Merge pull request 'Promote development → master (deploy v2: versioning + visible jobs + rollback)' (#106) from development into master

.claude/CLAUDE.md

@@ -1,242 +0,0 @@
-# Agent field notes — scrabble-game
-
-Non-obvious, hard-won project knowledge that is **not** in the main docs (`CLAUDE.md`, `docs/*`,
-`deploy/README.md`). Kept in the repo so it travels with a clone to any host. These are working
-memory, not a spec — **verify any named file / flag / function against the current code before acting
-on it**, and prefer the authoritative docs where they overlap. Add to this file as new gotchas turn up.
-
-## Codegen & build
-
-- **jetgen churns everything.** `backend/cmd/jetgen` regenerates go-jet code for *all* tables and may
-  reorder output. After running it, revert the churn on tables you did not touch and commit only your
-  table's change.
-- **flatc is version-pinned** (`pkg/Makefile`, `REQUIRED_FLATC = 23.5.26`, hard-checked). A different
-  flatc silently churns the generated wire code and can flip wire defaults. Never regenerate FBS with
-  another flatc version.
-- **gopls lags codegen.** Right after an FBS/jet regen, gopls shows phantom "undefined" errors. Trust
-  `go build` / `go test`, not the editor squiggles.
-- **go-jet type mapping:** SQL `numeric` → `float64`, `interval` → `string`. Never store money as
-  `numeric` (float precision loss) — use **bigint minor units + a `Money` type**; store durations as
-  **int seconds**, not `interval`.
-- **`go mod tidy` chokes on dot-free local module paths** (`scrabble/...`). Hand-edit `go.mod` when a
-  bump is needed. The solver (`../scrabble-solver`) is consumed via `go.work` replace locally, but a
-  prod bump goes through a solver **PR → master + a published tag**, not a local replace.
-- **Run the whole CI suite locally before pushing** — unit + integration (`//go:build integration`,
-  Postgres) + the UI job + codegen check. Do not lean on CI to catch what a local run would.
-- **CI runner shares this host's `/tmp` as a different user.** In workflow steps, write artifacts to
-  `${GITHUB_WORKSPACE}`, never a fixed `/tmp/...` path (cross-user permission failures otherwise).
-- **pnpm corepack pre-flight flakes.** `pnpm exec` / `pnpm check` occasionally abort on a corepack
-  pre-flight. Dodge it by invoking the tool directly: `node_modules/.bin/<tool>`.
-
-## Native Android build (Capacitor)
-
-The native Android app is a Capacitor 8 wrapper of the `ui` SPA, scaffolded under
-`ui/` (a Node project outside `go.work`). Hard-won bring-up facts — verify against current code:
-
-- **Capacitor 8 needs JDK 21, not 17.** `@capacitor/android` compiles at `VERSION_21`; a JDK 17 Gradle
-  run dies with `error: invalid source release: 21`. Install sudo-free via the Homebrew **formula**
-  `brew install openjdk@21` (the `temurin@21` **cask** wants sudo for a system `.pkg`, unusable
-  non-interactively) + a user symlink into `~/Library/Java/JavaVirtualMachines/` so
-  `/usr/libexec/java_home -v 21` finds it. JDK 17 stays fine for `sdkmanager`/`avdmanager`.
-- **Cap 8 SDK pins:** compileSdk/targetSdk **36**, minSdk **24**, Gradle **8.14.3**, AGP **8.13.0**
-  (`ui/android/variables.gradle`). Install `platforms;android-36` — Android Studio's newer
-  `android-36.1` does NOT satisfy compileSdk 36.
-- **SDK is Android Studio's** at `~/Library/Android/sdk` (no `cmdline-tools` by default → `brew install
-  --cask android-commandlinetools`, then `sdkmanager`/`avdmanager --sdk_root=$HOME/Library/Android/sdk`).
-  Gradle finds it via **`ANDROID_HOME`** (`local.properties` is gitignored, machine-specific).
-- **Build recipe:** `cd ui && pnpm build && node_modules/.bin/cap sync android`; then `cd ui/android &&
-  ANDROID_HOME=~/Library/Android/sdk JAVA_HOME=$(/usr/libexec/java_home -v 21) ./gradlew assembleDebug`
-  → `ui/android/app/build/outputs/apk/debug/app-debug.apk`. Prefer the local `ui/node_modules/.bin/cap`
-  (dodges the corepack flake).
-- **Emulator smoke:** existing AVDs `Pixel_10` / `Pixel_4_Android_10_API_29` / `Pixel_Android_9`;
-  `emulator -avd <name>`, `adb install -r <apk>`, `adb shell monkey -p ru.eruditgame.app -c
-  android.intent.category.LAUNCHER 1`, `adb exec-out screencap -p > x.png`. The boot wait needs `sleep`
-  → run it as a **background** Bash task (foreground `sleep` is blocked). Browsers/WebView are cached, so a
-  full offline vs_ai turn is drivable via `adb shell input tap` (tap through the first-run coachmark tour —
-  each tap advances one step — then Hint places a suggested word; commit → the robot replies).
-- **Android 15+ edge-to-edge safe-area (WebView-version-dependent, bit me on API 37).** targetSdk 36 forces
-  edge-to-edge — the WebView draws behind the status bar (top) and the gesture-nav home indicator (bottom).
-  On Android **WebView < 140**, `env(safe-area-inset-*)` wrongly reports **0**, so chrome relying on it draws
-  under the bars and is untappable: the top nav under the clock, and the game's bottom action bar's **centre**
-  button (Hint) under the home-indicator pill (side buttons still work; `navigation_mode`=2 is gesture nav).
-  Fix is CSS-only, in TWO parts: (1) Capacitor 8's **SystemBars** plugin (built into `@capacitor/core`,
-  `insetsHandling:'css'` default — no dep, no config) injects correct `--safe-area-inset-*`; consume them as
-  `--tg-safe-*: var(--safe-area-inset-*, env(safe-area-inset-*, 0px))` (`ui/src/app.css`) — fixes any consumer
-  that ALREADY applies the token (the bottom bars: `Game.svelte`/`Screen.svelte` `--tg-safe-bottom`).
-  (2) But a consumer that never applied the top inset on the native path is NOT fixed by the token alone — the
-  **header's** top inset was Telegram-fullscreen-scoped only, so the native header sat under the status bar on
-  EVERY WebView; it needed its own `.bar { padding-top: calc(var(--safe-area-inset-top, 0px) + 5px) }`
-  (`Header.svelte`, native-only via the plugin var; tg-fullscreen still overrides via specificity). **Measure
-  per element, don't eyeball** — a centred title at y=11 under a 54px bar reads as "fine" in a screenshot but
-  is overlapping; an emulator WebView auto-updated to ≥140 (Chrome 149) also hides the `env()`=0 half (so the
-  BOTTOM looks fine there while the user's < 140 device overlaps). **Inspect a live debug WebView** over CDP:
-  `adb forward tcp:9222 localabstract:$(adb shell cat /proc/net/unix | grep -o 'webview_devtools_remote_[0-9]*'
-  | head -1)`, then Playwright `chromium.connectOverCDP('http://localhost:9222')` → `page.evaluate` (read each
-  element's `getBoundingClientRect().top`, and `--safe-area-inset-*` vs `env(...)`).
-- **`sharp` is whitelisted** in `ui/pnpm-workspace.yaml` (`allowBuilds: sharp: true`) — `@capacitor/assets`
-  uses it for `pnpm android:assets` (launcher icon/splash); else pnpm 11 raises `ERR_PNPM_IGNORED_BUILDS`.
-- **Bundled offline dicts come from the `scrabble-dictionary` release** (`scrabble-dawg-<DICT_VERSION>.tar.gz`,
-  keyed on the `DICT_VERSION` Gitea var — the same source the backend image + CI `curl`), NOT
-  `scrabble-solver/dawg` (those are the solver's pinned test fixtures).
-
-## Wire / schema evolution (client ↔ gateway ↔ backend)
-
-- **FBS is additive-only.** Add **trailing** fields ("added trailing — backward-compatible"). Never
-  delete or reorder a mid-table field — **deprecate** it (`(deprecated)`); deleting shifts field IDs
-  and breaks older readers.
-- **Retiring a domain field must also retire the WIRE field it fed** — by deprecation, not deletion,
-  and do not just zero it: a dead `0` the client dutifully syncs will clobber the real value.
-- **The gateway transcodes FBS ↔ backend JSON DTOs in lockstep.** A wire change usually means editing
-  both the FBS schema and the backend DTO.
-- **Seat display name is built in two places** — `game.Service` live events **and** the server REST
-  DTOs. Change both or they drift.
-- **A per-viewer flag is computed only in the per-viewer REST DTO**; the client seeds it from REST,
-  then bumps it from the live event. Don't expect it on the shared broadcast.
-
-## UI / Svelte 5
-
-- **Never name a `$state` variable `state`.** `svelte-check` then misreads `$state` as a store
-  subscription. Rename (e.g. `view`).
-- **Svelte trims literal edge whitespace** in markup. To keep a separator space, emit an expression:
-  `{' : '}`.
-- **No global `.btn` / `.ghost` button classes.** Style buttons per-component with scoped CSS + design
-  tokens (mirror `NewGame`'s `.invite`).
-- **A `$state` proxy fails structured-clone** when persisted to IndexedDB. Snapshot at the call site
-  with `$state.snapshot(...)` before storing.
-
-## Platform / WebView quirks (Telegram, VK, iOS, native, old Android)
-
-- **Telegram `showPopup` eats the user-activation.** Share / clipboard called from inside a
-  `showPopup` callback fail (no gesture). Use your own `Modal` for gesture-gated Web APIs.
-- **iOS Telegram `<a download blob:>` navigates away** and strands the SPA. Deliver files by **Web
-  Share on mobile**, and only use a `<a download>` Blob path on **desktop**.
-- **Android TG/VK WebViews** lack `navigator.share` and ignore `<a download>`. Deliver a
-  client-generated file by **copying it to the clipboard**.
-- **VK Android WebView ignores `target=_blank`.** Open external links through `lib/links.ts`
-  (routes to `vk.com/away.php`). Verify on-device.
-- **Per-platform file-delivery last hop differs** (TG / VK / plain browser) — there is a delivery
-  matrix; do not re-litigate it without new on-device facts.
-- **Old Android System WebView floor ≈ Chrome 67.** The bundle targets **es2019** (esbuild lowers
-  syntax), a conditional `core-js` polyfill loads only on old engines, and `index.html` has a boot
-  gate (BigInt / Proxy are the hard block → the unsupported-engine screen). There's also a `vmin`
-  glyph fallback for old rendering.
-- **iOS WKWebView overscroll and Telegram swipe-to-close are not reproducible in Playwright.** Verify
-  those live on the deployed contour, not in the e2e.
-- **Telegram Desktop Mini App shows a persistent bottom-right loader** — that's the long-lived
-  Subscribe stream, cosmetic, deliberately left as-is.
-
-## Testing
-
-- **UI test layers:** vitest (node env, pure logic, **no jsdom**) + Playwright **mock** e2e. The mock
-  e2e **bypasses the codec**, so wire/codec bugs need **codec unit tests**, not e2e coverage.
-- **Mock overlay blocks e2e.** The cold-load overlay must be instant under the mock build or it
-  intercepts Playwright taps.
-- **Mock tile pools lack a blank `'?'`.** The seeded game `G1` hard-codes one; flip `G1`'s variant to
-  eyeball per-variant tiles.
-- **Durable Playwright MCP servers** (chromium + webkit) exist for UI inspection (there's a
-  plugin-config gotcha in wiring them).
-- **The `playwright test` runner can't *fetch* browsers in this sandbox** — `playwright install` dies
-  with `EBADF` against the Playwright CDN (blocked network), even with the sandbox off. Run the e2e in
-  **CI** (the `ui` job installs chromium+webkit), or drive a state live through the **Playwright MCP**
-  browser against a local `vite --mode mock` server for visual verification. **But if chromium/webkit are
-  already cached** in `~/Library/Caches/ms-playwright/`, `playwright test` runs locally fine (only the CDN
-  fetch is blocked) — the native offline-first e2e was run green locally this way (chromium + webkit),
-  its dawgs from the sibling `../../scrabble-solver/dawg` via the webServer's `bundle-dicts.mjs` fallback.
-- **A native (Capacitor) e2e must inject `window.androidBridge`, NOT `window.Capacitor.getPlatform`.**
-  `@capacitor/core` (pulled in during boot by `initNativeShell`'s dynamic `@capacitor/app` import)
-  **replaces** any pre-set `window.Capacitor` with its own shim and derives the platform from
-  `window.androidBridge` (android) / `window.webkit.messageHandlers` (ios) — so a bare injected
-  `Capacitor.getPlatform: () => 'android'` is clobbered to `web` and the boot falls to `/login`. Inject
-  `window.androidBridge = { postMessage(){} }` in an `addInitScript` (see `e2e/native.spec.ts` `simulateNative`);
-  `initNativeShell` is written to tolerate the stub bridge (`try/catch` round the `@capacitor/app` addListener).
-- **`docker run -p ...` boot tests fail from the shell** (published ports unreachable in this env).
-  Use **testcontainers** for container-backed tests.
-- **Distroless images run as UID 65532 (nonroot).** Bind-mounted TLS keys must be **0644** (not 0600)
-  or the service crash-loops on start.
-
-## Deploy / test contour (operational)
-
-- **The TEST contour runs on THIS dev host.** Inspect it via `docker` / Prometheus. A host-side
-  `curl` to caddy **hangs** (NAT hairpin) — don't debug the edge that way.
-- **The contour's client IP is the home-router SNAT address**, not the real external IP. Correct in
-  prod, not a bug — which is why the IP ban / blocklist are **prod-only**.
-- **The contour is one shared env, last-deploy-wins.** Keep a multi-PR batch a **linear stack** (one
-  PR, one deploy) so deploys don't clobber each other.
-- **A schema/wire PR breaks the contour** until a `DROP SCHEMA` + backend restart. Note such a
-  prerelease step in `PRERELEASE.md`.
-- **A contour DB wipe resets the account but not the client's stored locale**; the reconciler then
-  syncs the stale locale, masking a fresh TG `language_code` seed. Clear client prefs too when testing
-  locale.
-- **`DNS=` in `TEST_AWG_CONF` pins the VPN netns to 1.1.1.1** → internal names go NXDOMAIN → the
-  bot-link silently dies. Diagnose from inside the netns.
-- **Swap one contour service to a local image** without deploy secrets via a busybox-in-the-netns
-  socket-inspect trick (single-service recreate).
-- **A rolling deploy did NOT recreate caddy on a config-only change.** Force `--force-recreate` for
-  caddy; don't trust "deploy green" for an edge-config change.
-- **A new gateway edge route MUST be added to the Caddyfile `@gateway` matcher** or it falls through
-  to the landing catch-all. Add a CI probe for the route.
-- **Prod caddy logs warnings only, no access log.** Trace a request via the backend "http request"
-  telemetry log or Tempo, not caddy.
-- **Confirm a release is live without SSH** by grepping the served SPA: `__APP_VERSION__` inside
-  `/assets/main-*.js`.
-- **"App hangs on load" was a dead HTTP/3 advert:** caddy sent `Alt-Svc: h3` with no UDP/443 open;
-  clients cache it ~30 days. Fix with `Alt-Svc: clear`.
-- **Config-poison deploy loop:** a crash-looping config-mounted service + a missing bind source
-  produces a root-owned directory that then fails deploys. Break it by removing the root-owned dir.
-- **Maintenance-window contract** (planned-deploy 503): a marker header, `/_gm` exempt, the flag spans
-  the whole roll, the SPA overlay reloads on recovery. Don't break these invariants.
-- **A new dictionary goes live via a `/_gm/dictionary` upload, NOT a redeploy.** In-flight games keep
-  their pinned version. The **owner** does the upload.
-- **Renderer deploy job flakes** on the skia-canvas GitHub binary download when its lockfile changes —
-  re-run, it's not your code.
-
-## Repo workflow
-
-- **PR-based, zero issues.** Work is tracked via PRs + `PRERELEASE.md`. "заведи задачу" means *do it*
-  / add a plan line — not file a tracker issue.
-- **`tea` CLI for all Gitea ops** (PRs, secrets, variables, dispatch). `gh` does **not** work here. The
-  agent **cannot self-approve** a PR but **can merge** it after the owner approves. Watch the
-  stale-mergeable trap (re-check mergeability right before merging).
-- **Watch every push/merge/deploy to green** with `python3 ~/.claude/bin/gitea-ci-watch.py`, launched
-  **bare** under a background task. It polls run-level conclusions; its `ALL GREEN` already covers the
-  gated deploy job. Pass `--no-runs 600` when the runner is busy. A **merge** is the most-forgotten
-  case — watch the post-merge runs too.
-- **After a merge, switch to the merged-into branch** (`development`/`master`), pull, and prune the
-  local feature branch.
-- **The contour deploy probe checks the backend `/readyz`**; a PR deploy builds the PR's own code; a
-  wedged contour can be recovered by recreating the host container set.
-
-## Domain semantics (not obvious from the code)
-
-- **Account deletion must NOT delete any user messages** — including feedback / support. Interview the
-  owner on every deletion point before wiring it.
-- **`account.time_zone` is `NOT NULL DEFAULT 'UTC'`, seeded from a detected ±HH:MM offset.** An email
-  account row is created at the **code-request** step, not at confirmation.
-- **The robot has two distinct time windows:** a **sleep window** (~00:00–07:00, gates its moves and
-  nudges) vs the **player away window** (turn-timeout only). "окно отсутствия" in dialogue = the
-  **sleep** window.
-
-## Production topology
-
-- **Two prod hosts.** `main` — full stack + ACME/edge (Selectel); `tg` — Telegram bot only (vdsina).
-  SSH aliases `scrabble-main-ops` / `scrabble-tg-ops`. Deploy is **manual dispatch only**, rolling +
-  health-gated + auto-rollback. Hosts are provisioned by `deploy/ansible/` (inventory + vars there —
-  the source of truth for IPs/roles).
-- **The agent has targeted root SSH** to the hosts (and may run the prod Ansible). Surface every
-  owner-side step **before** a deploy, not after.
-
-## Feature-area pointers (state lives in the linked docs/plans, not here)
-
-- **Monetization** — «Фишка» currency, per-platform wallets, ads. Agreements in
-  `docs/PAYMENTS_DECISIONS_ru.md`; a phased plan (E0–E9). go-jet money rule above applies.
-- **PITR** — pgBackRest → Selectel S3 (encrypted, 30-day), currently **gated off**; runbook in
-  `deploy/README.md`. Gotcha: run pgBackRest via docker-exec **as the `postgres` user** with
-  `--pg1-user=scrabble`.
-- **Offline mode** — the robot brain, move generator/validator/scorer and DAWG reader are **JS ports**
-  of the Go engine, bundled client-side and **parity-pinned** by golden tests. Multi-phase; native
-  offline-first bundles the dictionaries.
-- **VK ID web login** — raw OAuth 2.1 against `id.vk.com`, a **separate VK "Web" app** from the Mini
-  App, server-side confidential code exchange.
-- **Email relay** — Selectel SMTP + confirm / link / unlink / deletion codes + alerts.
-- **Native Android** — Capacitor bundle model, client-version gate, offline-first, RuStore; the
-  design lives in `docs/ARCHITECTURE.md` (§2 gate, §3 identity, §13 native build).

