js load resolved, surfaced on the
+ * launch-error screen to tell the failure modes apart — notably 'error' / 'timeout', which mean the
+ * network could not reach telegram.org (the script blocked or hung):
+ *
+ *   not-attempted — loadTelegramSDK was never called (a plain web / native entry)
+ *   present       — window.Telegram.WebApp was already there (a cached load or native injection)
+ *   loaded        — the script loaded and defined window.Telegram.WebApp
+ *   no-webapp     — the script loaded (HTTP 200) but did not define window.Telegram.WebApp
+ *   error         — the script failed to load (telegram.org unreachable / blocked, a fast failure)
+ *   timeout       — the script neither loaded nor failed within the timeout (a blocked, hanging fetch)
+ */
+export type TelegramSdkOutcome = 'not-attempted' | 'present' | 'loaded' | 'no-webapp' | 'error' | 'timeout';
+
+let sdkLoadOutcome: TelegramSdkOutcome = 'not-attempted';
+
+/** telegramSdkOutcome returns how the last loadTelegramSDK attempt resolved (see TelegramSdkOutcome). */
+export function telegramSdkOutcome(): TelegramSdkOutcome {
+  return sdkLoadOutcome;
+}
+
+/**
+ * loadTelegramSDK injects the official telegram-web-app.js and resolves true once
+ * window.Telegram.WebApp is available, or false if the script errors or does not load within
+ * timeoutMs. It is loaded dynamically — not a render-blocking <script> in index.html — so a network
+ * that blocks telegram.org (common where Telegram itself reaches users only over a proxy) cannot
+ * hang the page and strand the app or the launch-error screen. Resolves true immediately when the
+ * SDK is already present (a cached load, or a future native injection); a fast connection failure
+ * resolves via the error event without waiting out the timeout, so the timeout only bounds a true
+ * hang.
+ */
+export function loadTelegramSDK(timeoutMs: number): Promise<boolean> {
+  if (typeof document === 'undefined') return Promise.resolve(false);
+  if (webApp()) {
+    sdkLoadOutcome = 'present';
+    return Promise.resolve(true);
+  }
+  return new Promise<boolean>((resolve) => {
+    let done = false;
+    const finish = (outcome: TelegramSdkOutcome): void => {
+      if (done) return;
+      done = true;
+      sdkLoadOutcome = outcome;
+      resolve(outcome === 'loaded');
+    };
+    const timer = setTimeout(() => finish(webApp() ? 'loaded' : 'timeout'), timeoutMs);
+    const s = document.createElement('script');
+    s.src = sdkScriptSrc;
+    s.async = true;
+    s.onload = () => {
+      clearTimeout(timer);
+      finish(webApp() ? 'loaded' : 'no-webapp');
+    };
+    s.onerror = () => {
+      clearTimeout(timer);
+      finish('error');
+    };
+    document.head.appendChild(s);
+  });
+}
+
 /**
  * telegramOpenLink opens a t.me link through the Mini App SDK, so Telegram navigates to
  * it natively (e.g. a bot chat) rather than spawning an in-app browser tab. Returns false
@@ -302,6 +370,132 @@ export function onTelegramPath(): boolean {
   return location.pathname.startsWith('/telegram/');
 }
 