.claude/skills/deploy-check/SKILL.md

@@ -1,89 +0,0 @@
----
-name: deploy-check
-description: "Use before any deploy-touching change to this repo — phrases like '/deploy-check', 'is this prod-safe', 'before we deploy', 'deploy safety review', 'проверь перед деплоем', 'это безопасно для прода'. Runs a pre-deploy checklist of this project's hard-won runtime constraints against the current diff, so the crash classes that have bitten live environments get caught before shipping instead of after."
----
-
-# Pre-deploy runtime-constraint check
-
-Triggered before shipping anything that touches the deploy contour (Dockerfiles,
-`deploy/`, Caddyfile, compose, migrations, boot guards, the Telegram side-service,
-edge config). The worst frictions in this repo were never logic bugs — they were
-**environment mismatches that crashed a live env and forced a redesign**. Run this
-list against the diff first; turn crash-and-redesign into a single pass.
-
-This checklist is a prompt, **not** the source of truth. The canonical detail
-lives in `deploy/README.md`, `docs/ARCHITECTURE.md`, `docs/EDGE_HTTP3.md`, and the
-agent memory files referenced below — read them when an item is in play, and add a
-new class here when a new incident teaches one.
-
-## How to run it
-
-1. `git diff <base>...HEAD --stat` to see what the change actually touches.
-2. For every risk class below that the diff touches, perform the **Check** and
-   report PASS / FAIL with the exact file:line to fix. Skip classes the diff does
-   not touch — say which you skipped and why.
-3. Remember: **deploy-job green ≠ healthy**. CI's deploy probe has historically
-   passed with a dead backend (it only checked static landing+gateway). Verify the
-   real feature live (`/readyz`, the actual flow) after deploy, not just the green.
-
-## Risk classes
-
-### 1. Container user — distroless nonroot UID 65532
-- **Bit us:** TLS keys `chmod 600` for the host owner crash-looped gateway + bot at
-  boot with "permission denied" — service images run UID 65532.
-- **Check:** any new/changed mounted secret, key, or config file must be readable by
-  UID 65532 (`0644`, not `0600`). Scan the diff for file modes, `chmod`, and new
-  volume mounts. (memory: `distroless-nonroot-mounted-secrets`)
-
-### 2. Caddy header pipeline ordering
-- **Bit us:** `header_up delete` after `set` nulled the value (the honeypot tag went
-  empty); it passed CI and only showed up live.
-- **Check:** in any Caddyfile change, verify the `set` / `delete` / `header_up`
-  ordering for every affected route, and test the tripwire/route on the live
-  contour, not just CI.
-
-### 3. Edge Alt-Svc / HTTP3
-- **Bit us:** edge advertised `Alt-Svc: h3` while UDP/443 was never exposed
-  (docker tcp-only + ufw tcp-only); clients cached it 30 days and stalled on dead
-  QUIC before falling back to h2 — Mini App "hangs on load".
-- **Check:** any edge/caddy change keeps `Alt-Svc: clear` (or only advertises h3 if
-  UDP/443 is genuinely exposed). (memory: `tg-app-load-stall-dead-http3-altsvc`,
-  `docs/EDGE_HTTP3.md`)
-
-### 4. Prod caddy config recreate
-- **Bit us:** prod rolling deploy did **not** recreate caddy on a config-only change
-  (pinned `caddy:2-alpine` + `admin off`), so a new Caddyfile deployed GREEN but
-  stayed inert until a manual `docker restart`.
-- **Check:** a config-only edge change must `--force-recreate` caddy in
-  `prod-deploy.sh` `roll()`; never trust deploy-green for edge config.
-  (memory: `prod-deploy-caddy-config-recreate`)
-
-### 5. DICT_VERSION / dictionary boot
-- **Bit us:** an early `DICT_VERSION` refuse-boot guard was wrong and crashed the
-  live env when bumped on a seeded volume; it had to be redesigned to "marker-wins".
-- **Check:** any change touching `DICT_VERSION`, dict load, or the boot guard must
-  keep marker-wins semantics and survive a seeded volume **and** an image rollback.
-  `DICT_VERSION` is a required build-arg (no default), single-sourced. A new dict
-  goes live via the admin console upload, not a redeploy. (memory:
-  `dict-version-deploy-verify`, `contour-schema-change-wipe`)
-
-### 6. Migrations — expand-contract + rollback safety
-- **Bit us / risk:** a non-backward-compatible migration breaks image rollback (DB
-  ahead of rolled-back code).
-- **Check:** migrations must be **expand-contract** (backward-compatible). A schema
-  change adds the maintenance window + a consistent `pg_dump` in prod-deploy. On the
-  **test contour**, a schema/wire-label change needs `DROP SCHEMA backend CASCADE` +
-  backend restart (new code vs old persisted DB), else the contour breaks. (memory:
-  `contour-schema-change-wipe`)
-
-### 7. Telegram permission model
-- **Bit us:** permissions are an **AND-intersection** — default-allow with explicit
-  denies, not default-deny; inverting it broke access.
-- **Check:** any change to the Telegram permission / relay logic preserves the
-  AND-intersection default-allow shape. (memory: `telegram-forum-relay-gotchas`)
-
-## Output
-
-A short PASS/FAIL table over the classes the diff touches, each FAIL with the exact
-file:line and the fix. If every touched class passes, say so plainly and name the
-post-deploy live check to run (not just "CI green").

.claude/vk-games-integration.md

@@ -1,175 +0,0 @@
-# VK Mini App / VK Games — integration reference
-
-Captured research + our implementation map, so a future session does not need to re-fetch
-the VK docs. Authoritative external source: <https://dev.vk.com/> (the `dev.vk.com` portal
-does not render via plain HTTP fetch; the facts below were cross-checked against the VKCOM
-reference repos cited at the end and verified against our own Go implementation).
-
-A VK **game** is technically a **VK Mini App**: an HTML5 SPA VK loads in an **iframe inside
-vk.com** (desktop + mobile web) and in a **WebView** inside the VK mobile apps (iOS/Android).
-We serve our existing SPA under a dedicated `/vk/` path, mirroring the Telegram `/telegram/`
-entry — the single-origin, path-routed model.
-
-## 1. Embedding model
-
-- VK loads the app at the **Web iframe URL** configured in the app settings (HTTPS + valid
-  cert required), appending the signed launch parameters as the **URL query string**.
-- An optional separate **Mobile iframe URL** is used by the VK mobile apps (we use the same).
-- No special `X-Frame-Options` / CSP `frame-ancestors` is required from us — VK frames the
-  configured origin. (Our edge sets **no** framing headers today, so VK works as-is; see the
-  clickjacking note in §Security.)
-- URL must match the settings exactly (scheme, host, no stray `www`/whitespace).
-
-## 2. Launch parameters (URL query)
-
-VK appends these to the iframe `src`. The `vk_*` set is what the signature covers.
-
-| Param | Meaning |
-| --- | --- |
-| `vk_user_id` | signed-in VK user numeric id — **the identity** |
-| `vk_app_id` | our registered app id |
-| `vk_is_app_user` | 0/1 — user authorized/installed the app |
-| `vk_are_notifications_enabled` | 0/1 |
-| `vk_language` | 2-letter UI language (`ru`, `en`, …) |
-| `vk_platform` | `mobile_iphone` \| `mobile_android` \| `mobile_web` \| `desktop_web` \| … |
-| `vk_ts` | unix seconds when VK generated the params |
-| `vk_ref` | where the app was opened from (`catalog`, `feed`, …) |
-| `vk_access_token_settings` | comma-separated granted scopes (often empty) |
-| `vk_group_id`, `vk_viewer_group_role`, `vk_is_favorite`, `vk_client` | optional/contextual |
-| `sign` | **the signature** (see §3) — NOT part of the signed set |
-
-Always present: `vk_user_id`, `vk_app_id`, `vk_platform`, `vk_ts`, `sign`.
-
-The user's **name is NOT in the launch params** (only `vk_user_id`). Read it client-side via
-`VKWebAppGetUserInfo` (see §4) — unsigned, so treat it as a cosmetic display seed only.
-
-## 3. Signature verification (`sign`)  — CONFIRMED base64url, not hex
-
-Algorithm (verified against our `gateway/internal/vkauth` + an independent Python reference):
-
-1. Collect the query params whose key starts with `vk_` (exclude `sign`).
-2. Sort by key (alphabetical).
-3. Serialize as a URL-encoded query string `k=v&k=v…` (Go `url.Values.Encode()` matches VK's
-   reference serialization for the constrained launch-param charset).
-4. `HMAC-SHA256(serialized, secret)` where `secret` = the app's **«Защищённый ключ»**
-   (protected / secure key, a.k.a. client_secret) from the app settings.
-5. **base64url, no padding** (`+`→`-`, `/`→`_`, strip `=`).
-6. Constant-time compare against `sign`.
-
-VK launch params have **no built-in expiry** (unlike Telegram's `auth_date`). We do NOT enforce
-freshness — the minted server session is the short-lived credential; a replay only
-re-authenticates the same `vk_user_id`.
-
-Verified against the official doc <https://dev.vk.com/ru/mini-apps/development/launch-params-sign>
-(prose + PHP example: base64url = `strtr('+/','-_')` + `rtrim('=')`) and reproduced identically by
-independent Node `crypto` + Python references. **Doc-example caveat**: that page shows secret
-`wvl68m4dR1UpLrVRli` → sign `exTIBP…`, but the secret is a **placeholder** — recomputing with it does
-NOT yield the shown sign (it was made with the real, unshown key). Don't chase the mismatch; our
-`vkauth.Verify` is correct (`gateway/internal/vkauth/vkauth_test.go` carries cross-checked vectors,
-incl. the `%2C` comma case for `vk_access_token_settings`).
-
-## 4. VK Bridge (client SDK)
-
-`@vkontakte/vk-bridge` (npm, v3.x; bundled — `default` export `bridge`). Methods we use / may use:
-
-- `VKWebAppInit` — **required**: tells VK the Mini App loaded (dismisses VK's loading cover).
-- `VKWebAppGetUserInfo` — `{ id, first_name, last_name, photo_200, … }`; no extra scope needed.
-- `VKWebAppGetLaunchParams` — parsed `vk_*` **without** `sign` (so NOT usable for our server
-  verification — read `window.location.search` instead, which carries `sign`).
-- `VKWebAppGetAuthToken` — OAuth access token for VK API calls (only if we ever call VK API).
-- `VKWebAppShare` — native share dialog (the friend-code invite uses it; `navigator.share` is absent
-  in the desktop VK iframe). **Used.**
-- `VKWebAppCopyText` — clipboard copy that works inside the VK iframe, where `navigator.clipboard` is
-  blocked. **Used** as the copy-code / copy-link path.
-- `VKWebAppUpdateConfig` (subscribe) — light/dark scheme; the app follows it while the theme pref is
-  "auto" (the VK webview's prefers-color-scheme does not track it). **Used.**
-- `VKWebAppSetViewSettings` / `VKWebAppSetSwipeSettings` — viewport / swipe-back (mobile); not used.
-- `VKWebAppUpdateInsets` (+ `VKWebAppUpdateConfig`) — device safe-area insets; the app **max'es** them
-  with CSS `env(safe-area-inset-*)` (viewport-fit=cover) so the bottom home bar is cleared. The bridge
-  value is needed on Android, where the VK webview exposes no `env()` inset. **Used.**
-
-The bridge talks to the embedding VK client over postMessage; it is NOT an external fetch, so
-it has no telegram.org-style load-hang risk. The SDK reads browser globals at import — we import
-it **lazily** so the pure URL helpers stay node-test-importable.
-
-**Deep links — NOT possible on VK (confirmed on the contour).** The VK iframe receives ONLY the signed
-`vk_*` launch params (+ `sign`); VK strips any custom data from the app link. The documented
-`vk.com/app<id>#<payload>` form is eaten by the vk.com SPA (which owns the URL hash), and a
-`vk.com/app<id>?hash=<payload>` query is dropped (the diagnostic showed `rawSearch` with only `vk_*`
-and an empty `hash`). So the friend-code invite link is just `vk.com/app<id>` (`vkShareLink`, app id
-from `vk_app_id`); the recipient enters the **copied code by hand** (`VKWebAppCopyText` works). The
-`vkStartParam` reader + the `bootVK` routing stay as a no-op today, ready if a post-moderation VK
-channel (e.g. an invite API) ever delivers a payload.
-
-## 5. Test mode (to verify before moderation)
-
-1. App already registered (we have the App ID).
-2. In the app settings (dev.vk.com / `vk.com/editapp?act=settings&app_id=<id>`):
-   - Category = **Игра** (Game).
-   - **Web iframe URL** = our public HTTPS `/vk/` (the test-contour origin for contour testing,
-     prod `https://erudit-game.ru/vk/` later). Mobile iframe URL = same.
-   - Copy the **«Защищённый ключ»** → set as `GATEWAY_VK_APP_SECRET` (Gitea `TEST_`/`PROD_` secret).
-   - Add own VK id to **testers**; open in test mode.
-3. Test mode = visible only to admins/testers, no payments processed.
-
-## 6. Auth / identity (our model)
-
-- `vk_user_id` (from verified params) → backend identity `kind='vk'`, `external_id=vk_user_id`,
-  auto-confirmed (a platform identity). First contact seeds language from `vk_language` and the
-  display name from the client-supplied `VKWebAppGetUserInfo` name (placeholder if empty).
-- No VK access token / VK API call needed for the launch+login MVP.
-
-## 7. Payments / monetization
-
-VK Pay / «голоса» (votes) are **optional**, not required to publish a free game. Not planned.
-
-## 8. ToS / moderation (pre-publish, analyzed — no blocker for a free «Эрудит»)
-
-- **Trademark**: "Scrabble" is trademarked. Our public brand is **«Эрудит»** (erudit-game.ru),
-  a generic Russian word-game name → fine. Ensure the VK-registered app name is «Эрудит»/word-game,
-  NOT "Scrabble". The repo name is internal and irrelevant to moderation.
-- **Pre-publish requirements**: public **Privacy Policy** + **ToS** URLs (disclose collected data:
-  `vk_user_id`, language; mention VK), **age rating** (likely 6+/12+), icon, description.
-- **Dictionary**: standard word lists; VK may expect offensive-word filtering — likely fine for a
-  dictionary game, flag if moderation asks.
-- **In-game chat (UGC)**: we already have a moderated chat + support relay → covered.
-- Moderation reviews after submission (commonly ~24–72h); rejects on violence/hate/sexual/illegal
-  content or IP infringement — none apply.
-
-## 9. Platforms
-
-Desktop web (iframe), mobile web (iframe), VK iOS app (WKWebView), VK Android app (WebView). Bridge
-methods behave per-platform; the app's own back chevron + app-shell document-pin cover navigation
-without VK-specific code. Theme/viewport fine-tuning is best verified live in the real VK client
-(not reproducible in Playwright — like the iOS gesture caveats).
-
-## 10. Our implementation map (what to touch for VK)
-
-- **Wire**: `pkg/fbs/scrabble.fbs` → `VKLoginRequest{ params, browser_tz, display_name }`
-  (regen: `make -C pkg fbs` + `pnpm -C ui codegen`).
-- **Gateway**: `internal/vkauth/` (the §3 verify), `internal/transcode` op `auth.vk`
-  (registered via `WithVKAuth(secret)` option; `DomainCode` → `invalid_vk_params`),
-  `internal/backendclient` `VKAuth` → `POST /api/v1/internal/sessions/vk`,
-  config `GATEWAY_VK_APP_SECRET`, SPA mount `/vk/` in `internal/connectsrv/server.go`.
-- **Backend**: `internal/account` `KindVK` + `ProvisionVK`/`vkSeed` + `confirmed` for platform
-  kinds; `internal/server/handlers_auth.go` `handleVKAuth` + route; migration
-  `00005_vk_identity.sql` (widen `identities_kind_chk` to include `'vk'`, expand-contract).
-- **UI**: `src/lib/vk.ts` (`onVKPath`/`vkLaunchParams`/`insideVK`/`vkInit`/`vkUserName` plus `vkAppId`/
-  `vkStartParam`/`vkShare`/`vkCopyText`/`vkOnScheme`), `app.svelte.ts` `bootVK` (+ deep-link routing
-  and VK scheme→theme) + the `/vk/` dispatch branch + shared `retryMiniAppBoot`, `codec.ts`
-  `encodeVKLogin`, `transport.ts`/`client.ts`/`mock/client.ts` `authVK`, `deeplink.ts` `vkShareLink`,
-  `Friends.svelte` (VK share/copy), `app.css` `--tg-safe-*` defaulting to `env(safe-area-inset-*)`.
-- **Edge/deploy**: `deploy/caddy/Caddyfile` `/vk` path; `GATEWAY_VK_APP_SECRET` in
-  `docker-compose.yml` + `.env.example` + `ci.yaml` (`TEST_…` secret) + `prod-deploy.yaml`
-  (`PROD_…` secret, deploy-main).
-- **Deferred**: payments (VK Pay / votes), native (Capacitor) VK, account-linking a vk identity to an
-  existing account, VK push. (Done after the launch+auth MVP — Group B: native share + clipboard via
-  the bridge, the friend-code deep link, the auto-theme follow, and the home-bar safe area.)
-
-## Sources
-
-- VKCOM/vk-bridge — <https://github.com/VKCOM/vk-bridge>
-- VKCOM/vk-apps-launch-params (canonical signature examples) — <https://github.com/VKCOM/vk-apps-launch-params>
-- kravetsone/vk-launch-params — <https://github.com/kravetsone/vk-launch-params>
-- SevereCloud/vksdk `vkapps.ParamsVerify` (Go reference) — <https://pkg.go.dev/github.com/SevereCloud/vksdk/v2/vkapps>
-- VK Mini Apps API — <https://github.com/VKCOM/vk-mini-apps-api>