+/** hasLaunchFragment reports whether the URL fragment carries Telegram launch params (tgWebApp…),
+ *  the form Telegram appends when opening a Mini App — so the SDK is loaded for a Mini App opened
+ *  at the site root too, not only the /telegram/ path. */
+export function hasLaunchFragment(): boolean {
+  if (typeof location === 'undefined') return false;
+  return location.hash.includes('tgWebApp');
+}
+
+// --- Launch diagnostics (the /telegram/ entry without sign-in data) ---
+
+/** The initData fields a valid Telegram launch is expected to carry; their absence is the signal
+ *  the launch-error screen reports. Only field names are ever inspected, never their values. */
+const expectedInitDataFields = ['user', 'auth_date', 'hash', 'signature'];
+
+interface uaBrand {
+  brand: string;
+  version: string;
+}
+
+interface uaDataValue {
+  platform?: string;
+  mobile?: boolean;
+  brands?: uaBrand[];
+}
+
+/** uaData returns the User-Agent Client Hints object (Chromium only — notably the Android Telegram
+ *  webview), or undefined where it is unavailable (iOS / Safari / Firefox). */
+function uaData(): uaDataValue | undefined {
+  if (typeof navigator === 'undefined') return undefined;
+  return (navigator as unknown as { userAgentData?: uaDataValue }).userAgentData;
+}
+
+/** launchFragmentData returns the raw tgWebAppData carried in the URL fragment (the form Telegram
+ *  appends on launch), or '' when absent. With no SDK present a non-empty value means Telegram
+ *  delivered the data but telegram-web-app.js never ran to parse it. */
+function launchFragmentData(): string {
+  if (typeof location === 'undefined') return '';
+  const frag = location.hash.replace(/^#/, '');
+  if (!frag) return '';
+  try {
+    return new URLSearchParams(frag).get('tgWebAppData') ?? '';
+  } catch {
+    return '';
+  }
+}
+
+/** initDataFieldNames parses a Telegram initData (or raw fragment data) query string and returns
+ *  only its field NAMES — never the values, since the hash / signature are auth material. */
+function initDataFieldNames(raw: string): string[] {
+  if (!raw) return [];
+  try {
+    return [...new URLSearchParams(raw).keys()];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * TelegramDiag is a privacy-safe snapshot of why a Mini App launch lacked sign-in data, taken at
+ * the moment of failure and rendered on the launch-error screen so a stuck user can share it with
+ * the developer. It carries no secret values — only presence flags, client / OS identification and
+ * the field NAMES of the launch data, never the signed initData itself, and never an IP.
+ */
+export interface TelegramDiag {
+  /** Whether window.Telegram (the telegram-web-app.js script) is present at all. */
+  hasSDK: boolean;
+  /** Whether window.Telegram.WebApp is present. */
+  hasWebApp: boolean;
+  /** How the dynamic telegram-web-app.js load resolved (see TelegramSdkOutcome) — 'error' /
+   *  'timeout' mean telegram.org was unreachable, the prime suspect for an empty launch. */
+  sdkLoad: TelegramSdkOutcome;
+  /** Telegram's own platform string (ios | android | android_x | tdesktop | web | …), or ''. */
+  platform: string;
+  /** The Bot API version the client reports, or ''. */
+  version: string;
+  /** The length of WebApp.initData — 0 is the failure this screen reports. */
+  initDataLen: number;
+  /** Whether the URL fragment still carried tgWebAppData at launch; true with hasSDK false means
+   *  Telegram delivered the data but the SDK script did not load to parse it. */
+  hashHadTgData: boolean;
+  /** The field names present in the launch data (from initData, or the raw fragment when the SDK
+   *  left initData empty); values are never included. */
+  fieldsPresent: string[];
+  /** The expected field names absent from the launch data (a subset of expectedInitDataFields). */
+  fieldsMissing: string[];
+  /** The OS / platform per User-Agent Client Hints (else navigator.platform), e.g. 'Android', ''. */
+  osPlatform: string;
+  /** Whether the client reports itself mobile per Client Hints: 'yes' | 'no' | '' (unknown). */
+  mobile: string;
+  /** The browser brands + major versions per Client Hints (Chromium only), or ''. */
+  browser: string;
+  /** The full User-Agent string — the catch-all that also carries the OS version and webview build. */
+  userAgent: string;
+}
+
+/**
+ * collectTelegramDiag captures a TelegramDiag snapshot of the current launch state. Call it at the
+ * point a /telegram/ launch is found to lack sign-in data, so the snapshot reflects that moment —
+ * sign-in data arriving late would otherwise mask the failure.
+ */
+export function collectTelegramDiag(): TelegramDiag {
+  const w = webApp();
+  const sdk = typeof window !== 'undefined' && !!(window as unknown as { Telegram?: unknown }).Telegram;
+  const initData = w?.initData ?? '';
+  const fragData = initData ? '' : launchFragmentData();
+  const present = initDataFieldNames(initData || fragData);
+  const ua = uaData();
+  const navPlatform =
+    typeof navigator === 'undefined' ? '' : (navigator as unknown as { platform?: string }).platform ?? '';
+  return {
+    hasSDK: sdk,
+    hasWebApp: !!w,
+    sdkLoad: sdkLoadOutcome,
+    platform: w?.platform ?? '',
+    version: w?.version ?? '',
+    initDataLen: initData.length,
+    hashHadTgData: fragData.length > 0,
+    fieldsPresent: present,
+    fieldsMissing: expectedInitDataFields.filter((f) => !present.includes(f)),
+    osPlatform: ua?.platform ?? navPlatform,
+    mobile: ua?.mobile === undefined ? '' : ua.mobile ? 'yes' : 'no',
+    browser: (ua?.brands ?? []).map((b) => `${b.brand} ${b.version}`).join(', '),
+    userAgent: typeof navigator === 'undefined' ? '' : navigator.userAgent,
+  };
+}
+
 // --- Login Widget (web sign-in for account linking) ---
 