.gitea/workflows/android-build.yaml

@@ -1,172 +0,0 @@
-# Manual signed-APK build for the standalone Android app (RuStore). Runs ONLY from master, ONLY on
-# workflow_dispatch with confirm=build — the same deliberate-manual shape as prod-deploy.yaml, never on
-# a PR. It builds the native-flavoured SPA, bundles the offline dictionaries into the APK assets, and
-# assembles a release APK, uploaded as a run artifact (RuStore upload stays manual for the MVP).
-#
-# Signing degrades gracefully: with the ANDROID_RUSTORE_* secrets present the APK is signed; without
-# them build.gradle produces an UNSIGNED release APK (so a dry run still proves the whole pipeline).
-# The keystore is a publication prerequisite — see deploy/README.md (Android build/release runbook).
-# The toolchain is self-provisioned here (JDK 21 + a cached Android SDK), so the runner host needs
-# nothing pre-installed.
-name: android-build
-run-name: "android build ${{ github.sha }}"
-
-on:
-  workflow_dispatch:
-    inputs:
-      confirm:
-        description: 'Type "build" to confirm an APK build from master.'
-        required: true
-        default: ""
-
-permissions:
-  contents: read
-
-env:
-  NO_COLOR: "1"
-  # The dictionary release, one source of truth (same Gitea variable the backend image + CI use). It
-  # both fetches the DAWGs and labels the bundled files (VITE_DICT_VERSION must equal __DICT_VERSION__).
-  DICT_VERSION: ${{ vars.DICT_VERSION }}
-  VITE_DICT_VERSION: ${{ vars.DICT_VERSION }}
-  # Hide in-app purchases in the RuStore MVP (RuStore, not Google Play — VITE_GP_BUILD stays unset).
-  VITE_PAYMENTS_DISABLED: "1"
-  # The update overlay's store target; empty until publication (the button no-ops, and the version gate
-  # is dormant in the MVP so it never fires). Set the ANDROID_RUSTORE_URL variable when the app is live.
-  VITE_RUSTORE_URL: ${{ vars.ANDROID_RUSTORE_URL }}
-  # Host-executor runner: the Android SDK is pre-installed on the host. Override ANDROID_SDK_DIR if it
-  # lives elsewhere (the default matches deploy/README.md's install path).
-  ANDROID_HOME: ${{ vars.ANDROID_SDK_DIR || '/opt/android-sdk' }}
-  ANDROID_SDK_ROOT: ${{ vars.ANDROID_SDK_DIR || '/opt/android-sdk' }}
-
-jobs:
-  build:
-    if: ${{ github.ref == 'refs/heads/master' && inputs.confirm == 'build' }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      # Host-executor runner: the Android SDK is pre-installed on the host (JDK 21 comes from setup-java
-      # below). Fail fast + legibly if the runner user cannot read/execute it or a needed package is
-      # missing — this doubles as the runner-access check (deploy/README.md).
-      - name: Verify the host Android SDK
-        run: |
-          sm="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
-          if [ ! -x "$sm" ]; then
-            echo "::error::sdkmanager not found/executable at $sm — set the ANDROID_SDK_DIR variable if the SDK lives elsewhere, or grant the runner user read+exec: sudo chmod -R a+rX \"$ANDROID_HOME\""; exit 1
-          fi
-          for pkg in "platforms/android-36" "build-tools"; do
-            if [ ! -d "$ANDROID_HOME/$pkg" ]; then
-              echo "::error::missing $ANDROID_HOME/$pkg — run: \"$sm\" 'platforms;android-36' 'build-tools;36.0.0'"; exit 1
-            fi
-          done
-          echo "Android SDK OK at $ANDROID_HOME"; "$sm" --version
-
-      - name: Compute version + native build env
-        id: prep
-        env:
-          PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-        run: |
-          # A store release must sit on an exact vMAJOR.MINOR.PATCH tag (G tags before dispatch) so the
-          # versionCode is deterministic and strictly increasing across uploads. Refuse anything else
-          # rather than derive a versionCode from a "-N-gSHA" describe.
-          desc="$(git describe --tags --exact-match 2>/dev/null || true)"
-          case "$desc" in
-            v[0-9]*.[0-9]*.[0-9]*) ;;
-            *) echo "::error::HEAD is not on a clean vX.Y.Z tag (git describe --exact-match = '${desc:-none}'); tag the release first"; exit 1 ;;
-          esac
-          v="${desc#v}"
-          IFS=. read -r MA MI PA <<< "$v"
-          # 10# forces base-10 so a zero-padded part is never read as octal.
-          code=$(( 10#$MA * 1000000 + 10#$MI * 1000 + 10#$PA ))
-          # The native SPA talks to the production origin (reuse the prod public base URL); strip any
-          # trailing slash so the Connect endpoint never doubles it.
-          gateway="${PUBLIC_BASE_URL%/}"
-          {
-            echo "tag=$desc"
-            echo "name=$v"
-            echo "code=$code"
-            echo "gateway=$gateway"
-          } >> "$GITHUB_OUTPUT"
-          echo "release $desc -> versionName $v versionCode $code, gateway $gateway"
-
-      # Same release + fetch as the Go/UI jobs in ci.yaml — the bundled dicts come from this tarball,
-      # NOT the scrabble-solver sibling (ui is a Node project outside go.work).
-      - name: Fetch dictionary DAWGs
-        run: |
-          mkdir -p "${GITHUB_WORKSPACE}/dawg"
-          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
-          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
-          ls -la "${GITHUB_WORKSPACE}/dawg"
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install pnpm
-        run: npm install -g pnpm@11.0.9
-
-      - name: Install deps
-        working-directory: ui
-        run: pnpm install --frozen-lockfile
-
-      - name: Build the SPA (native flavour)
-        working-directory: ui
-        env:
-          VITE_GATEWAY_URL: ${{ steps.prep.outputs.gateway }}
-          VITE_APP_VERSION: ${{ steps.prep.outputs.tag }}
-        run: pnpm run build
-
-      # Copy the release DAWGs into dist/dict/<variant>@<version>.dawg for the offline-first bundled tier
-      # (after the build, before cap sync copies dist/ into the native assets).
-      - name: Bundle the dictionaries
-        working-directory: ui
-        env:
-          DICT_DIR: ${{ github.workspace }}/dawg
-        run: node scripts/bundle-dicts.mjs
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "21"
-
-      # Local cap binary (dodges the corepack pre-flight flake); syncs dist/ (incl. dict/) + native deps.
-      - name: Sync the native project
-        working-directory: ui
-        run: node_modules/.bin/cap sync android
-
-      - name: Decode the release keystore
-        id: keystore
-        env:
-          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_RUSTORE_KEYSTORE_BASE64 }}
-        run: |
-          if [ -n "$ANDROID_KEYSTORE_BASE64" ]; then
-            printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > "${GITHUB_WORKSPACE}/release.jks"
-            echo "file=${GITHUB_WORKSPACE}/release.jks" >> "$GITHUB_OUTPUT"
-            echo "keystore decoded -> signed release build"
-          else
-            echo "file=" >> "$GITHUB_OUTPUT"
-            echo "::warning::ANDROID_RUSTORE_KEYSTORE_BASE64 secret is not set — building an UNSIGNED release APK (not installable/publishable)"
-          fi
-
-      - name: Assemble the release APK
-        working-directory: ui/android
-        env:
-          ANDROID_KEYSTORE_FILE: ${{ steps.keystore.outputs.file }}
-          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_RUSTORE_KEYSTORE_PASSWORD }}
-          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_RUSTORE_KEY_ALIAS }}
-          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_RUSTORE_KEY_PASSWORD }}
-        run: ./gradlew assembleRelease -PversionCode=${{ steps.prep.outputs.code }} -PversionName=${{ steps.prep.outputs.name }} --console=plain
-
-      - name: Upload the APK artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: erudit-${{ steps.prep.outputs.name }}-apk
-          path: ui/android/app/build/outputs/apk/release/*.apk
-          if-no-files-found: error

.gitea/workflows/ci.yaml

@@ -26,12 +26,12 @@ on:
   push:
     branches: [development]
 
-# The dictionary release. One Gitea variable is the single source of truth: the
-# test suite validates against it here (inherited by the unit/integration jobs) and
-# both contours' deploy jobs seed a fresh volume with the same value. A release bump
-# is one edit (the variable). See deploy/README.md.
+# The dictionary release the test suite validates against — the current
+# scrabble-dictionary release. Centralised here so a release bump is one edit; the
+# unit/integration jobs inherit it. The deploy job overrides it per contour with
+# vars.TEST_DICT_VERSION (the seed for a fresh volume), see deploy/README.md.
 env:
-  DICT_VERSION: ${{ vars.DICT_VERSION }}
+  DICT_VERSION: v1.2.1
 
 jobs:
   # changes detects which areas a PR/push touched, so the test jobs can skip when
@@ -73,9 +73,6 @@ jobs:
             go=false; ui=false
             if echo "$files" | grep -qE '^(backend/|pkg/|gateway/|platform/|loadtest/|go\.work)'; then go=true; fi
             if echo "$files" | grep -qE '^ui/'; then ui=true; fi
-            # The render sidecar bundles ui/src/lib, so its dir rides the ui lane (the
-            # deploy's compose build picks it up either way).
-            if echo "$files" | grep -qE '^renderer/'; then ui=true; fi
             # A workflow or deploy change re-runs everything as a safety net.
             if echo "$files" | grep -qE '^(\.gitea/workflows/|deploy/)'; then go=true; ui=true; fi
           else
@@ -202,96 +199,19 @@ jobs:
       - name: Bundle-size budget
         run: node scripts/bundle-size.mjs
 
-      # The render sidecar executes the shared ui/src/lib/gameimage.ts on skia-canvas;
-      # its smoke test guards the bundling + skia seam (docs/TESTING.md).
-      - name: Render sidecar test
-        working-directory: renderer
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-
       - name: Install Playwright browsers
         run: pnpm exec playwright install chromium webkit
         timeout-minutes: 5
 
-      # The offline e2e plays a real local vs_ai game, so it needs the per-variant dawgs; fetch the
-      # release the same way the Go jobs do and point the mock preview's copy step (scripts/
-      # e2e-dict.mjs, via E2E_DICT_DIR below) at it.
-      - name: Fetch dictionary DAWGs
-        run: |
-          mkdir -p "${GITHUB_WORKSPACE}/dawg"
-          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
-          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
-          ls -la "${GITHUB_WORKSPACE}/dawg"
-
       - name: E2E smoke (mock)
         run: pnpm run test:e2e
         timeout-minutes: 5
-        env:
-          E2E_DICT_DIR: ${{ github.workspace }}/dawg
-
-  # conformance proves the client's local move preview (the ported dawg reader +
-  # validator, ui/src/lib/dict) byte-for-byte against the authoritative Go engine:
-  # a Go step generates golden parity vectors from the release dictionaries, then the
-  # gated Vitest suite replays them. It spans both toolchains, so it runs whenever the
-  # Go engine side or the UI side changed.
-  conformance:
-    needs: changes
-    if: ${{ needs.changes.outputs.go == 'true' || needs.changes.outputs.ui == 'true' }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      GOPRIVATE: gitea.iliadenisov.ru/*
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Fetch dictionary DAWGs
-        run: |
-          mkdir -p "${GITHUB_WORKSPACE}/dawg"
-          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
-          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.work
-          cache: true
-
-      - name: Generate golden parity vectors
-        run: |
-          go run ./backend/cmd/dictgen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/dictgold
-          go run ./backend/cmd/validategen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/validgold
-          go run ./backend/cmd/movegen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out "${GITHUB_WORKSPACE}/movegold"
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install pnpm
-        run: npm install -g pnpm@11.0.9
-
-      - name: Install deps
-        working-directory: ui
-        run: pnpm install --frozen-lockfile
-
-      - name: Local-eval conformance (reader + validator vs the Go engine)
-        working-directory: ui
-        env:
-          DICT_DAWG_DIR: ${{ github.workspace }}/dawg
-          DICT_GOLD_DIR: /tmp/dictgold
-          DICT_VALID_DIR: /tmp/validgold
-          DICT_MOVEGEN_DIR: ${{ github.workspace }}/movegold
-        run: pnpm exec vitest run src/lib/dict/
 
   # gate is the single branch-protection required check. It always runs and passes
   # only when each upstream job succeeded or was skipped (a path-filtered no-op),
   # failing the merge if any actually failed or was cancelled.
   gate:
-    needs: [unit, integration, ui, conformance]
+    needs: [unit, integration, ui]
     if: always()
     runs-on: ubuntu-latest
     defaults:
@@ -301,7 +221,7 @@ jobs:
       - name: Aggregate required checks
         run: |
           fail=
-          for r in "unit:${{ needs.unit.result }}" "integration:${{ needs.integration.result }}" "ui:${{ needs.ui.result }}" "conformance:${{ needs.conformance.result }}"; do
+          for r in "unit:${{ needs.unit.result }}" "integration:${{ needs.integration.result }}" "ui:${{ needs.ui.result }}"; do
             name="${r%%:*}"; res="${r#*:}"
             echo "$name = $res"
             case "$res" in
@@ -316,13 +236,9 @@ jobs:
     # Auto test-deploy on a PR into development and on the push that merges it.
     # A PR into master is test-only (this job is skipped); prod deploy is manual.
     # Gates on `gate` (so a real test failure blocks the deploy) but runs even when
-    # some test jobs were path-skipped. Skipped entirely when neither the Go nor the
-    # UI side changed (e.g. a docs-only change): the contour image is unchanged, so
-    # there is nothing to redeploy. `changes` still defaults both to true when the
-    # diff is uncomputable, and a workflow/deploy edit forces both true, so an
-    # ambiguous or infra change still deploys as a safety net.
-    needs: [changes, gate]
-    if: ${{ (needs.changes.outputs.go == 'true' || needs.changes.outputs.ui == 'true') && ((github.event_name == 'push' && github.ref == 'refs/heads/development') || (github.event_name == 'pull_request' && github.base_ref == 'development')) }}
+    # some test jobs were path-skipped.
+    needs: [gate]
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/development') || (github.event_name == 'pull_request' && github.base_ref == 'development') }}
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -345,59 +261,12 @@ jobs:
           GRAFANA_ADMIN_PASSWORD: ${{ secrets.TEST_GRAFANA_ADMIN_PASSWORD }}
           TELEGRAM_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_BOT_TOKEN }}
           TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_PROMO_BOT_TOKEN }}
-          # VK Mini App protected key (offline HMAC for the launch-param signature); empty
-          # leaves the VK auth path (auth.vk) disabled until the operator sets the secret.
-          # One VK Mini App serves every contour -> unprefixed secret.
-          GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-          # VK ID web login (browser VK-identity linking): the VK ID "Web" app's protected key
-          # for the server-side confidential code exchange — a SEPARATE VK app from the Mini
-          # App above. One VK ID "Web" app serves every contour -> unprefixed secret.
-          GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-          # Client-version gate (ARCHITECTURE.md §2): one plain (unprefixed) variable serves every
-          # contour. In the test contour the stamped client version is a commit hash (unparseable ⇒
-          # fail-open), so setting these only enforces on real semver prod builds. Empty ⇒ dormant.
-          GATEWAY_MIN_CLIENT_VERSION: ${{ vars.GATEWAY_MIN_CLIENT_VERSION }}
-          GATEWAY_RECOMMENDED_CLIENT_VERSION: ${{ vars.GATEWAY_RECOMMENDED_CLIENT_VERSION }}
-          # Planted honeytoken bearer: presenting it flags the caller (logs + a ban metric on
-          # test where the IP ban is off; a 24h IP ban on prod). Per-contour secret; empty = trap off.
-          GATEWAY_HONEYTOKEN: ${{ secrets.TEST_GATEWAY_HONEYTOKEN }}
-          # Signs the finished-game export download URLs (backend + compose interpolation).
-          EXPORT_SIGN_KEY: ${{ secrets.TEST_EXPORT_SIGN_KEY }}
-          # Transactional email via the shared Selectel relay: one account for every
-          # contour -> unprefixed host/port/tls/user/pass. Empty host leaves the backend
-          # on the log mailer (email disabled) but the contour still boots.
-          SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-          SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-          SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-          SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-          SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-          # Direct-rail (Robokassa) sandbox intake on the contour: the test shop's merchant login +
-          # Password1/Password2. IsTest is forced to 1 below so the contour can never take real money
-          # (independent of the shop's own mode). Empty login leaves the direct rail off.
-          ROBOKASSA_MERCHANT_LOGIN: ${{ secrets.TEST_BACKEND_ROBOKASSA_MERCHANT_LOGIN }}
-          ROBOKASSA_PASSWORD1: ${{ secrets.TEST_BACKEND_ROBOKASSA_PASSWORD1 }}
-          ROBOKASSA_PASSWORD2: ${{ secrets.TEST_BACKEND_ROBOKASSA_PASSWORD2 }}
-          ROBOKASSA_TEST: "1"
-          SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
-          # Operator alerts: backend admin emails (new feedback / complaints) + Grafana
-          # infra alerts. Distinct senders + recipients; Grafana uses the relay's STARTTLS
-          # host:port. Empty leaves the alert worker off and Grafana SMTP disabled.
-          SMTP_RELAY_ADMIN_FROM: ${{ vars.TEST_SMTP_RELAY_ADMIN_FROM }}
-          ADMIN_EMAIL: ${{ vars.TEST_ADMIN_EMAIL }}
-          SMTP_RELAY_SERVICE_FROM: ${{ vars.TEST_SMTP_RELAY_SERVICE_FROM }}
-          SERVICE_EMAIL: ${{ vars.TEST_SERVICE_EMAIL }}
-          GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-          GF_SMTP_ENABLED: ${{ vars.TEST_GF_SMTP_ENABLED }}
-          # Canonical public origin for links in the email (this contour's URL);
-          # required by the backend whenever SMTP_RELAY_HOST is set.
-          PUBLIC_BASE_URL: ${{ vars.TEST_PUBLIC_BASE_URL }}
           GM_BASICAUTH_USER: ${{ vars.TEST_GM_BASICAUTH_USER }}
+          GRAFANA_ROOT_URL: ${{ vars.TEST_GRAFANA_ROOT_URL }}
           CADDY_SITE_ADDRESS: ${{ vars.TEST_CADDY_SITE_ADDRESS }}
-          # TELEGRAM_MINIAPP_URL, GRAFANA_ROOT_URL and VITE_VK_ID_REDIRECT_URL are derived
-          # from PUBLIC_BASE_URL in the run step below, not stored as their own variables.
+          TELEGRAM_MINIAPP_URL: ${{ vars.TEST_TELEGRAM_MINIAPP_URL }}
           TELEGRAM_GAME_CHANNEL_ID: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID }}
           TELEGRAM_CHAT_ID: ${{ vars.TEST_TELEGRAM_CHAT_ID }}
-          TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.TEST_TELEGRAM_SUPPORT_CHAT_ID }}
           TELEGRAM_BOT_USERNAME: ${{ vars.TEST_TELEGRAM_BOT_USERNAME }}
           # The promo button reuses the UI's Mini App link variable.
           TELEGRAM_BOT_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
@@ -407,19 +276,11 @@ jobs:
           VITE_TELEGRAM_BOT_ID: ${{ vars.TEST_VITE_TELEGRAM_BOT_ID }}
           VITE_TELEGRAM_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
           VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-          # VK Mini App landing link + VK ID "Web" app id: one value each serves every
-          # contour -> unprefixed. VITE_VK_APP_ID also feeds the gateway (GATEWAY_VK_ID_APP_ID);
-          # the VK ID redirect URL is derived from PUBLIC_BASE_URL in the run step below.
-          VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
-          VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-          # Rewarded-ad test stub: set TEST_VITE_ADS_STUB=1 to swap real ads for a toast on the
-          # contour (empty = real ads, for capturing the real VK ad result). Prod never sets it.
-          VITE_ADS_STUB: ${{ vars.TEST_VITE_ADS_STUB }}
-          # VITE_GATEWAY_URL omitted: the SPA is served same-origin, so it stays the
-          # compose ":-" empty default. Other unset vars likewise fall to their defaults.
+          VITE_GATEWAY_URL: ${{ vars.TEST_VITE_GATEWAY_URL }}
+          # Unset vars render empty -> the compose ":-" defaults apply.
           POSTGRES_DB: ${{ vars.TEST_POSTGRES_DB }}
           POSTGRES_USER: ${{ vars.TEST_POSTGRES_USER }}
-          DICT_VERSION: ${{ vars.DICT_VERSION }}
+          DICT_VERSION: ${{ vars.TEST_DICT_VERSION }}
           LOG_LEVEL: ${{ vars.TEST_LOG_LEVEL }}
         run: |
           # Seed the config files to a stable host path. The runner checks out into
@@ -430,34 +291,8 @@ jobs:
           conf="$HOME/.scrabble-deploy"
           rm -rf "$conf"
           mkdir -p "$conf"
-          cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
+          cp -r caddy otelcol prometheus tempo grafana "$conf"/
           export SCRABBLE_CONFIG_DIR="$conf"
-          # Maintenance page for the redeploy window, mirroring prod-deploy.sh so the SPA
-          # overlay is exercised on the test contour too (not only prod). Raised just before
-          # the recreate and lowered once caddy is back (below); the trap clears it if the
-          # step fails so the contour never sticks in maintenance (and the reseed above wipes a
-          # stale flag anyway). The caddy-routed probes run in the NEXT step, after it is lowered.
-          maint_flag="$conf/caddy/on"
-          trap 'rm -f "$maint_flag"' EXIT
-          # Derive the public URLs from the one canonical origin instead of storing each as
-          # its own variable (paths are structural SPA routes / the Caddy /_gm sub-path).
-          # Exported before build so the VK ID redirect is baked into the SPA.
-          base="${PUBLIC_BASE_URL%/}"
-          export TELEGRAM_MINIAPP_URL="$base/telegram/"
-          export GRAFANA_ROOT_URL="$base/_gm/grafana/"
-          export VITE_VK_ID_REDIRECT_URL="$base/app/"
-          # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
-          # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
-          # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare
-          # address + name for Grafana; the backend keeps the full form.
-          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
-          case "$svc_from" in
-            *"<"*">"*)
-              export GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
-              export GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
-            *)
-              export GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
-          esac
           # Bot-link mTLS material for the test contour: a private CA + gateway/bot
           # leaves (CN=gateway, the service name the bot dials). Prod supplies these
           # from PROD_ secrets instead. Regenerated each deploy; both ends redeploy
@@ -470,23 +305,12 @@ jobs:
           # bot on its own host instead (deploy/docker-compose.bot.yml), and the prod
           # main host omits both. Without the profile they would not start here.
           docker compose --ansi never --profile telegram-local build --progress plain
-          # Raise the maintenance page, THEN bring caddy onto the reseeded config mount so it
-          # actually carries the flag: the running caddy sits on the stale pre-reseed mount (the
-          # dir was rm'd + recreated — see the force-recreate note below), so a flag written to
-          # the new dir is invisible until caddy is recreated. With the fresh caddy up, an open
-          # SPA sees the 503 marker + overlay for the whole recreate window, not a bare reconnect.
-          : > "$maint_flag"
-          docker compose --ansi never up -d --force-recreate --no-deps caddy
           docker compose --ansi never --profile telegram-local up -d --remove-orphans
           # The config-only services bind-mount the reseeded config dir. A plain `up -d`
           # leaves them on the previous bind mount (the dir was rm'd + recreated), so a
-          # changed Grafana dashboard is ignored — force-recreate them to pick up the fresh
-          # config. (Caddy was already recreated above so it would carry the maintenance flag.)
-          docker compose --ansi never up -d --force-recreate --no-deps otelcol prometheus tempo grafana
-          # Lower the maintenance page: services are back. An open SPA's poll now gets through
-          # (once the gateway finishes booting) and reloads into the fresh client; the caddy
-          # probes in the next step see 200. The EXIT trap is a backstop if we failed earlier.
-          rm -f "$maint_flag"
+          # changed Caddyfile or Grafana dashboard is ignored — force-recreate them to
+          # pick up the fresh config.
+          docker compose --ansi never up -d --force-recreate --no-deps caddy otelcol prometheus tempo grafana
 