 // The Login Widget is the web (non-Mini-App) Telegram sign-in. It is used only to

ui/src/lib/transport.ts

@@ -63,13 +63,13 @@ export function createTransport(baseUrl: string): GatewayClient {
     },
 
     async authTelegram(initData) {
-      return codec.decodeSession(await exec('auth.telegram', codec.encodeTelegramLogin(initData)));
+      return codec.decodeSession(await exec('auth.telegram', codec.encodeTelegramLogin(initData, browserOffset())));
     },
     async authGuest(locale) {
-      return codec.decodeSession(await exec('auth.guest', codec.encodeGuestLogin(locale ?? '')));
+      return codec.decodeSession(await exec('auth.guest', codec.encodeGuestLogin(locale ?? '', browserOffset())));
     },
     async authEmailRequest(email) {
-      await exec('auth.email.request', codec.encodeEmailRequest(email));
+      await exec('auth.email.request', codec.encodeEmailRequest(email, browserOffset()));
     },
     async authEmailLogin(email, code) {
       return codec.decodeSession(await exec('auth.email.login', codec.encodeEmailLogin(email, code)));

ui/src/screens/Friends.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { onMount } from 'svelte';
+  import Modal from '../components/Modal.svelte';
   import { app, handleError, refreshNotifications, showToast } from '../lib/app.svelte';
   import { connection } from '../lib/connection.svelte';
   import { gateway } from '../lib/gateway';
@@ -16,6 +17,11 @@
   let robotBlocks = $state<RobotBlockEntry[]>([]);
   let code = $state<FriendCode | null>(null);
   let redeemInput = $state('');
+  // The friend row whose kebab actions are slid open, like the lobby list.
+  let revealedId = $state<string | null>(null);
+  // Pending confirmation targets: the friend account awaiting a block / unfriend confirm.
+  let blockTarget = $state<AccountRef | null>(null);
+  let unfriendTarget = $state<AccountRef | null>(null);
 
   async function load() {
     try {
@@ -52,6 +58,41 @@
   const blockUser = (id: string) => act(() => gateway.block(id));
   const unblock = (id: string) => act(() => gateway.unblock(id));
 
+  // toggleReveal slides one friend row open (closing any other), exposing its
+  // block / unfriend icon actions; tapping the same kebab again closes it.
+  function toggleReveal(id: string): void {
+    revealedId = revealedId === id ? null : id;
+  }
+
+  // confirmBlock / confirmUnfriend run the pending action once its modal is
+  // accepted, then clear the target and the revealed row.
+  function confirmBlock(): void {
+    const target = blockTarget;
+    blockTarget = null;
+    revealedId = null;
+    if (target) void blockUser(target.accountId);
+  }
+
+  function confirmUnfriend(): void {
+    const target = unfriendTarget;
+    unfriendTarget = null;
+    revealedId = null;
+    if (target) void remove(target.accountId);
+  }
+
+  // While a friend row is slid open, a tap anywhere outside its action buttons
+  // closes it again. Taps on a kebab are skipped so its own toggle stays in charge.
+  $effect(() => {
+    if (revealedId === null) return;
+    function onDown(e: PointerEvent) {
+      const el = e.target as Element | null;
+      if (el?.closest('.acts') || el?.closest('.kebab')) return;
+      revealedId = null;
+    }
+    window.addEventListener('pointerdown', onDown, true);
+    return () => window.removeEventListener('pointerdown', onDown, true);
+  });
+
   async function getCode() {
     try {
       code = await gateway.friendCodeIssue();
@@ -152,30 +193,39 @@
     {#if incoming.length}
       <section>
         <h3>{t('friends.incoming')}</h3>
-        {#each incoming as r (r.accountId)}
-          <div class="item">
-            <span class="who">{r.displayName}</span>
-            <span class="acts">
-              <button class="btn" onclick={() => respond(r.accountId, true)} disabled={!connection.online}>{t('friends.accept')}</button>
-              <button class="ghost" onclick={() => respond(r.accountId, false)} disabled={!connection.online}>{t('friends.decline')}</button>
-            </span>
-          </div>
-        {/each}
+        <div class="list">
+          {#each incoming as r (r.accountId)}
+            <div class="rowwrap">
+              <div class="row">
+                <span class="who">{r.displayName}</span>
+                <span class="btns">
+                  <button class="btn" onclick={() => respond(r.accountId, true)} disabled={!connection.online}>{t('friends.accept')}</button>
+                  <button class="ghost" onclick={() => respond(r.accountId, false)} disabled={!connection.online}>{t('friends.decline')}</button>
+                </span>
+              </div>
+            </div>
+          {/each}
+        </div>
       </section>
     {/if}
 