       - name: Probe the landing, gateway and backend
         run: |
@@ -512,100 +336,6 @@ jobs:
           docker logs --tail 50 scrabble-backend || true
           exit 1
 
-      - name: Probe the /offer/ public offer page is served
-        run: |
-          set -u
-          # /offer/ is rendered by the render sidecar: it splices the live catalog price list
-          # (fetched from the backend's internal endpoint) into the committed ui/legal/offer_ru.md.
-          # If the @offer caddy route is missing, the request falls to the landing shell (also 200),
-          # and if the backend fetch fails the sidecar returns 502 — so assert offer-specific content
-          # (the seller INN, §11) AND that the pricing marker was substituted (proves the fetch +
-          # splice ran), never just the status. Data-independent: an empty catalog still substitutes
-          # the marker with nothing, so "pricing_template" must be absent either way.
-          # Full body is needed (the INN is in §11 and the marker check spans the page), so this
-          # cannot be a head-only probe like the legal one. Retry with a timeout instead: the offer is
-          # now bilingual (RU + EN, larger), and a single-shot fetch can race the renderer's restart in
-          # the same deploy.
-          ok=
-          for i in $(seq 1 20); do
-            out="$(docker run --rm --network edge alpine:3.20 wget -q -T 10 -O - http://scrabble/offer/ 2>&1 || true)"
-            if echo "$out" | grep -q "290210610742" && ! echo "$out" | grep -q "pricing_template"; then
-              echo "ok: /offer/ serves the rendered offer with the price list spliced in"
-              ok=1
-              break
-            fi
-            sleep 3
-          done
-          if [ -z "$ok" ]; then
-            echo "FAIL: /offer/ did not serve the rendered offer (route fell through, or the price splice failed)"
-            docker logs --tail 50 scrabble-renderer || true
-            docker logs --tail 50 scrabble-backend || true
-            docker logs --tail 50 scrabble-landing || true
-            exit 1
-          fi
-
-      - name: Probe the /privacy/ and /eula/ legal pages are served
-        run: |
-          set -u
-          # /privacy/ and /eula/ are static legal markdown rendered by the render sidecar. If the
-          # @legal caddy route is missing they fall to the landing shell (also 200, canonical
-          # erudit-game.ru/), so assert the page-specific canonical URL — it uniquely identifies the
-          # rendered legal doc reaching the edge, not the landing catch-all. Read only the <head>
-          # (head -c 4096; the canonical link sits in the first bytes): the check is then
-          # size-independent, so the large EULA page does not exceed the timeout while the monitoring
-          # stack is still booting post-deploy and starving the CPU-capped renderer. Retry like the
-          # landing/gateway/backend probe to ride out that window.
-          for route in privacy eula; do
-            ok=
-            for i in $(seq 1 20); do
-              head_out="$(docker run --rm --network edge alpine:3.20 sh -c "wget -q -T 10 -O - http://scrabble/${route}/ 2>/dev/null | head -c 4096" || true)"
-              if printf '%s' "$head_out" | grep -qF "erudit-game.ru/${route}/"; then
-                echo "ok: /${route}/ serves the rendered legal page"
-                ok=1
-                break
-              fi
-              sleep 3
-            done
-            if [ -z "$ok" ]; then
-              echo "FAIL: /${route}/ did not serve the rendered legal page (@legal route missing?)"
-              docker logs --tail 50 scrabble-renderer || true
-              exit 1
-            fi
-          done
-
-      - name: Probe the /pay/ callback route reaches the gateway
-        run: |
-          set -u
-          # /pay/robokassa/result must reach the gateway, not fall to the landing catch-all. An
-          # unsigned probe is rejected downstream, so the gateway answers a 4xx/5xx (never a 200 or
-          # a 404 landing.html), which proves the edge route is wired.
-          out="$(docker run --rm --network edge alpine:3.20 wget -S -q -O /dev/null http://scrabble/pay/robokassa/result 2>&1 || true)"
-          echo "$out" | grep -E "HTTP/" || true
-          if echo "$out" | grep -qE "HTTP/1\.1 (4|5)[0-9][0-9]"; then
-            echo "ok: /pay/ reaches the gateway (non-landing response)"
-          else
-            echo "FAIL: /pay/robokassa/result did not reach the gateway (landing catch-all?)"
-            docker logs --tail 50 scrabble-gateway || true
-            exit 1
-          fi
-
-      - name: Probe the /dict edge route reaches the gateway
-        run: |
-          set -u
-          # The client fetches each game's dictionary blob at {edge}/dict/{variant}/{version}
-          # for the local move preview. If caddy does not route /dict to the gateway the request
-          # falls to the static landing and the client silently gets a non-dawg blob. Probed
-          # unauthenticated it must be the gateway's 401 (the route reaches the gateway), never a
-          # 404/200 from the landing catch-all.
-          out="$(docker run --rm --network edge alpine:3.20 wget -S -q -O /dev/null http://scrabble/dict/scrabble_en/v1 2>&1 || true)"
-          echo "$out" | grep -E "HTTP/" || true
-          if echo "$out" | grep -q " 401"; then
-            echo "ok: /dict reaches the gateway (401 unauthenticated)"
-          else
-            echo "FAIL: /dict did not reach the gateway (expected 401) — caddy route missing?"
-            exit 1
-          fi
-
       - name: Probe the Telegram validator and bot liveness
         run: |
           set -u

.gitea/workflows/prod-deploy.yaml

@@ -40,22 +40,11 @@ jobs:
       VITE_TELEGRAM_BOT_ID: ${{ vars.PROD_VITE_TELEGRAM_BOT_ID }}
       VITE_TELEGRAM_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
       VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.PROD_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-      # VK Mini App link + VK ID "Web" app id: one value each serves every contour.
-      VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      # VITE_GATEWAY_URL omitted: the SPA is served same-origin (compose ":-" default).
+      VITE_GATEWAY_URL: ${{ vars.PROD_VITE_GATEWAY_URL }}
       POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
-      # `docker compose build` interpolates the WHOLE compose file, so every :?-guarded
-      # runtime var must be present at build even though it is not a build-arg — incl. the
-      # backend's EXPORT_SIGN_KEY (added with the finished-game export after v1.7.0, which is
-      # why the first v1.8.0 build tripped on it). POSTGRES_PASSWORD/GM_BASICAUTH_HASH above
-      # are here for the same reason; DICT_VERSION + the derived Mini App URL cover the rest.
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # PUBLIC_BASE_URL drives the derived VK ID redirect (baked into the SPA) and the
-      # Mini App URL; both are computed in the build step, not stored variables.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
+      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -69,15 +58,10 @@ jobs:
         working-directory: deploy
         run: |
           export TAG="${{ steps.ver.outputs.tag }}" APP_VERSION="${{ steps.ver.outputs.tag }}" SCRABBLE_CONFIG_DIR=.
-          # Derive the public URLs from the one canonical origin: the VK ID redirect is a
-          # build-arg baked into the SPA, and the Mini App URL satisfies the (profiled-out)
-          # bot service's compose ":?" guard during parse. See deploy/write-prod-env.sh.
-          base="${PUBLIC_BASE_URL%/}"
-          export VITE_VK_ID_REDIRECT_URL="$base/app/" TELEGRAM_MINIAPP_URL="$base/telegram/"
-          # The main-stack images via compose (reuses the build args, incl. VERSION);
+          # The four main-stack images via compose (reuses the build args, incl. VERSION);
           # the bot separately, since it is profiled out of the prod compose.
           docker compose -f docker-compose.yml -f docker-compose.prod.yml build
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml push postgres backend gateway landing validator renderer
+          docker compose -f docker-compose.yml -f docker-compose.prod.yml push backend gateway landing validator
           docker build -f ../platform/telegram/Dockerfile --target bot --build-arg VERSION="$TAG" -t "$REGISTRY/scrabble-telegram-bot:$TAG" ..
           docker push "$REGISTRY/scrabble-telegram-bot:$TAG"
 
@@ -98,76 +82,17 @@ jobs:
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
       GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
       TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-      # Robokassa direct-rail (backend BACKEND_ROBOKASSA_*): the prod shop login + the pass phrases
-      # that sign the launch request / verify the Result callback, and the test-mode flag — a var so
-      # go-live is a flag flip, not a secret redeploy ("1" runs test payments against the test
-      # passwords; empty/"0" is live). An empty login leaves the direct rail disabled.
-      ROBOKASSA_MERCHANT_LOGIN: ${{ secrets.PROD_BACKEND_ROBOKASSA_MERCHANT_LOGIN }}
-      ROBOKASSA_PASSWORD1: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD1 }}
-      ROBOKASSA_PASSWORD2: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD2 }}
-      ROBOKASSA_TEST: ${{ vars.PROD_BACKEND_ROBOKASSA_TEST }}
-      # VK ID web login: the "Web" app id (the gateway reuses it as GATEWAY_VK_ID_APP_ID at
-      # runtime) + the app's protected key. Both shared across contours. The redirect URL is
-      # derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-      # Client-version gate (ARCHITECTURE.md §2): plain (unprefixed) vars, shared across contours
-      # (empty ⇒ dormant). On prod the stamped client version is a real semver, so the gate enforces
-      # here — set GATEWAY_MIN_CLIENT_VERSION to the release in the same rollout that ships a breaking
-      # wire change; bump GATEWAY_RECOMMENDED_CLIENT_VERSION (≥ min) to nudge upgrades softly.
-      GATEWAY_MIN_CLIENT_VERSION: ${{ vars.GATEWAY_MIN_CLIENT_VERSION }}
-      GATEWAY_RECOMMENDED_CLIENT_VERSION: ${{ vars.GATEWAY_RECOMMENDED_CLIENT_VERSION }}
-      # Planted honeytoken bearer: presenting it earns a 24h IP ban + a high-severity alarm.
-      # Per-contour secret; empty = trap off. Rendered by deploy/write-prod-env.sh.
-      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
-      # Community IP blocklist (Spamhaus DROP): opt-in. Set _ENABLED=true + _URL (the feed) once
-      # verified; _ALLOW is a comma-separated never-block set (own infra). Empty ⇒ off.
-      GATEWAY_BLOCKLIST_ENABLED: ${{ vars.PROD_GATEWAY_BLOCKLIST_ENABLED }}
-      GATEWAY_BLOCKLIST_URL: ${{ vars.PROD_GATEWAY_BLOCKLIST_URL }}
-      GATEWAY_BLOCKLIST_ALLOW: ${{ vars.PROD_GATEWAY_BLOCKLIST_ALLOW }}
-      # Signs the finished-game export download URLs (backend BACKEND_EXPORT_SIGN_KEY).
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # Transactional email via the shared Selectel relay (confirm-codes): one account for
-      # every contour -> unprefixed host/port/tls/user/pass.
-      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
-      # Operator alerts: backend admin emails + Grafana infra alerts (distinct senders +
-      # recipients; Grafana uses the relay's STARTTLS host:port).
-      SMTP_RELAY_ADMIN_FROM: ${{ vars.PROD_SMTP_RELAY_ADMIN_FROM }}
-      ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
-      SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
-      SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-      GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
       PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
       PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
       PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
       GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
+      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
       CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
+      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
       POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
       POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      # Point-in-time recovery (pgBackRest -> S3), prod main host only. Endpoint/bucket/
-      # region + the archive-mode switch are variables; the S3 keys + the repository cipher
-      # passphrase are secrets. All empty/off until the operator arms archiving; flipping
-      # PROD_PGBACKREST_ARCHIVE_MODE=on activates it (deploy/README.md, arming).
-      PGBACKREST_ARCHIVE_MODE: ${{ vars.PROD_PGBACKREST_ARCHIVE_MODE }}
-      PGBACKREST_S3_ENDPOINT: ${{ vars.PROD_PGBACKREST_S3_ENDPOINT }}
-      PGBACKREST_S3_PORT: ${{ vars.PROD_PGBACKREST_S3_PORT }}
-      PGBACKREST_S3_BUCKET: ${{ vars.PROD_PGBACKREST_S3_BUCKET }}
-      PGBACKREST_S3_REGION: ${{ vars.PROD_PGBACKREST_S3_REGION }}
-      PGBACKREST_S3_KEY: ${{ secrets.PROD_PGBACKREST_S3_KEY }}
-      PGBACKREST_S3_KEY_SECRET: ${{ secrets.PROD_PGBACKREST_S3_KEY_SECRET }}
-      PGBACKREST_CIPHER_PASS: ${{ secrets.PROD_PGBACKREST_CIPHER_PASS }}
-      # TELEGRAM_MINIAPP_URL and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in
-      # deploy/write-prod-env.sh, not stored variables.
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -195,8 +120,24 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
-          # Shared with prod-rollback so the two paths render an identical runtime env.
-          APP_VERSION="$TAG" bash deploy/write-prod-env.sh stage/env.sh
+          cat > stage/env.sh <<EOF
+          export REGISTRY='$REGISTRY'
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
+          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
+          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
+          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
+          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
+          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
+          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
+          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          export DICT_VERSION='$DICT_VERSION'
+          export APP_VERSION='$TAG'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export GATEWAY_ABUSE_BAN_ENABLED='true'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
@@ -207,7 +148,7 @@ jobs:
           ssh_main 'mkdir -p /opt/scrabble/compose'
           tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
             | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana blackbox \
+          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
             | ssh_main 'tar -C /opt/scrabble -xzf -'
           tar -C stage -czf - certs-main \
             | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
@@ -235,11 +176,9 @@ jobs:
       PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
       PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      # PUBLIC_BASE_URL drives the derived Mini App URL in deploy/write-prod-bot-env.sh.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
       TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
       TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
-      TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
       TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
       TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
     steps:
@@ -253,8 +192,19 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-bot
-          # Shared with prod-rollback so the two paths render an identical bot env.
-          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TAG" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
+          cat > stage/env.bot.sh <<EOF
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TAG'
+          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
+          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
+          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
+          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
+          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key