     <section>
       <h3>{t('friends.yours')}</h3>
       {#if friends.length}
-        {#each friends as f (f.accountId)}
-          <div class="item">
-            <span class="who">{f.displayName}</span>
-            <span class="acts">
-              <button class="ghost" onclick={() => remove(f.accountId)} disabled={!connection.online}>{t('friends.unfriend')}</button>
-              <button class="ghost danger" onclick={() => blockUser(f.accountId)} disabled={!connection.online}>{t('friends.block')}</button>
-            </span>
-          </div>
-        {/each}
+        <div class="list">
+          {#each friends as f (f.accountId)}
+            <div class="rowwrap" class:revealed={revealedId === f.accountId}>
+              <div class="acts">
+                <button class="iconbtn" onclick={() => (blockTarget = f)} disabled={!connection.online} aria-label={t('friends.block')}>🚫</button>
+                <button class="iconbtn" onclick={() => (unfriendTarget = f)} disabled={!connection.online} aria-label={t('friends.unfriend')}>✖️</button>
+              </div>
+              <div class="row">
+                <span class="who">{f.displayName}</span>
+                <button class="kebab" onclick={() => toggleReveal(f.accountId)} aria-label={t('friends.actions')}>⋮</button>
+              </div>
+            </div>
+          {/each}
+        </div>
       {:else}
         <p class="muted">{t('friends.none')}</p>
       {/if}
@@ -184,20 +234,49 @@
     {#if blocked.length || robotBlocks.length}
       <section>
         <h3>{t('friends.blockedList')}</h3>
-        {#each blocked as b (b.accountId)}
-          <div class="item">
-            <span class="who">{b.displayName}</span>
-            <button class="ghost" onclick={() => unblock(b.accountId)} disabled={!connection.online}>{t('friends.unblock')}</button>
-          </div>
-        {/each}
-        {#each robotBlocks as r (r.id)}
-          <div class="item">
-            <span class="who">{r.displayName}</span>
-            <button class="ghost" onclick={() => unblock(r.id)} disabled={!connection.online}>{t('friends.unblock')}</button>
-          </div>
-        {/each}
+        <div class="list">
+          {#each blocked as b (b.accountId)}
+            <div class="rowwrap">
+              <div class="row">
+                <span class="who">{b.displayName}</span>
+                <span class="btns">
+                  <button class="ghost" onclick={() => unblock(b.accountId)} disabled={!connection.online}>{t('friends.unblock')}</button>
+                </span>
+              </div>
+            </div>
+          {/each}
+          {#each robotBlocks as r (r.id)}
+            <div class="rowwrap">
+              <div class="row">
+                <span class="who">{r.displayName}</span>
+                <span class="btns">
+                  <button class="ghost" onclick={() => unblock(r.id)} disabled={!connection.online}>{t('friends.unblock')}</button>
+                </span>
+              </div>
+            </div>
+          {/each}
+        </div>
       </section>
     {/if}
+
+    {#if blockTarget}
+      <Modal title={t('friends.blockConfirm')} onclose={() => (blockTarget = null)}>
+        <p class="confirm-name">{blockTarget.displayName}</p>
+        <div class="confirm-row">
+          <button class="cancel" onclick={() => (blockTarget = null)}>{t('common.cancel')}</button>
+          <button class="danger" onclick={confirmBlock} disabled={!connection.online}>{t('friends.block')}</button>
+        </div>
+      </Modal>
+    {/if}
+    {#if unfriendTarget}
+      <Modal title={t('friends.unfriendConfirm')} onclose={() => (unfriendTarget = null)}>
+        <p class="confirm-name">{unfriendTarget.displayName}</p>
+        <div class="confirm-row">
+          <button class="cancel" onclick={() => (unfriendTarget = null)}>{t('common.cancel')}</button>
+          <button class="danger" onclick={confirmUnfriend} disabled={!connection.online}>{t('friends.unfriend')}</button>
+        </div>
+      </Modal>
+    {/if}
   {/if}
 </div>
 