.gitea/workflows/prod-rollback.yaml

@@ -51,52 +51,13 @@ jobs:
       PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
       PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
       GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
+      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
       CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
+      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
       POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
       POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      # Full runtime env — parity with prod-deploy's deploy-main so a rollback re-renders
-      # the SAME env.sh (email / VK login / Grafana alerts survive a rollback). TELEGRAM_MINIAPP_URL
-      # and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
-      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-      # Robokassa direct-rail: the rollback re-renders the same runtime env (write-prod-env.sh), so
-      # it must carry the same credentials or the direct rail goes dark after a rollback.
-      ROBOKASSA_MERCHANT_LOGIN: ${{ secrets.PROD_BACKEND_ROBOKASSA_MERCHANT_LOGIN }}
-      ROBOKASSA_PASSWORD1: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD1 }}
-      ROBOKASSA_PASSWORD2: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD2 }}
-      ROBOKASSA_TEST: ${{ vars.PROD_BACKEND_ROBOKASSA_TEST }}
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
-      # Community IP blocklist — rendered on rollback too so a rollback keeps the same edge policy.
-      GATEWAY_BLOCKLIST_ENABLED: ${{ vars.PROD_GATEWAY_BLOCKLIST_ENABLED }}
-      GATEWAY_BLOCKLIST_URL: ${{ vars.PROD_GATEWAY_BLOCKLIST_URL }}
-      GATEWAY_BLOCKLIST_ALLOW: ${{ vars.PROD_GATEWAY_BLOCKLIST_ALLOW }}
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
-      SMTP_RELAY_ADMIN_FROM: ${{ vars.PROD_SMTP_RELAY_ADMIN_FROM }}
-      ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
-      SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
-      SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-      GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
-      # PITR archiving parity: a rollback must re-render the SAME env.sh, else it would
-      # silently disarm WAL archiving (PGBACKREST_ARCHIVE_MODE would fall back to off).
-      PGBACKREST_ARCHIVE_MODE: ${{ vars.PROD_PGBACKREST_ARCHIVE_MODE }}
-      PGBACKREST_S3_ENDPOINT: ${{ vars.PROD_PGBACKREST_S3_ENDPOINT }}
-      PGBACKREST_S3_PORT: ${{ vars.PROD_PGBACKREST_S3_PORT }}
-      PGBACKREST_S3_BUCKET: ${{ vars.PROD_PGBACKREST_S3_BUCKET }}
-      PGBACKREST_S3_REGION: ${{ vars.PROD_PGBACKREST_S3_REGION }}
-      PGBACKREST_S3_KEY: ${{ secrets.PROD_PGBACKREST_S3_KEY }}
-      PGBACKREST_S3_KEY_SECRET: ${{ secrets.PROD_PGBACKREST_S3_KEY_SECRET }}
-      PGBACKREST_CIPHER_PASS: ${{ secrets.PROD_PGBACKREST_CIPHER_PASS }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
       INPUT_TARGET: ${{ inputs.target_version }}
     steps:
       - uses: actions/checkout@v4
@@ -128,9 +89,24 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
-          # Same writer as prod-deploy's deploy-main -> the rollback re-renders the FULL
-          # runtime env (not a subset), so email / VK login / Grafana alerts survive it.
-          APP_VERSION="$TARGET" bash deploy/write-prod-env.sh stage/env.sh
+          cat > stage/env.sh <<EOF
+          export REGISTRY='$REGISTRY'
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
+          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
+          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
+          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
+          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
+          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
+          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
+          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          export DICT_VERSION='$DICT_VERSION'
+          export APP_VERSION='$TARGET'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export GATEWAY_ABUSE_BAN_ENABLED='true'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
@@ -171,11 +147,9 @@ jobs:
       PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
       PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      # PUBLIC_BASE_URL drives the derived Mini App URL; SUPPORT_CHAT_ID for parity with deploy.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
       TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
       TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
-      TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
       TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
       TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
     steps:
@@ -189,8 +163,19 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-bot
-          # Same writer as prod-deploy's deploy-bot (parity; includes TELEGRAM_SUPPORT_CHAT_ID).
-          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TARGET" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
+          cat > stage/env.bot.sh <<EOF
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TARGET'
+          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
+          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
+          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
+          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
+          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key

CLAUDE.md

@@ -1,97 +1,96 @@
 # scrabble-game — project guide
 
-Multiplatform Scrabble game, **in production** at `https://erudit-game.ru`. Read this
-first every session. The repository — not conversation memory — is the source of
-continuity; keep it that way.
+Multiplatform Scrabble game. Read this first every session. The owner drives the
+project **one stage per session** (tariff constraint), so the repository — not
+conversation memory — is the source of continuity. Keep it that way.
 
 ## Sources of truth (read before changing behaviour)
 
-- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — architecture, transport, security,
-  the decision record. Always describes the current state.
-- [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md) mirror)
-  — per-domain user stories. English authoritative.
-- [`docs/TESTING.md`](docs/TESTING.md) — test layers + the CI gate.
+- [`PLAN.md`](PLAN.md) — staged plan + **stage tracker** + per-stage *open
+  details to interview*.
+- [`PRERELEASE.md`](PRERELEASE.md) — pre-release hardening tracker (phases R1–R7
+  before Stage 18); same per-phase *interview + bake-back* discipline as `PLAN.md`.
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — architecture, transport,
+  security, the decision record. Always describes current state.
+- [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md)
+  mirror) — per-domain user stories. English authoritative.
+- [`docs/TESTING.md`](docs/TESTING.md) — test layers + the per-stage CI gate.
 - [`docs/UI_DESIGN.md`](docs/UI_DESIGN.md) — the `ui` visual/interaction design system.
-- [`deploy/README.md`](deploy/README.md) — the deploy contour + the production
-  rollout / rollback runbook.
 
-## How we work
+## Mandatory per-stage workflow
 
-- Inspect the relevant code path and the docs above before changing behaviour.
-- **Interview the owner on every fork** — do not silently pick borderline decisions;
-  offer options with brief pros/cons.
-- Smallest correct diff. Prefer compact code; reuse before adding; do not add deps,
-  seams or knobs until they are needed.
-- **Update or add tests for every functional change**, at the layers
-  `docs/TESTING.md` calls out.
-- **Bake docs in the same PR**: update `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md`
-  (+`_ru`), the affected service `README` and Go Doc comments alongside the change.
-- Document added packages, types, funcs, consts and vars with Go Doc comments.
+**Start of a stage**
+1. Read `PLAN.md` (the stage's scope + *open details*) and the relevant `docs/`.
+2. Analyse what the stage actually requires against the current code.
+3. **Interview the owner** on every open detail and any fork not already fixed
+   in the plan — do not silently pick borderline decisions. Offer options with
+   brief pros/cons.
+4. Only then implement, strictly within the stage's scope.
+
+**End of a stage**
+1. Bake every new agreement back into `PLAN.md`, `docs/ARCHITECTURE.md`,
+   `docs/FUNCTIONAL.md` (+ `_ru`), the affected service `README`, and Go Doc
+   comments — in the **same** PR. Correct earlier stages' docs/code if a new
+   decision changes them.
+2. Update the stage tracker; add a line under *Refinements logged during
+   implementation* for any plan deviation.
+3. Get CI green, then mark the stage done.
+
+(The `stage-implementation` skill encodes this same loop and can be invoked.)
 
 ## Conventions
 
 - All code, comments, identifiers, commits, docs, filenames in **English**.
-- Chat with the owner follows the user-level `~/.claude/CLAUDE.md` (Russian, the
-  agreed persona and translation rules).
-- Mirror every point edit of `docs/FUNCTIONAL.md` into `docs/FUNCTIONAL_ru.md` in the
-  same patch (translate only the touched paragraphs).
+- Chat with the owner follows the user-level `~/.claude/CLAUDE.md` (Russian,
+  the agreed persona and translation rules).
+- Mirror every point edit of `docs/FUNCTIONAL.md` into `docs/FUNCTIONAL_ru.md`
+  in the same patch (translate only the touched paragraphs).
+- Prefer compact code; do not add deps, seams or knobs until a stage needs them.
+  Reuse before adding. Document added packages/types/funcs with Go Doc comments.
+- Update or add tests for every functional change.
 
-## Branching, CI & production
+## Branching & CI
 
-- **Two long-lived branches**: **`development`** is the integration branch; **`master`**
-  is the production trunk. Cut `feature/*` from `development` and PR back into it;
-  promote `development → master` via PR when ready to release. Both branches require
-  one approval + the `CI / gate` check.
-- A commit to a `feature/*` branch triggers nothing. The single workflow
-  `.gitea/workflows/ci.yaml` runs the full suite (`unit` + `integration` + `ui`) on a
-  PR into `development` or `master`, and the gated **`deploy`** job auto-rolls the
-  **test contour** on a PR into — or a push to — `development`
-  (`docker compose up -d --build` on the runner host + landing/SPA/backend probes). A
-  PR into `master` is test-only.
-- **Production is live on two hosts** (main + the Telegram bot host) and deploys
-  **only manually** (`workflow_dispatch`), never automatically:
-  - **`.gitea/workflows/prod-deploy.yaml`** (`confirm=deploy`, from `master`) builds +
-    pushes the images to the registry, then SSH-deploys both hosts — rolling per
-    service in dependency order, health-gated, **auto-rollback to the previous tag**;
-    a schema migration adds a maintenance window + a consistent `pg_dump`. Four visible
-    jobs: build → deploy-main → deploy-bot → verify.
-  - **`.gitea/workflows/prod-rollback.yaml`** (`confirm=rollback`) re-deploys a prior
-    release (blank `target_version` = the previous deployed version) — image-only,
-    rolling, health-gated.
-  - **Releases are git tags `vX.Y.Z` on `master`**; the deploy stamps `git describe
-    --tags` into the image tag, every binary (`pkg/version` via `-ldflags` → the
-    `service.version` telemetry attribute) and the SPA About screen. Tag the release
-    before deploying.
-  - Hosts are provisioned idempotently by **`deploy/ansible/`**. Per-contour
-    secrets/variables use the `TEST_` / `PROD_` prefix (Gitea 1.26 has no deployment
-    environments). Migrations must be **expand-contract** (backward-compatible) so
-    image rollback stays DB-safe. Full runbook + variable list in `deploy/README.md`.
-- After any push, merge or deploy, **watch the run to green** before declaring done —
-  use the ready-made watcher (run it in the background), never an inline poll loop:
-  `python3 ~/.claude/bin/gitea-ci-watch.py`. It reads `$GITEA_URL` / `$GITEA_TOKEN`;
-  `gitea.iliadenisov.ru` is allow-listed in `.claude/settings.json`. Remote:
-  `origin git@gitea.iliadenisov.ru:developer/scrabble-game.git`.
+- **Two long-lived branches** (Stage 16 onward): **`development`** is the
+  integration branch; **`master`** is the production trunk. Cut `feature/*`
+  branches **from `development`** and PR them back into it. (Stages 0–15 used
+  `master` as the trunk with `feature/* → master`; the genesis Stage 0 commit is
+  on `master` by necessity.)
+- A commit to a `feature/*` branch triggers **nothing**. The single workflow
+  `.gitea/workflows/ci.yaml` runs the full suite (`unit` + `integration` + `ui`)
+  on a PR into `development` or `master`, and the gated **`deploy`** job auto-rolls
+  the **test contour** on a PR into — or a push to — `development`
+  (`docker compose up -d --build` on the runner host + a `GET /` probe). A PR into
+  `master` is test-only.
+- Merge `development → master` only when CI is green; the **prod** deploy is then a
+  **manual** workflow (Stage 18), never automatic. Secrets/variables are prefixed
+  `TEST_` / `PROD_` per contour (Gitea 1.26 has no deployment environments).
+- After any push, watch the run to green before declaring a stage done — use the
+  ready-made watcher, never an inline poll loop:
+  `python3 ~/.claude/bin/gitea-ci-watch.py` (background). It reads `$GITEA_URL`
+  / `$GITEA_TOKEN`; `gitea.iliadenisov.ru` is allow-listed in
+  `.claude/settings.json`. Remote: `origin git@gitea.iliadenisov.ru:developer/scrabble-game.git`.
 
 ## Stack
 
-Go 1.26.3, `go.work` monorepo, module paths `scrabble/<name>`. Backend uses `gin` +
-`zap` + `pgx`/`go-jet`/`goose`/OTel. Client↔gateway is Connect-RPC + FlatBuffers
-(h2c); gateway↔backend is REST/JSON + `X-User-ID` plus a gRPC server-stream for live
-events. UI is pure HTML5/CSS on plain Svelte + Vite, packaged to native with
-Capacitor. No Redis.
+Go 1.26.3, `go.work` monorepo, module paths `scrabble/<name>`. Dependencies are
+added **when first used** (incremental): backend uses `gin` + `zap` +
+`pgx`/`go-jet`/`goose`/OTel (added in Stage 1). Client↔gateway is Connect-RPC +
+FlatBuffers (h2c); gateway↔backend is REST/JSON + `X-User-ID` plus a gRPC
+server-stream for live events. UI is pure HTML5/CSS on plain Svelte + Vite,
+packaged to native with Capacitor. Likely no Redis.
 
 ## Reused engine: `../scrabble-solver` (module `scrabble-solver`, Go 1.26.3)
 
-Embedded **in-process as a library** (`replace scrabble-solver => ../scrabble-solver`
-in `go.work`; CI checks out the sibling from
-`https://gitea.iliadenisov.ru/.../scrabble-solver.git`). There is no per-game
-container. Public API to reuse (do not reimplement):
+Embedded **in-process as a library** — there is no per-game container. Public
+API to reuse (do not reimplement):
 
-- `scrabble.NewSolver(rs, finder)` → `GenerateMoves(b, r, mode)` (ranked, highest
-  score first), `ValidatePlay(b, dir, tiles)`, `ScorePlay(...)`; `scrabble.Apply(b, m)`;
-  types `Move/Word/Placement/Direction/Mode`
+- `scrabble.NewSolver(rs, finder)` → `GenerateMoves(b, r, mode)` (ranked,
+  highest score first), `ValidatePlay(b, dir, tiles)`, `ScorePlay(...)`;
+  `scrabble.Apply(b, m)`; types `Move/Word/Placement/Direction/Mode`
   (`scrabble-solver/scrabble/{solver,move,apply}.go`).
-- `rules.English() / RussianScrabble() / Erudit()` (`scrabble-solver/rules/rules.go`).
+- `rules.English() / RussianScrabble() / Erudit()`
+  (`scrabble-solver/rules/rules.go`).
 - `board.New / Parse / Clone / Transpose`; `rack.New / Add / Remove / Clone`;
   `selfplay.NewBag / Draw / Len` (bag pattern).
 - Load committed dictionaries with `dawg.Load(path)` from
@@ -100,17 +99,20 @@ container. Public API to reuse (do not reimplement):
 
 Constraints:
 - Words/tiles are **alphabet-index bytes**, meaningful only with the matching
-  `rules.Ruleset` (`Alphabet.Decode`); the blank flag is carried separately. **Decode
+  `rules.Ruleset` (`Alphabet.Decode`); blank flag carried separately. **Decode
   to real characters before persisting history** (history must be
   dictionary-independent — see `docs/ARCHITECTURE.md` §9.1).
 - The solver's `internal/*` is NOT importable from this sibling module.
 - **GCG is test-only** in the solver (no public writer) — we ship our own.
-- The solver uses published `github.com/iliadenisov/{alphabet,dafsa}` (no local replace).
+- Wiring: add `replace scrabble-solver => ../scrabble-solver` to `go.work` in
+  **Stage 2** (when `internal/engine` first imports it), and make CI check out
+  the solver sibling (`https://gitea.iliadenisov.ru/.../scrabble-solver.git`).
+  It uses published `github.com/iliadenisov/{alphabet,dafsa}` (no local replace).
 
 ## Repository layout
 
 ```
-go.work                      # the go.work monorepo
+go.work                      # use the existing modules; grows per stage
 backend/                     # module scrabble/backend
   cmd/backend/               # main: telemetry -> db+migrate -> cache -> server
   cmd/jetgen/                # dev tool: regenerate go-jet code (throwaway container)
@@ -121,15 +123,12 @@ backend/                     # module scrabble/backend
   internal/session/          # opaque tokens, sessions store, cache, service
   internal/server/           # gin engine, /api/v1 groups, X-User-ID, probes
   internal/inttest/          # //go:build integration Postgres-backed tests
-gateway/                     # module scrabble/gateway: Connect-RPC edge, embeds the SPA
-ui/                          # Svelte + Vite SPA + landing (Node project, not in go.work)
-pkg/                         # shared: telemetry, version, wire/FlatBuffers, proto, mtls
-platform/telegram/           # Telegram side-service: cmd/validator (HMAC, no VPN) + cmd/bot (Bot API; dials gateway over reverse mTLS bot-link)
-renderer/                    # image-render sidecar (Node + skia-canvas): runs ui/src/lib/gameimage.ts server-side for the finished-game PNG export
-loadtest/                    # module scrabble/loadtest: the load/stress harness
-docs/  .gitea/workflows/  CLAUDE.md  README.md
-backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile renderer/Dockerfile  # multi-stage distroless (renderer: node:22-slim + skia-canvas + fonts); gateway/Dockerfile has the `landing` target, platform/telegram/Dockerfile has `validator`+`bot` targets
-deploy/                      # docker-compose (+ prod overlay + bot host) + ansible provisioning + caddy + landing + otelcol (OTLP + docker_stats) + prometheus/tempo/grafana + node_exporter + postgres_exporter; prod-deploy.sh
+docs/  .gitea/workflows/  PLAN.md  CLAUDE.md  README.md
+gateway/  ui/  pkg/              # added by their stages
+platform/telegram/               # Telegram side-service, two binaries (Stage 9; split in phase TX): cmd/validator (HMAC, no VPN) + cmd/bot (Bot API; dials gateway over reverse mTLS bot-link)
+loadtest/                        # module scrabble/loadtest: the pre-release stress harness (R2)
+backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile  # multi-stage distroless (Stage 16; loadtest R2); gateway/Dockerfile has the `landing` target (R3), platform/telegram/Dockerfile has `validator`+`bot` targets (TX)
+deploy/                          # docker-compose (per-service limits, R7) + caddy + landing + otelcol (OTLP + docker_stats per-container metrics) + prometheus/tempo/grafana + postgres_exporter
 ```
 
 ## Build & test
@@ -139,28 +138,20 @@ go build ./backend/...          # per module ('./...' from the root won't span t
 go vet ./backend/...
 gofmt -l .                      # must print nothing
 go test -count=1 ./backend/...
-go build ./platform/telegram/... && go test ./platform/telegram/...  # Telegram validator + bot
+go build ./platform/telegram/... && go test ./platform/telegram/...  # Telegram validator + bot (Stage 9; split in TX)
 go run ./backend/cmd/backend    # /healthz, /readyz on :8080
 
-cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI
+cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI (Stage 7+)
 pnpm start                      # UI mock mode: lobby -> game, no backend
-cd renderer && pnpm install && pnpm test  # image-render sidecar (bundles ui/src/lib/gameimage.ts, skia smoke)
 
-docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required (no default); gateway embeds the SPA
+docker build -f backend/Dockerfile -t scrabble-backend .   # images (Stage 16); gateway embeds the SPA
 docker build -f gateway/Dockerfile --target gateway -t scrabble-gateway .
-docker build -f gateway/Dockerfile --target landing -t scrabble-landing .  # static landing
+docker build -f gateway/Dockerfile --target landing -t scrabble-landing .  # static landing (R3)
 docker compose -f deploy/docker-compose.yml config         # validate the full contour
 ```
 
-The `ui` module is a Node project (pnpm), **not** in `go.work`; it is the `ui` job of
-the single `.gitea/workflows/ci.yaml`. Committed edge codegen under `ui/src/gen/`
+The `ui` module is a Node project (pnpm), **not** in `go.work`; it is the `ui` job
+of the single `.gitea/workflows/ci.yaml` (Stage 16 folded the former go-unit /
+integration / ui-test workflows into it). Committed edge codegen under `ui/src/gen/`
 (regenerate with `pnpm codegen`); pnpm build-script approval lives in
 `ui/pnpm-workspace.yaml` (`allowBuilds: esbuild: true`).
-
-## Agent field notes
-
-Non-obvious, hard-won knowledge the agent has accumulated that is **not** captured in the docs above,
-kept in the repo so it travels with a clone. Verify any named file/flag against current code before
-acting on it.
-
-@.claude/CLAUDE.md

PRERELEASE.md

@@ -0,0 +1,632 @@
+# Pre-release plan — hardening before Stage 18
+
+Living tracker for the pre-release hardening pass that runs **before Stage 18** (the
+prod cutover). Same discipline as [`PLAN.md`](PLAN.md): one phase per session,
+**interview the owner on the open details** at the start of each phase, bake every
+decision back into `PLAN.md` / `docs/` / the affected `README`s / Go Doc comments in
+the **same** PR, get CI green, then mark the phase done. Phases run as
+`feature/* → development` PRs (the Stage 16 branch model); the owner approves+merges.
+
+**Why now:** the system is feature-complete through Stage 17 and the test contour is
+green, but there is **no prod data yet** — schema, wire labels and the dictionary
+layout can still change for free. These phases spend that one-time freedom and harden
+the edge before prod. Each phase maps back to the owner's raw pre-release TODO list
+(numbers in the tracker).
+
+## Phase tracker
+
+| # | Phase | Raw TODOs | Status |
+|---|-------|-----------|--------|
+| R1 | Schema & naming reset | 1 + 10 | **done** |
+| R2 | Stress harness + contour observability + early run | 9a | **done** |
+| R3 | Edge hardening | 2 + 8 + 3 | **done** |
+| R4 | Push enrichment + kill the last poll | 4 + 5 | **done** |
+| R5 | Bundle slimming | 6 | **done** |
+| R6 | Refactor + docs reconciliation + de-staging | 7 | **done** |
+| R7 | Final stress run + tuning | 9b | **done** |
+| UI | Tab-bar navigation redesign (drop the hamburger) | owner ad-hoc | **done** |
+| MW | "Multiple words per turn" rule for Russian games (engine v1.1.0) | owner ad-hoc | **done** |
+| MW2 | Single-word rule connectivity fix: the word must run along its own line through an existing tile (perpendicular-only contact no longer connects); single-tile direction picks the best legal word (engine v1.1.1) | owner ad-hoc | **done** |
+| MW3 | Graceful replay degradation: a game whose journalled move became illegal under MW2 is closed as a draw (`end_reason='aborted'`) on open instead of erroring, with an impersonal organizer note in the history + GCG (migration `00002`) | owner ad-hoc | **done** |
+| OW | Open auto-match: enter the game at once and wait inside it (robot after 90–180 s) | owner ad-hoc | **done** |
+| DA | Dictionary admin: online release-archive upload → word-diff preview → install/activate; versioned dict volume; active version persisted in DB; resident label = release tag | owner ad-hoc | **done** |
+| AB | Manual account block (admin suspension): permanent/temporary with an editable en+ru reason picklist; a block forfeits the player's active games + cancels their open ones; a backend gate refuses a blocked account with **403 `account_blocked`**; the UI shows a terminal blocked screen and stops all push/poll; manual unblock; temporary blocks self-expire (migration `00003`) | owner ad-hoc | **done** |
+| AI | Honest AI opponent in quick game: an explicit 🤖 AI / 👤 random selector (AI default); the robot is seated and moves at once; 7-day inactivity loss (the per-turn timeout reused); chat/nudge disabled, no statistics; the opponent is shown as 🤖 everywhere | owner ad-hoc | **done** |
+| AD | Advertising banner ("ad network"): server-driven weighted campaigns (percent weight + validity window; the perpetual default fills the remainder up to 100%), bilingual messages shown by bot (`service_language`); eligibility = free account + empty hint wallet + no `no_banner` role (guests included); the resolved feed rides `profile.get` with a `notify` `banner` re-poll on eligibility change; `/_gm/banners` admin + global display timings; client smooth-weighted-round-robin rotation + fade-out/gap/fade-in UX. A single `app.load` bootstrap aggregator was considered and **deferred** (see ARCHITECTURE §10). | owner ad-hoc | **done** (PR1 backend+admin, PR2 UI rotation) |
+| GL | Simultaneous quick-game cap (10): grey "New Game" + a lobby notice at the cap; backend gate on quick enqueue + invitation creation (409 `game_limit_reached`), accepting invitations exempt; `at_game_limit` rides `games.list` | owner ad-hoc | **done** |
+| CR | In-game chat read receipts: per-message `unread_seats` bitmask (migration `00008`); a per-viewer unread **dot** in the lobby + game header (a nudge counts and clears when its recipient moves); reading = opening the move history (the 💬 fade-blinks twice) or the chat, acked (`chat.read`) only when unread; `chat_read_duration` + `chat_unread_messages` metrics + tracing + the **Scrabble — Messages** Grafana dashboard (follow-up PR); a message to a disguised robot opponent is born read; admin unread-only filter / read column / per-seat read card | owner ad-hoc | **done** |
+| BX | Asymmetric per-user block + in-game controls: a block now silently suppresses everything **from** the blocked user (chat, nudge, friend requests, invitations are kept but never delivered/surfaced, born-read) while they notice nothing, **without** deleting the friendship (unblock restores it); auto-match excludes a block-related pair (either direction); in-game opponent card gains a ✖️ **block** control (mirroring 🤝, red "Block?" confirm, mutual-hide, struck name + hidden chat composer when blocked); optimistic apply + `user_blocked`/`user_unblocked` event confirm + rollback; admin user card gains **blocks / blocked-by / friends** cross-linked lists. Blocking a disguised-robot opponent is recorded per-game in a separate **`robot_blocks`** table (migration `00011`), keyed on game+seat with the seen name — never the shared robot account — so the matchmaker keeps giving robots; it shows in the blocked list and re-marks the in-game card | owner ad-hoc | **done** |
+| FM | First-move tile draw (official rules): each seated player draws a tile, the one closest to "A" leads (a blank beats every letter), ties re-drawing until a single leader; **honest per-draw `crypto/rand` entropy**, not the bag seed, so the **record** (`game_setup_draws`, migration `00013`) — not a seed — is the only account of the outcome, kept for future **tournaments** (designed as a discrete per-tile "player N draws" step). Friend/AI draws at create; **auto-match draws at *open*** against a synthetic `uuid.Nil` opponent whose draw rows are back-filled on join, so the opener's seat is fixed up front and the existing open-game pre-move is preserved (no reseating, no play-gating). Admin `/_gm/games/:id` gains the recorded draw list + a simple **step-by-step board replay** (`ReplayTimeline`). | owner ad-hoc | **done** |
+| SB | Single Telegram bot + per-user variant preferences: the two per-language bots collapse into **one** (drop `accounts.service_language`, `supported_languages`, the `*_EN`/`*_RU` env vars and game-language push routing — the single bot renders in the recipient's `preferred_language`); New Game variant gating moves to a profile **`variant_preferences`** set (default Erudit only, Erudit-first, server-enforced on the caller's auto-match/vs-AI/invitation-create paths, an invited friend may accept any variant); env vars collapse to unsuffixed `TELEGRAM_BOT_TOKEN`/`TELEGRAM_GAME_CHANNEL_ID`/`VITE_TELEGRAM_LINK`/`VITE_TELEGRAM_GAME_CHANNEL_NAME` and `GATEWAY_DEFAULT_SUPPORTED_LANGUAGES` is removed; wire drops `service_language`/`supported_languages` (Session, ValidateInitDataResponse) + the push `language` routing field and adds `variant_preferences` to Profile/UpdateProfile. | owner ad-hoc | **done** |
+| DV | Dictionary version hygiene: CI + image/compose seed track the current release (`v1.2.1`); a **seed-drift guard** records the flat dir's seed in an authoritative `.seed_version` marker so a bumped build seed on a live volume is ignored (it can't relabel live bytes — which would mis-serve the dictionary + void games pinned to the prior label); `DICT_VERSION` is the fresh-volume seed only, a live contour migrates through the admin console | owner ad-hoc | **done** |
+| TX | Telegram egress off the main host: split the connector into a home **validator** (Mini App / Login-Widget HMAC, no VPN, no Bot API — so game login no longer depends on Telegram being reachable) and a remote **bot** (Bot API long-poll + `sendMessage`) that holds **no inbound port** and dials the gateway over a reverse **mTLS bot-link** (`pkg/proto/botlink/v1`); the gateway funnels out-of-app push (fire-and-forget, at-most-once) and the backend admin broadcasts (a relay that awaits the bot's ack) down the link. The bot is Telegram-rate-limited; **one bot now**, with seams (a bot registry + `owns_updates` + command ids) for N later; **no webhook** (rejected: one URL per token, adds inbound + a static address). The **unified test contour** runs the split (the bot keeps its VPN sidecar and dials the gateway by its internal name; certs from `deploy/gen-certs.sh`). The **prod** wiring — the bot on a separate host (no VPN), the gateway bot-link port published, `PROD_` certs, an SSH deploy of both hosts together — is **built in Stage 18** (the two-host registry rollout; first cutover pending the `erudit-game.ru` DNS). | owner ad-hoc | **done** (code + test contour; prod wiring built — Stage 18) |
+| AG | Anti-abuse IP ban + honeypot/honeytoken (prod-only): a fail2ban-style in-memory `ratelimit.Banlist` keyed by client IP, fed by sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the user class stays the soft-flag's concern), a **honeypot** decoy path (the contour caddy tags `/.env`, `/.git`, `/wp-*`, … with `X-Scrabble-Honeypot` and routes them to the gateway), and a **honeytoken** (`GATEWAY_HONEYTOKEN`, a planted bearer). The `abuseGuard` edge middleware refuses a banned IP with **429** before any work — closing the R3 gap that the static SPA/landing was outside the token bucket. Off by default — it keys by the real client IP the shared-NAT test contour does not expose (detection still logs there); enabled in prod via `GATEWAY_ABUSE_BAN_ENABLED`. Operators see + lift bans on the console **Throttled** page; the gateway syncs its active set to the backend (`/api/v1/internal/bans/sync`, `internal/banview`) every 30 s and applies operator unbans. | owner ad-hoc | **done** (code + test contour; ban on in prod via Stage 18 — machinery built, cutover pending DNS) |
+| CM | Channel-chat moderation + promo bot: a second standalone bot in the bot container answers `/start` with a localized message + a **URL** button into the **main** bot's Mini App (`?startapp`; a `web_app` button would sign initData with the promo token, which the main validator rejects). The **main** bot gates write access in a channel's linked discussion chat. The chat **allows sending by default** and the bot only restricts (Telegram intersects the chat default with the per-user permission, so a per-user grant cannot exceed a deny-by-default group): it **mutes** a member who is not registered or is admin-suspended or holding a new **`chat_muted`** role, and **un-mutes** an eligible one it had muted, for a member currently in the chat (a `getChatMember` guard, since bots cannot list members). Eligibility = `registered AND NOT suspended AND NOT chat_muted` (the game suspension dominates), resolved once in the backend and reached two ways: the bot's `ResolveChatEligibility` on a `chat_member` event over the existing mTLS bot-link, and a backend `chat_access_changed` event → gateway → `ChatGate` command (emitted on block/unblock, a `chat_muted` change, a first registration, or a temporary-block expiry via a sweeper; idempotent). No schema change — `chat_muted` reuses `account_roles`. | owner ad-hoc | **done** |
+| → | Stage 18 — prod contour deploy | — | see [`PLAN.md`](PLAN.md) |
+
+## Key findings (these reshaped the raw list — read before starting a phase)
+
+- **R1 (TODO 1 + 10) is one cheap moment, now.** Squashing the 12 goose migrations is
+  safe precisely because there is no prod data and the contour DB is wiped. Folding the
+  new variant labels (`scrabble_ru`/`scrabble_en`/`erudit_ru`) into that single baseline
+  makes the rename need **no data migration and no back-compat mapping**. Today's labels
+  (`english`/`russian_scrabble`/`erudit`) are persisted in `games.variant`,
+  `game_invitations.variant`, in `pkg/fbs` and the UI — ~100 files, but a mechanical sweep
+  on a clean DB.
+- **R4 (TODO 4 + 5): the app is already push-first.** Game state refreshes on
+  `your_turn`/`opponent_moved`, the lobby on `notify`, chat on `chat_message`. The **only**
+  genuine periodic server poll is `lobby.poll` (matchmaking, 2.5 s,
+  `ui/src/screens/NewGame.svelte`). What remains is killing that one poll **and** enriching
+  push events to carry payloads so the UI stops re-fetching after each signal.
+- **R3 (TODO 2): identity forgery is already mitigated.** Identity is always derived from
+  the session (`Authorization: Bearer` → `X-User-ID`); the client cannot inject identity,
+  the backend re-validates resource ownership, Telegram initData is HMAC-checked. The real
+  gaps are a missing **request-body size limit** (cheap DoS) and **invisible rate-limit
+  rejections** (no log/metric/admin view — that is TODO 8). Static landing serving is **not**
+  covered by the gateway token bucket (it only guards `Execute`).
+- **R6 (TODO 7) scale:** ~431 `Stage N` references across ~104 files (incl. the file name
+  `backend/internal/inttest/stage6_test.go`). Code is the source of truth; `docs/` describe
+  current state; `PLAN.md` keeps the decision history.
+
+## Locked decisions (owner interview)
+
+- **Stress test (TODO 9):** **early + final** runs. Driver = **edge protocol** (Connect/FB
+  through the gateway, moves generated by the solver) **plus a separate gateway-hammer**
+  saturation test. Pacing = **realistic (under limits) + saturation (ramp to the knee)**.
+  Resource metrics = **add cAdvisor + postgres_exporter to the contour** (today only
+  Go-runtime metrics exist). The harness stays in the repo for repeats.
+- **Push (TODO 4 + 5):** **both** — kill `lobby.poll` (use the existing `match_found`, keep
+  poll as the ws-down fallback) **and** enrich push events with payloads.
+- **Refactor (TODO 7):** **hygiene + structural changes by a reviewed list** —
+  behaviour-preserving, test-gated, contentious items surfaced to the owner before applying.
+- **Landing (TODO 3):** **separate static container** behind the project caddy
+  (`/` → landing, `/app/` + `/telegram/` → gateway); drop `landing.html` from the gateway
+  `go:embed`.
+- **Rate-abuse (TODO 8):** metric + Grafana + admin view **plus a conservative auto-flag** —
+  a *soft, reversible* "suspected high-rate" marker for operator review, tunable threshold,
+  **no auto-ban**.
+- **Anti-abuse IP ban (AG, owner ad-hoc):** a honeypot was considered and rejected as a *DDoS*
+  defence — it detects/deceives but does not shed volumetric load, cannot cover the real
+  endpoints, and a tarpit backfires under flood; volumetric L3/L4 is an upstream/CDN concern,
+  out of scope. The effective layer is a **temporary IP ban** (fail2ban-style) that the honeypot
+  and honeytoken merely *feed*. This does **not** reverse the TODO-8 "no auto-ban": that decision
+  governs the **account** soft-flag (still never a gate); the IP ban is a separate, IP-keyed,
+  **prod-only** layer with an **operator unban** in the console. Decisions: banlist lives in the
+  existing `ratelimit` package (smallest surface); the decoy path list is a **single source of
+  truth in the caddy** (it tags requests with a header — the gateway keeps no second list);
+  bans are in-memory + single-instance (like `ratewatch`), auto-expiring, **plus** an admin
+  console view + manual unban over a bidirectional 30 s sync (operator control = owner's choice).
+  An active-bans Grafana **gauge** was trimmed (the console view + the `gateway_abuse_banned_total`
+  counter cover it) to keep the diff focused.
+- **Open auto-match (owner ad-hoc):** a quick game **enters a real game at once and waits inside
+  it** (status `open`, the opponent seat empty); a second human searching the same variant+rule
+  joins it, or a robot fills it after a **90 s + random 0–90 s** wait, pushing the in-app
+  **opponent_joined** event. While open, the starter may move on their turn but resign, chat and
+  nudge are disabled, and the lobby + opponent card read "searching for opponent". Matchmaking is
+  now **DB-backed open games** — the in-memory pool, `lobby.poll` and `lobby.cancel` are gone. The
+  schema is edited in the baseline (no prod data); `game_players.account_id` is nullable for the
+  empty seat.
+- **Telegram egress off-host (TX, owner ad-hoc):** the driver is **removing VPN/Telegram
+  traffic from the main host** (OPSEC / one fewer analysis vector), not only notification
+  resilience. Login is local HMAC, so it stays up regardless of the bot — confirmed in the
+  code and made structural by the split. **Unified topology in code** (validator + bot, the
+  bot dialing the gateway) in **both** contours, differing only in deployment; the test bot
+  keeps its VPN sidecar. Transport = a **reverse gRPC bidi stream, mTLS, bot-dials-gateway**
+  (no inbound/static IP on the bot), reusing the push-stream pattern; **webhook rejected**
+  (one URL per token, adds inbound + a static address). Delivery **at-most-once** (a dropped
+  nudge beats a duplicate). **One bot now**, seams (registry + `owns_updates` + command ids)
+  for N later. **Cert rotation** by a scheduled CI job from a long-lived CA. **Prod deploy by
+  SSH** (pull excluded), the bot rolled **together** with the main app (the bot-link protocol
+  kept back-compatible by one version as the non-atomic-two-host-deploy safety net). The bot
+  is monitored **from the gateway** (connection + ack metrics). The bot-host token-at-rest is
+  **accepted**.
+
+## Phases
+
+Each phase: read this tracker + the relevant `docs/`, **interview the owner on the open
+details below**, implement within scope, then update the tracker + docs/code and get CI
+green before marking it done.
+
+### R1 — Schema & naming reset *(TODO 1 + 10)* — first