@@ -279,28 +358,76 @@
     padding: 4px 0;
     text-align: left;
   }
-  .item {
+  .list {
+    display: flex;
+    flex-direction: column;
+  }
+  /* One-line rows split by hairlines, mirroring the lobby list. */
+  .rowwrap {
+    position: relative;
+    overflow: hidden;
+  }
+  .rowwrap + .rowwrap {
+    border-top: 1px solid var(--border);
+  }
+  /* Block / unfriend icon actions sit behind the friend row, exposed when it slides left. */
+  .acts {
+    position: absolute;
+    inset: 0 0 0 auto;
+    display: flex;
+    align-items: stretch;
+  }
+  .iconbtn {
+    flex: 0 0 auto;
+    width: 48px;
+    border: none;
+    background: var(--bg-elev);
+    color: var(--text);
+    font-size: 1.1rem;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+  }
+  .iconbtn + .iconbtn {
+    border-left: 1px solid var(--border); /* the vertical divider between 🚫 and ✖️ */
+  }
+  .row {
+    position: relative;
     display: flex;
     align-items: center;
     justify-content: space-between;
     gap: 10px;
     padding: 10px 12px;
-    border: 1px solid var(--border);
-    background: var(--surface);
-    border-radius: var(--radius-sm);
-    margin-bottom: 8px;
+    background: var(--bg);
+    transform: translateX(0);
+    transition: transform 0.18s ease;
+  }
+  .rowwrap.revealed .row {
+    transform: translateX(-96px); /* 2 × 48px icon buttons */
+  }
+  .kebab {
+    flex: 0 0 auto;
+    width: 30px;
+    padding: 6px 0;
+    border: none;
+    background: none;
+    color: var(--text-muted);
+    font-size: 1.4rem;
+    line-height: 1;
+  }
+  .btns {
+    display: flex;
+    gap: 8px;
+    flex: 0 0 auto;
   }
   .who {
+    flex: 1;
+    min-width: 0;
     font-weight: 600;
     overflow: hidden;
     text-overflow: ellipsis;
     white-space: nowrap;
   }
-  .acts {
-    display: flex;
-    gap: 8px;
-    flex: 0 0 auto;
-  }
   .btn {
     padding: 8px 12px;
     border: 1px solid var(--accent);
@@ -315,7 +442,27 @@
     color: var(--text);
     border-radius: var(--radius-sm);
   }
-  .ghost.danger {
-    color: var(--danger, #c0392b);
+  .confirm-name {
+    margin: 0 0 12px;
+    font-weight: 600;
+    overflow-wrap: anywhere; /* a long display name wraps instead of stretching the sheet */
+  }
+  .confirm-row {
+    display: flex;
+    gap: 8px;
+  }
+  .confirm-row button {
+    flex: 1;
+    padding: 11px;
+    border-radius: var(--radius-sm);
+    border: 1px solid var(--border);
+    background: var(--surface);
+    color: var(--text);
+    font-weight: 600;
+  }
+  .confirm-row .danger {
+    background: var(--danger);
+    color: #fff;
+    border-color: var(--danger);
   }
 </style>

ui/src/screens/TelegramLaunchError.svelte

@@ -0,0 +1,133 @@
+<script lang="ts">
+  // Shown on the dedicated /telegram/ entry when a Mini App launch carried no sign-in data (empty
+  // initData) — instead of bouncing the visitor to the marketing landing. It states the problem
+  // plainly and renders a compact, privacy-safe diagnostic snapshot (taken at the moment of
+  // failure, app.launchError) sized to fit one screenshot, with a Share button (the OS share sheet,
+  // or a clipboard copy on desktop) so a stuck user can send it to the developer to pinpoint why
+  // Telegram provided no initData — notably on some Android clients. The snapshot carries only
+  // presence / identification signals and field NAMES, never the signed initData itself, nor an IP.
+  import { app, retryTelegramLaunch } from '../lib/app.svelte';
+  import { shareText } from '../lib/share';
+  import { t } from '../lib/i18n/index.svelte';
+
+  const diag = $derived(app.launchError);
+
+  // One compact "key: value" line per fact; the field labels are fixed diagnostic tokens (not UI
+  // prose), so the developer reads the same report in any locale. Kept terse to fit one screenshot.
+  const report = $derived(
+    diag
+      ? [
+          `sdk-load: ${diag.sdkLoad}`,
+          `sdk: ${diag.hasSDK ? 'yes' : 'no'}   webapp: ${diag.hasWebApp ? 'yes' : 'no'}`,
+          `tg-platform: ${diag.platform || '—'}   tg-version: ${diag.version || '—'}`,
+          `initData: ${diag.initDataLen > 0 ? diag.initDataLen : 'empty'}   tgdata-in-url: ${diag.hashHadTgData ? 'yes' : 'no'}`,
+          `fields: ${diag.fieldsPresent.join(',') || '—'}`,
+          `missing: ${diag.fieldsMissing.join(',') || '—'}`,
+          `os: ${diag.osPlatform || '—'}   mobile: ${diag.mobile || '—'}`,
+          `browser: ${diag.browser || '—'}`,
+          `ua: ${diag.userAgent || '—'}`,
+        ].join('\n')
+      : '',
+  );
+
+  let retrying = $state(false);
+  async function retry(): Promise<void> {
+    if (retrying) return;
+    retrying = true;
+    try {
+      await retryTelegramLaunch();
+    } finally {
+      retrying = false;
+    }
+  }
+
+  let copied = $state(false);
+  let copyTimer: ReturnType<typeof setTimeout> | undefined;
+  async function share(): Promise<void> {
+    const r = await shareText(report, t('launch.errorTitle'));
+    // The OS share sheet is its own feedback; a desktop clipboard copy is silent, so confirm it.
+    if (r === 'copied') {
+      copied = true;
+      clearTimeout(copyTimer);
+      copyTimer = setTimeout(() => (copied = false), 1500);
+    }
+  }
+</script>
+
+{#if diag}
+  <div class="boot">
+    <div class="card">
+      <h1>{t('launch.errorTitle')}</h1>
+      <p class="msg">{t('launch.errorBody')}</p>
+      <pre class="diag">{report}</pre>
+      <div class="actions">
+        <button class="share" onclick={share}>{copied ? t('launch.copied') : t('launch.share')}</button>
+        <button class="retry" onclick={retry} disabled={retrying}>{t('common.retry')}</button>
+      </div>
+    </div>
+  </div>
+{/if}
+
+<style>
+  .boot {
+    height: 100%;
+    display: grid;
+    place-items: center;
+    padding: 16px;
+    background: var(--bg);
+  }
+  .card {
+    max-width: 32rem;
+    width: 100%;
+    display: flex;
+    flex-direction: column;
+    gap: 0.6rem;
+    text-align: center;
+    color: var(--text);
+  }
+  h1 {
+    margin: 0;
+    font-size: 1.1rem;
+  }
+  .msg {
+    margin: 0;
+    color: var(--text-muted);
+    font-size: 0.9rem;
+  }
+  .diag {
+    margin: 0;
+    text-align: left;
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+    font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+    font-size: 11px;
+    line-height: 1.4;
+    color: var(--text);
+    background: var(--bg-elev);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+    padding: 8px 10px;
+  }
+  .actions {
+    display: flex;
+    justify-content: center;
+    gap: 0.5rem;
+  }
+  .share,
+  .retry {
+    padding: 8px 16px;
+    border-radius: var(--radius-sm);
+    border: 1px solid var(--accent);
+  }
+  .share {
+    background: var(--accent);
+    color: var(--accent-text);
+  }
+  .retry {
+    background: transparent;
+    color: var(--accent);
+  }
+  .retry:disabled {
+    opacity: 0.5;
+  }
+</style>