+Squash `backend/internal/postgres/migrations/00001..00012` into one `00001_baseline.sql`
+(method: `pg_dump --schema-only` from a fully-migrated DB → wrap as the goose baseline →
+prove a fresh migrate yields a schema identical to the 12-migration chain via the
+integration suite → delete the old files; keep goose). Bake the new variant labels into the
+baseline. Propagate `scrabble_ru`/`scrabble_en`/`erudit_ru` through the backend
+(`engine.Variant`/`ParseVariant`, `registry.dictFiles`, the CHECK values), the wire
+(`pkg/fbs` `variant:string`, regenerate FB) and the UI (`lib/model.ts` union, `variants.ts`,
+fixtures, premium/alphabet keys, tests); i18n display keys stay display-only. Tidy
+`../scrabble-dictionary` to a single source→dawg build point and align the dawg artifact
+names to the new labels (crosses into `../scrabble-solver`'s committed fixtures — keep them
+byte-identical). After merge, **wipe the contour DB** (drop the volume) so it re-provisions
+on the next deploy.
+- Critical files: `backend/internal/postgres/migrations/`,
+  `backend/internal/engine/{engine,registry}.go`, `pkg/fbs/scrabble.fbs`,
+  `ui/src/lib/{model,variants}.ts`, `../scrabble-dictionary/{Makefile,cmd/builddict,…}`.
+- Open details to interview: the exact dawg filename scheme; whether the dict-repo tidy is
+  one PR or split; how to script the contour DB wipe in the deploy.
+
+### R2 — Stress harness + contour observability + early run *(TODO 9, part 1)*
+Build the reusable load harness as a new `loadtest` module in `go.work` (reuses `pkg/fbs`,
+`connect-go`, and `scrabble-solver` for legal-move generation): a seeder that inserts
+**1000 guest + 10000 durable** accounts with pre-created sessions (token hashes) directly in
+the DB and hands the plaintext tokens to the client; a driver that runs N virtual users,
+each in 3–5 concurrent 2–4-player games, exercising submit-play / pass / exchange / nudge /
+chat / check-word / draft-move / profile-save through the **edge protocol**, in
+**realistic** (under rate limits) and **saturation** (ramp) modes; plus a separate
+**gateway-hammer** that deliberately exceeds limits to verify the limiter holds and measure
+its cost. Add **cAdvisor + postgres_exporter** to `deploy/docker-compose.yml` and a Grafana
+resource dashboard. Run the **early pass** against the freshly-wiped contour; produce a
+**trip report** (logic/concurrency bugs + a resource baseline) that feeds R3 and R6.
+- Critical files: new `loadtest/`, `deploy/docker-compose.yml`, `deploy/observability/*`,
+  `docs/TESTING.md`.
+- Open details: the scale ramp steps; the move-selection policy (a mid-ranked solver move
+  for realistic game progress); run duration; the pass/fail bar.
+
+### R3 — Edge hardening *(TODO 2 + 8 + 3)*
+Add a **request-body size cap** at the gateway h2c mux / `Execute` (e.g. ~1 MB). Add
+**rate-limit observability**: a `gateway_rate_limited_total{class}` counter + a structured
+log per rejection; an **aggregate** Grafana panel (request rate + rejection rate — spikes
+visible without per-user label cardinality, honouring the Stage 12/17 discipline); an
+**admin-console view** of recently throttled users/IPs (in-memory ring buffer, single-
+instance, reset-on-restart, like the `active_users` gauge). Add the **conservative
+auto-flag**: when a user is *sustained*-throttled past a tunable threshold, set a soft,
+reversible `account.flagged_high_rate_at` marker (baked into the R1 baseline) surfaced in the
+admin user list/detail — **no auto-ban**; the operator clears it. Split the **landing** into
+its own static container (`deploy/` + a Caddyfile route `/` → landing) and drop
+`landing.html` from the gateway `go:embed`.
+- Critical files: `gateway/internal/connectsrv/server.go`, `gateway/internal/ratelimit/`,
+  `gateway/internal/connectsrv/metrics.go`, `backend/internal/adminconsole/`,
+  `deploy/caddy/Caddyfile`, `deploy/docker-compose.yml`, `gateway/internal/webui/`.
+- Open details: the auto-flag threshold/window + whether the marker is persisted vs
+  in-memory; the landing image base (caddy vs nginx).
+
+### R4 — Push enrichment + kill the last poll *(TODO 4 + 5)*
+Replace `lobby.poll` with the existing `match_found` push (keep the poll as a ws-down
+fallback). Enrich `your_turn`/`opponent_moved`/`notify` to carry the state payload so the UI
+renders from the event without a follow-up `game.state` (removes the lobby↔game nav latency
+the owner noticed). Wire-contract change: `pkg/fbs` event payloads → backend `notify` emit →
+UI stream consumers (`ui/src/lib/app.svelte.ts`), with the per-game cache as the landing
+spot; regenerate FB.
+- Critical files: `pkg/fbs/scrabble.fbs`, `backend/internal/notify/events.go`,
+  `ui/src/lib/{app.svelte,transport}.ts`, `ui/src/screens/NewGame.svelte`.
+- Open details: which events carry full vs delta payloads; the fallback-poll cadence when the
+  stream is down.
+
+### R5 — Bundle slimming *(TODO 6)* — done
+Analysed the bundle against the 100 KB-gzip budget; **no code slimming was warranted**, and the
+budget metric was retargeted to measure the app correctly. The build already minifies +
+tree-shakes; the dominant cost is the Connect/FlatBuffers transport runtime + generated bindings
++ the Svelte runtime (≈⅔ of `main`'s source is third-party/generated) — irreducible within scope.
+**Lazy-loading was rejected**: `bundle-size.mjs` sums every emitted chunk, so code-splitting yields
+no total-size win and adds request latency (+N gateway fetches on first navigation to a split
+screen). i18n lazy-load was skipped (the catalogs are a sliver of a Svelte-runtime-dominated shared
+chunk, and `en` must stay bundled as the `MessageKey` type source + fallback). Instead,
+`bundle-size.mjs` now measures **per HTML entry**, with three independent gates on the natural chunk
+boundaries — **app entry ≤ 100 KB, the Svelte+i18n shared chunk ≤ 30 KB, the landing's own chunk
+≤ 5 KB** — since the app's real payload is its entry chunk plus the shared chunk (≈97 KB), while the
+landing (≈24 KB) is reported separately and kept minimal. Same CLI + exit-code contract, so the CI
+step is unchanged.
+- Critical files: `ui/scripts/bundle-size.mjs`; no app code changed.
+
+### R6 — Refactor + docs reconciliation + de-staging *(TODO 7)* — done
+Behaviour-preserving only. Three separable, separately-committed passes: (a) mechanical
+**de-staging** — remove `Stage N`/`TODO-N` references from code, comments and service
+READMEs (rename `stage6_test.go`); (b) **docs↔code reconciliation** — reconcile
+`docs/ARCHITECTURE.md` / `docs/FUNCTIONAL.md`(+`_ru`) against the code-as-truth, fixing drift
+and Go Doc comments; (c) **structural changes by a reviewed list** — surface a list of
+proposed optimizations / test-suite consolidations to the owner, apply only the approved,
+behaviour-preserving, test-gated ones. The full suite + the final stress run (R7) are the
+regression gate. Incorporates the early-run (R2) bug fixes not already shipped.
+- Open details: the structural-changes list itself (owner-approved before applying); the test
+  consolidation targets.
+
+### R7 — Final stress run + tuning *(TODO 9, part 2)* — done
+Re-run the R2 harness against the final, refactored system on a clean contour; analyse
+resource consumption across **all** components (gateway, backend, Postgres, the
+metrics/observability stack, docker log volume) and agree the tuning (pool sizes, rate
+limits, cache TTLs, container limits, GOMAXPROCS, log levels). Apply the agreed tuning; record
+the methodology + results in the repo.
+
+→ **Stage 18** (prod contour) then proceeds per [`PLAN.md`](PLAN.md).
+
+## Sequencing rationale
+
+`R1` first (cheapest now; everything builds on the final schema/naming and the stress test
+must run against it). `R2` builds the harness and runs the **early** pass to surface bugs and
+a resource baseline that feed `R3` and `R6`. `R3`/`R4`/`R5` harden and improve the system.
+`R6` (de-stage + reconcile + structural) runs near the end so it sweeps settled code once and
+benefits from all accumulated bug knowledge. `R7` validates the final system and tunes it.
+Then Stage 18.
+
+## Regression-safety discipline (cross-cutting)
+
+- Every phase is a `feature/* → development` PR; CI (`unit` + `integration` + `ui` behind the
+  `CI / gate` check) must be green before the owner merges; watch the post-merge contour
+  deploy with `gitea-ci-watch.py`.
+- `R6` structural changes are behaviour-preserving, test-gated, and split from the mechanical
+  sweeps; contentious items are owner-approved first.
+- The two stress runs (`R2` early, `R7` final) are the system-level regression gate.
+
+## Verification (per phase)
+
+- `go build ./<module>/...`, `go vet`, `gofmt -l .` clean, `go test -count=1 ./<module>/...`;
+  UI: `pnpm check && pnpm test:unit && pnpm build`; the integration suite
+  (`-tags integration`) for DB/schema changes; `docker compose config` for deploy changes;
+  green CI on the PR + a healthy contour deploy.
+- `R1`: prove the squashed baseline yields a schema identical to the 12-migration chain
+  (integration suite on a fresh DB) **before** deleting the old files.
+- `R2`/`R7`: the harness runs end-to-end against the contour; the trip report lists concrete
+  defects + a resource profile from the Grafana cAdvisor/postgres_exporter panels.
+
+## Refinements logged during implementation
+
+- **R1** (interview + implementation):
+  - **Variant labels** `english`/`russian_scrabble`/`erudit` → **`scrabble_en`/`scrabble_ru`/`erudit_ru`**
+    across the backend (`engine.Variant.String`/`ParseVariant`; the `games`/`game_invitations` `variant`
+    CHECK in the baseline; GCG `#lexicon` and the `variant` metric attribute both flow from `String`),
+    the wire (`pkg/fbs` `variant` is a `string` field — values change with **no FlatBuffers regen**) and
+    the UI (`model.ts` union, `variants.ts` records, `codec`/`premiums`/mocks/tests, the admin
+    `dictionary.gohtml`). **Kept:** the Go enum identifiers (`VariantEnglish`…, internal) and the i18n
+    display keys (`new.english`/`new.russian`/`new.erudit`, display-only). `complaints.variant` stays
+    free-text (no CHECK, as before).
+  - **dawg filenames kept descriptive** (`en_sowpods`/`ru_scrabble`/`ru_erudit`) — only the registry's
+    `Variant` key carries the rename, so `registry.go`, the published `scrabble-solver` fixtures and the
+    dictionary release artifact are untouched (decouples the three repos).
+  - **Migrations squashed** 12 → one hand-written `00001_baseline.sql`. Verified by a
+    `pg_dump --schema-only` diff (the chain vs the baseline are **identical** but for the two intended
+    variant-CHECK values) plus the green integration suite. **No data migration** (no production data).
+  - **Done (cross-repo + contour):** the **`scrabble-dictionary` tidy** merged (PR #2) and was re-cut as
+    the **byte-identical `v1.0.1`** release for clean provenance (the backend stays on `v1.0.0` — same
+    bytes, no rewire; the backend pulls a version-pinned release artifact, not master). Post-merge the
+    contour `backend` schema was wiped (`DROP SCHEMA backend CASCADE` + restart, not a volume drop) and
+    re-migrated to the baseline — verified the new variant CHECK (`scrabble_en/scrabble_ru/erudit_ru`),
+    `games`=0 and a clean boot.
+
+- **R2** (interview + implementation):
+  - **Locked decisions:** game assembly via **invitations** (real path, no robots; not direct game-row
+    inserts); **moderate** ramp **50 → 200 → 500** at 10 min/step; **diagnostic** pass bar (no SLO gate);
+    run as a **one-shot container on `scrabble-internal`** in this PR.
+  - **Harness** = new `scrabble/loadtest` module (`use ./loadtest` + a `replace scrabble/gateway` for the
+    dot-free edge-proto import). It seeds 1000 guest + 10000 durable accounts + sessions **directly in
+    Postgres** (token hash mirrors `backend/internal/session`), drives players over the **edge protocol**,
+    generates **mid-ranked legal moves locally** with the embedded `scrabble-solver` by replaying
+    `game.history` (the edge carries no board — mirrors `engine.ReplayBoard` via the public API), and a
+    **gateway-hammer**. Compact CLI (`run` / `cleanup`), distroless Dockerfile (DAWGs baked), Go unit tests.
+  - **Adding the module broke the other images' builds** — backend/gateway/telegram Dockerfiles reduce the
+    workspace but still referenced `./loadtest` (not in their context); each now also
+    `-dropuse=./loadtest` (backend/telegram additionally `-dropreplace` the gateway replace). Caught by the
+    first deploy run; verified by building all four images.
+  - **Harness payload fixes found by the smoke pass:** the draft DTO's `rack_order` is a string (was sent
+    as `[]` → `bad_request`); the display-name validator forbids digits/colons, so the cleanup marker
+    became a letters-only `Zzloadtest` so `profile.update` resends the seeded name. `chat_not_your_turn` /
+    `nudge_own_turn` are **by-design** turn gates, correctly exercised.
+  - **Observability:** added **cAdvisor + postgres_exporter** + the **Scrabble — Resources** dashboard +
+    two Prometheus jobs. **Finding:** cAdvisor yields only the root cgroup on the contour host (separate
+    XFS `/var/lib/docker` breaks its layer-ID resolution — the existing galaxy deploy has the same limit),
+    so per-container CPU/RSS for the early pass was captured via `docker stats`. **R7:** adopt the otelcol
+    `docker_stats` receiver (already the contrib image) for per-container metrics in Grafana.
+  - **Early run (2026-06-09):** ramped clean to 500 players, no crash/deadlock, cleanup removed all 11000
+    accounts. 1.2 M edge calls, 48 870 plays, 2 798 games finished; the per-user limiter held under the
+    hammer (99.97 % rejected, p99 2 ms). **Top finding:** ~14 % `transport_error` on `game.state` at 500
+    players, under CPU saturation (backend/gateway/Postgres each ~1 core) and amplified by the harness's
+    single shared `http2.Transport`; the harness itself peaked at 86 % of a core on the same host, so the
+    figures are pessimistic. Full trip report in [`../loadtest/REPORT.md`](../loadtest/REPORT.md);
+    it feeds R3 (h2c `MaxConcurrentStreams`/timeouts, body-size cap), R6 and R7 (per-player transports,
+    separate hardware, pool/limit sizing).
+  - **CI:** `./loadtest/...` added to the path filter + vet/build/test; `go.work.sum` carries the new deps.
+
+- **R3** (interview + implementation):
+  - **Locked decisions:** the flag column lands by **editing the R1 baseline** (+ a contour schema
+    wipe after merge — no migration chain accrues before prod); auto-flag defaults **1000 rejected /
+    10 min** (`BACKEND_HIGHRATE_FLAG_THRESHOLD`/`_WINDOW`, rolling window, set-once, operator clears,
+    no auto-ban); landing image = **caddy:2-alpine**; throttle data flows **gateway → backend** (a
+    30 s per-key summary POST to the new `/api/v1/internal/ratelimit/report`, the existing trusted
+    direction) with the episode window + flag rule in the backend (`internal/ratewatch`); rejection
+    logging = **Warn summary per key per window + Debug per rejection** — a deliberate deviation from
+    the phase's "structured log per rejection" (the R2 hammer would have logged ~522k lines in
+    minutes); all three R2-report tails included (explicit h2c sizing, the session-resolve failure
+    cause at Warn, reviving the admin limiter).
+  - **Body cap:** `GATEWAY_MAX_BODY_BYTES` (default 1 MiB) as both the Connect per-message read limit
+    and an `http.MaxBytesReader` wrap of the public mux; an oversized Execute is `resource_exhausted`.
+  - **Dead config found:** `AdminPerMinute`/`AdminBurst` were never wired — the gateway `/_gm` mount is
+    now 429-guarded per IP ahead of its Basic-Auth. The caddy-fronted contour path stays unlimited
+    (stock caddy has no limiter) — an accepted gap, recorded in `docs/ARCHITECTURE.md` §12.
+  - **Landing split:** a `landing` target in `gateway/Dockerfile` (the UI build stage is shared;
+    identical compose build args keep it one cached build); the gateway drops `landing.html` from the
+    embed and 308-redirects `/` → `/app/`; the contour caddy routes `/app/`, `/telegram/` and the
+    Connect path to the gateway and the catch-all to the landing container; the CI deploy probe now
+    checks both `/` (landing) and `/app/` (gateway).
+  - **Observability:** `gateway_rate_limited_total{class}` (user/public/email/admin, aggregate-only)
+    + a rate-vs-rejections panel on the Edge/UX dashboard; the admin console gains the **Throttled**
+    page (the in-memory episode window, reset-on-restart like `active_users`, plus the flagged-account
+    queue) and the flag badge / clear action on the user list / card.
+  - The jet regen also restored the previously missing `game_drafts`/`game_hidden` generated models
+    (their tables were added after the last jetgen run; no behaviour change).
+
+- **R4** (interview + implementation):
+  - **Locked decisions:** **delta-first**, not full snapshots — an event carries only the new move and
+    the UI applies it to its per-game cache, keyed on `move_count` (idempotent + gap-safe: a gap or the
+    actor's own move falls back to a `game.state` + `game.history` refetch). `match_found` /
+    `game_started` carry the recipient's **initial `StateView`** (instant lobby→game); the fallback
+    refetch stays the existing two calls (no merged endpoint); the matchmaking poll runs **only while
+    the stream is down** (2.5 s); **all** UI-state-changing events carry their payload (incl. lobby `notify`).
+  - **Enriched events** (`pkg/fbs` trailing fields — backward-compatible, no FB regen of *values*, only
+    the schema): `opponent_moved` (+`move`/`game`/`bag_len`), `your_turn` (+`move_count`), `match_found`
+    (+`state`), `game_over` (+`game`), `notify` (+`account`/`invitation`/`state`). The pre-R4
+    `opponent_moved` scalars (`seat`/`action`/`score`/`total`) stay for wire back-compat, now redundant
+    with `move`/`game` — slated for the R6 de-stage.
+  - **Encoding placement:** the `notify` package keeps ownership of the FlatBuffers encoding (a new
+    `encode.go` mirrors the gateway transcode but reads wire-agnostic `notify.*` input structs +
+    `engine.MoveRecord`); the game/lobby/social services map their domain types to those structs, so the
+    wire schema stays out of the domain. **Flagged for R6:** this partly duplicates the gateway encoders
+    (different source types) — a candidate consolidation.
+  - **Actor self-fetch killed too** (beyond literal "push"): the `submit_play`/`pass`/`exchange`/`resign`
+    **response** (`MoveResult`) now returns the actor's refilled rack + bag size, so the mover renders the
+    next turn from the response — `Game.svelte`'s `commit`/`pass`/`exchange`/`resign` drop their `await load()`.
+  - **`match_found` enrichment** needs a per-seat initial state: `lobby.GameCreator` gained `InitialState`,
+    and `game.Service.InitialState` builds the `notify.PlayerState` (rack re-encoded to wire indices, the
+    variant alphabet embedded for a first-seen variant).
+  - **UI:** a pure `lib/gamedelta.ts` reducer (`applyMoveDelta` / `applyGameOver` / `seedInitialState`,
+    unit-tested) advances the cache; `app.svelte` seeds it on `match_found` / `game_started`; `Game.svelte`
+    applies the delta (falling back to `load()` while composing, on a gap, or on its own move's new rack);
+    `NewGame.svelte` polls only when `app.streamAlive` is false and guards its teardown so a push-delivered
+    match is not cancelled.
+  - **notify (friends/invitations) scope:** the backend carries the full account / invitation payload on the
+    wire (per "all events → push"); the UI seeds the game cache from `game_started` but keeps its lightweight
+    **authoritative** badge refresh (`refreshNotifications`, on the rare `notify` event + on foreground) rather
+    than adding client-side friend/invitation caches — the per-move hot path is fully de-fetched, which was the
+    goal. Deeper lobby-cache consumption is an easy follow-up.
+  - **No schema change** (no migration); the contour needs no DB wipe. Tests: `notify` FB round-trips +
+    `emitMove` delta + the `gamedelta` reducer; the e2e mock now emits the enriched delta.
+
+- **R5** (interview + implementation):
+  - **No code slimming — by analysis.** A gzip measure + sourcemap attribution of the real `dist` showed
+    the app bundle is already minified + tree-shaken and dominated by the Connect/FlatBuffers transport
+    runtime + generated FB/PB bindings (≈⅔ of `main`'s source) and the Svelte runtime — all
+    third-party/generated, irreducible within R5's scope. App-authored code carries no hand-trimmable fat.
+  - **Lazy-load rejected** (screens *and* i18n): `bundle-size.mjs` sums every emitted chunk, so
+    code-splitting moves bytes between chunks for **zero total-size win** while adding request latency (+N
+    gateway fetches on first navigation to a split screen). i18n lazy-load additionally buys ≤3 KB (en-only
+    users) at the cost of an async `t()`, and `en` must stay bundled (it is the `MessageKey` type source +
+    fallback). **Chunk-collapsing rejected** too — keeping the near-static Svelte runtime in its own
+    cacheable chunk is the recommended practice (an app deploy then re-busts only `main`, not the runtime),
+    and HTTP/2 makes the extra preload request negligible.
+  - **Metric retargeted to the app.** The two-entry build (`index.html` app + `landing.html`) makes Rollup
+    hoist the code shared by both (Svelte runtime + i18n + `aboutContent`) into one preloaded chunk, so the
+    app actually loads its entry chunk **+ the shared chunk** (≈74 + ≈23 = **≈97 KB**), never `landing.js`
+    (≈1.6 KB). The old script summed all three chunks (98.8 KB), over-counting the app by `landing.js`.
+    `bundle-size.mjs` now parses each built HTML for the JS it eagerly loads and gates three parts
+    independently — **app entry ≤ 100 KB, shared (Svelte+i18n) ≤ 30 KB, landing-own ≤ 5 KB** — reporting the
+    app total (≈97) and landing total (≈24.5). Same CLI + exit-code contract, so the CI step is unchanged.
+  - **No app/source/build change** (`App.svelte`, `lib/i18n/`, `vite.config.ts` untouched); no schema
+    change, no contour wipe. The stale "~82 KB" figure was corrected in `bundle-size.mjs` and `ui/README.md`.
+
+- **R6** (interview + implementation):
+  - **Locked decisions:** apply **both** wire/code structural changes (**B** + **A**) and **only C1+C2** of
+    the test consolidation (not C3/C5); strip the `*(Stage N)*` tags from **all current-state docs**
+    (ARCHITECTURE / FUNCTIONAL+`_ru` / TESTING / UI_DESIGN), keeping PLAN.md / PRERELEASE.md / CLAUDE.md as
+    history; **split `stage6_test.go`** by domain. The `h2cMaxConcurrentStreams` sizing stays an **R7**
+    concern (tuning, not behaviour-preserving); the R2 early run forced no code fix, so nothing was carried in.
+  - **(a) De-staging:** removed the `Stage N` / `TODO-N` / `(RN)` references across code, comments, service
+    READMEs and the current-state docs, rewording narratives to present tense (no technical content lost).
+    Renamed the only stage-named identifiers (`registerStage8`→`registerSocialOps`,
+    `registerStage11`→`registerLinkOps`) and split `stage6_test.go` (`TestEmailLoginFlow`→`email_test.go`;
+    `TestGuestAutoMatchLeavesNoStats`+`provisionGuest`→`account_test.go`). De-staged the `.fbs`/`.proto`
+    comments and regenerated: only the `.proto`-derived Go docstrings (`*_grpc.pb.go`, `push.pb.go`) changed —
+    flatc strips schema comments, so the FB Go/TS bindings were untouched.
+  - **(b) Reconciliation:** the docs were accurate (each R-phase baked its own); the one drift was a stale
+    "guest-reaping deferred (TODO-3)" note in `ARCHITECTURE.md` §3 — guest reaping is implemented, so the
+    note was replaced with the current behaviour (FUNCTIONAL/TESTING already described it).
+  - **(c) B — dead `opponent_moved` scalars:** removed `seat/action/score/total` from `OpponentMovedEvent`
+    (`pkg/fbs/scrabble.fbs` + the `notify` emit + the round-trip test); regenerated FB Go + TS. No reader
+    used them (the UI codec/mock take `move`/`game`/`bag_len`; the gateway forwards the payload verbatim).
+    A pre-release wire-slot renumber — free with no prod data, no DB change.
+  - **(c) A — shared FB builders:** new `scrabble/pkg/wire` holds the single definition of the nested wire
+    tables (GameView / MoveRecord / StateView / AccountRef / Invitation) shared by the backend `notify`
+    encoder and the gateway `transcode`; both map their own source types to neutral `wire.*` structs and
+    delegate. **Honest tradeoff:** the verbose `Start/Add/End` + reverse-prepend boilerplate is now written
+    once, but the field *set* is still mapped per side, and the new package makes the change net **+~145 LOC**
+    — a single-source / anti-drift win for the fiddly mechanics rather than a line-count cut. Behaviour-
+    preserving: the two sides' field sets were verified identical and the round-trip tests pass unchanged.
+  - **(c) C1+C2 — inttest fixtures:** moved the cross-file service/game fixtures (`newGameService` was used by
+    10 files) into `backend/internal/inttest/helpers.go`; single-file helpers stay local. Pure relocation.
+  - **No schema change → no contour DB wipe.** Regression gate: the full unit + integration + UI suites plus
+    the R7 stress run.
+
+- **R7** (interview + implementation):
+  - **Locked decisions:** run the harness **same-host** (one-shot container on `scrabble-internal`, capped
+    `--cpus=3` so the contour keeps spare cores); **apply container limits + `GOMAXPROCS` now** (not just a
+    prod recommendation); **replace cAdvisor with the otelcol `docker_stats` receiver** (it resolved only the
+    root cgroup on this host); keep rate-limit / h2c knobs **compiled-in** (change values only if the data
+    demands — it did not).
+  - **Harness refinements (pre-run):** each virtual player builds its **own `edge.Client`** (its own h2c
+    connection for its Subscribe stream + Execute calls) instead of all players sharing one `http2.Transport` —
+    the R2 `transport_error` artifact; and `playTurn` now reports a **finished** game so the player drops it
+    from rotation. Effect, measured: `game.state` `transport_error` 14 % (R2) → **2.49 %**; `game_finished` on
+    chat ≈ 3 900 → **35**.
+  - **Observability:** added the `docker_stats` receiver to `otelcol` (`api_version: "1.44"` — the daemon's
+    minimum is 1.40; the receiver defaults to 1.25 and crash-looped until pinned), mounted the docker socket
+    read-only with `group_add` (the contrib image runs as UID 10001), dropped the cAdvisor service + its
+    Prometheus job, and retargeted the **Scrabble — Resources** dashboard to the docker_stats metric names
+    (`container_cpu_utilization`/100 == cores). Cross-checked against `docker stats` within sampling error.
+  - **Profile (final run, 500 players, limits in force):** the **gateway is the binding constraint** — with
+    one connection per player it bursts into its 2-core cap (the residual 2.49 % `transport_error`); backend
+    ~0.85 core and postgres ~1.4 cores had headroom; **tempo reached its 1 GiB cap**; the backend pool sat at
+    its `MaxOpenConns=25` cap (28 backends); docker logs were unbounded (~14 MiB / 30 min on the backend at
+    info). Full write-up in [`../loadtest/REPORT.md`](../loadtest/REPORT.md). *(Superseded in part: a
+    later pass modelling the `game.evaluate` hot path traced the gateway's CPU appetite to
+    **gateway→backend connection churn** — the default 2-idle-connection HTTP transport — not proxying
+    work. Pooling the connections cut peak gateway CPU ~7× (~1.75 → ~0.26 cores at 500 players) and
+    removed the ephemeral-port-exhaustion cliff behind the residual `transport_error`, so the gateway is
+    no longer the binding constraint — postgres is. The 3-core gateway cap below is now generous headroom.)*
+  - **Round-2 tuning (owner-agreed, all in `deploy/docker-compose.yml`, no code change):** gateway **2 → 3
+    cores + `GOMAXPROCS=3`**; tempo memory **1 → 2 GiB**; backend `MAX_OPEN_CONNS` **25 → 40**; a json-file
+    **log-rotation** default (10m × 3) applied contour-wide via a YAML anchor (level stays info).
+    backend/postgres kept at 2 cores / 512 MiB (headroom is cheap on the shared host).
+  - **Validation:** the same gradual ramp on the tuned contour cut `game.state` `transport_error` to **0.72 %**
+    (gateway ~2 cores, now under the 3-core cap, no throttle; tempo ~1.27 GiB, under 2 GiB). A separate
+    **burst** run (a single 100 → 500 jump) pegged the gateway at 3 cores (≈296 % sustained, 9.27 % error),
+    confirming it is **connection-CPU-bound** — a true arrival spike is a **horizontal-scaling** lever, not
+    more cores per node (recorded in the prod-sizing recommendation).
+  - **No schema change → no contour DB wipe.** Bake-back: `loadtest/REPORT.md`, `loadtest/README.md`,
+    `docs/TESTING.md`, the telemetry/observability section of `docs/ARCHITECTURE.md`, the repo-layout line in `CLAUDE.md`.
+
+- **UI — Tab-bar navigation redesign** (owner ad-hoc, not on the raw TODO list): drop the hamburger
+  `Menu.svelte` everywhere (it fought the Telegram-fullscreen layout, where it had to be re-centred).
+  - **Locked decisions (interview):** the in-Settings sub-nav is a **bottom TabBar with the active tab
+    highlighted** (icon-only); **Export GCG** moves to the left slot of the move-history header (free in a
+    finished game, where 🏁 *leave* does not apply); the lobby **⚙️ badge counts incoming friend requests
+    only** (invitations keep their own lobby section); unread chat is badged on **the score bar and the 💬**.
+  - **What shipped:** a ⚙️ **Settings hub** (`screens/SettingsHub.svelte`) over the existing
+    Settings/Profile/Friends/About bodies and an in-game **comms hub** (`game/CommsHub.svelte`) over
+    chat + dictionary, both with in-place tabs and a fixed back target; the game's menu items relocate into
+    the open move history (🏁 leave / 📤 export + 💬 comms header) and the player cards (🤝 add-friend); a
+    shared **TapConfirm** (`components/TapConfirm.svelte`, `lib/tapconfirm.ts`) — tap → fading ✅ → tap —
+    replaces the Skip/Hint press-and-hold popovers and drives the add-friend confirm. Fixed the move-history
+    "jump" bug (the slid board is now inert and the stage can't scroll, so a swipe up genuinely closes it).
+    `Menu.svelte` + `HoldConfirm.svelte` removed.
+  - **No schema/wire change → no contour DB wipe.** Bake-back: `docs/UI_DESIGN.md`, `docs/FUNCTIONAL.md`
+    (+`_ru`). Regression gate: UI `check` + unit (`tapconfirm`) + build + bundle budget + e2e (Chromium &
+    WebKit), all green.
+
+- **UI — Merge Exchange/Pass; drop the dead Tournaments tab** (owner ad-hoc, not on the raw TODO
+  list): the lobby's 🏆 *Tournaments* tab was an inert `lobby.soon` toast — removed (the lobby is back
+  to three tabs, matching `docs/FUNCTIONAL.md`). In-game the separate 🥺 *Skip* (pass) tab folds into
+  the 🔄 tab, now **Exchange/Pass**, whose dialog passes when no tile is selected and exchanges when
+  tiles are.
+  - **Decision — a pass is NOT an exchange of zero (verified against the rules + GCG):** the merge is
+    **UI-only**. Pass and exchange stay distinct game actions end-to-end — wire (`GameActionRequest` vs
+    `ExchangeRequest`), engine (`ActionPass` vs `ActionExchange`), and the GCG Poslfit dialect (a pass is
+    a bare `-`, an exchange is `-TILES`). The engine forbids a zero-tile exchange (`ErrNothingToExchange`)
+    and allows an exchange only with a full rack left in the bag (`ErrNotEnoughTilesToExchange`), while a
+    pass is always legal — collapsing them would lose a real distinction. The dialog dispatches the
+    existing `gateway.pass` / `gateway.exchange`.
+  - **What shipped:** `Lobby.svelte` (tab removed); `Game.svelte` (one 🔄 Exchange/Pass tab no longer
+    gated on an empty bag; the dialog disables tile selection while the bag is below a full rack
+    (`bagLen >= RACK_SIZE`), its confirm button reading **Pass without exchanging** / **Exchange N**);
+    i18n (`game.draw` → Exchange/Pass, new `game.passNoExchange`, dropped `game.skip` /
+    `lobby.tournaments` / `lobby.soon`). No backend/wire/history/GCG change.
+  - **No schema/wire change → no contour DB wipe.** Bake-back: `docs/UI_DESIGN.md`, `docs/FUNCTIONAL.md`
+    (+`_ru`). Regression gate: UI `check` + unit + build + bundle budget + e2e (Chromium & WebKit).
+
+- **AI — Honest AI opponent in quick game** (owner ad-hoc, not on the raw TODO list): a second quick-game
+  opponent the player *knowingly* chooses, distinct from the disguised robot of the random/open path
+  (which is kept as-is). New Game's quick-game mode replaces the "auto-match" subtitle with a two-button
+  selector **🤖 AI / 👤 Random player** (the `.seg`/`.opt` segmented style, AI the default); for AI the
+  move-clock line reads "Loss after 7 days of inactivity" and the "searching" hint is hidden.
+  - **Locked decisions (interview):** AI move is **event-driven** (the robot replies the instant the
+    player's move commits; the 30 s driver is the fallback); AI games **do not touch `account_stats`**
+    (practice, like guests); the **Stage 5 strength logic is reused unchanged** (`playToWin` 40 % from the
+    seed + margin band); **no per-move timeout — a 7-day inactivity loss** instead; the 7-day line lives on
+    the New Game screen (the in-game screen has no move-clock line); chat + nudge **disabled**, word-check
+    kept, add-friend never drawn, opponent shown as **🤖** everywhere.
+  - **The 7-day rule reuses the existing per-turn timeout:** an AI game is created with
+    `turn_timeout_secs = AIInactivityTimeout` (7 days) and the existing timeout sweeper resigns the overdue
+    seat — since the robot moves at once, only the human is ever on the clock, so the per-turn timeout *is*
+    the abandon rule (no new column, no new sweeper).
+  - **One game flag drives everything:** `games.vs_ai` (edited into the R1 baseline — pre-release, so a
+    contour DB wipe after merge). It is set **only** on AI-started games, so a robot-filled random game keeps
+    `vs_ai=false` and the disguised opponent is never revealed; the UI derives 🤖 / the gates **from the flag,
+    never from the opponent account**. New backend path `Matchmaker.StartVsAI` (picks a pooled robot via the
+    existing `Pick`, creates an **active** seated game via `game.Service.Create`, random seat order) — the AI
+    request never enters the open pool, so the open-game reaper never touches it. The robot driver gains a
+    `vs_ai` branch (no sleep, no proactive nudge, zero delay) and a focused `DriveGame`/`TriggerMove` fast
+    path wired from the game service's after-create/after-commit hook (`SetAITrigger`, a func value so the
+    game package never imports the robot package). Chat/nudge gated by a new `social` `VsAI` check
+    (`ErrGameVsAI` → 409 `ai_game`); statistics skipped in `commit` when `vs_ai`.
+  - **Wire:** `EnqueueRequest` += `vs_ai`, `GameView` += `vs_ai` (trailing FB fields, regenerated Go + TS),
+    threaded through the backend DTO, the gateway transcode and the `pkg/wire` + `notify` builders.
+  - **Tests:** `lobby` unit (StartVsAI seats a robot + flags the game; empty pool leaves no game); backend
+    integration (`ai_game_test.go`: active+seated+vs_ai+7-day clock, robot moves immediately, stats skipped,
+    7-day timeout resigns the human, chat/nudge rejected); UI codec round-trip (`vs_ai` on enqueue + game
+    view); e2e (an AI game shows 🤖, no "searching", chat disabled, the dictionary still works) + the
+    existing quick-match e2e updated to pick **Random player** (the default is now AI).
+  - **Schema/wire change → a contour DB wipe** after merge (`DROP SCHEMA backend CASCADE` + restart, the
+    R1/R3 pattern). Bake-back: `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md` (+`_ru`), `docs/UI_DESIGN.md`,
+    `backend/README.md`, Go Doc comments.
+  - **Post-review refinements (owner, same PR):** (1) the **GCG export labels the robot seat "AI"** rather
+    than its human-like pool name (`ExportGCG` overrides the name via `accounts.IsRobot`; the in-app 🤖 is
+    unchanged); (2) honest-AI games **emit no `your_turn`** — the robot replies instantly, so the signal
+    would arrive with the move and be pointless; `opponent_moved` still advances the UI; (3) the **admin
+    console surfaces the AI flag** — a **🤖 column** in `/games` and an "AI game" line on the game card
+    (`GameRow`/`GameDetailView` gain `VsAI`); (4) `games_started_total` / `games_abandoned_total` gain a
+    **`vs_ai`** attribute and the Grafana *Game domain* dashboard splits started/abandoned into **human**
+    and **AI** panels.
+  - **Follow-up (separate PR — strategy deviation):** the robot now plays **≈20%** of opening/midgame moves
+    *against* its per-game `playToWin` intent (toward the opposite margin band — a winning robot eases off, a
+    losing one surges ahead), tapering linearly to **0 over the last 14 bag tiles** and **0 once the bag is
+    empty**, so the endgame follows the chosen strategy strictly while earlier outcomes can swing the human's
+    way. Deterministic from the seed (`mix(seed,"deviate",moveCount)`), applied to **both** robot paths via
+    the shared `selectMove`; the per-game intent (and the admin card) is unchanged. Tests: `robot` unit
+    (taper bounds + monotonicity, never-in-endgame, determinism, ~20% distribution). Bake-back:
+    `docs/ARCHITECTURE.md` §7, `docs/FUNCTIONAL.md` (+`_ru`), `backend/README.md`, `PLAN.md` Stage 5.
+
+- **GL — Simultaneous quick-game cap** (owner ad-hoc, not on the raw TODO list): a player may hold at
+  most **10** active quick games; at the cap the lobby greys **New Game** and shows a plain notice
+  "Вы достигли лимита одновременных партий", both clearing automatically when an active game finishes.
+  - **Locked decisions (interview):** what counts = active **+** open (searching) quick games, **including
+    AI** (`vs_ai`); friend games (invitation-linked) **never** count. The backend gate refuses **all** new-game
+    creation at the cap — `lobby/enqueue` **and** `invitations` — with **409 `game_limit_reached`**; **accepting**
+    an invitation is never gated, so friend games are capped "from the other end". Delivery = a boolean
+    **`at_game_limit`** on the existing `games.list` (no per-event payload: a turn change does not move the count,
+    and the lobby already re-fetches `games.list` on entry + every game event); the first uncached lobby frame
+    defaults the button **enabled** (the backend gate is the authority).
+  - **What shipped:** `game.MaxActiveQuickGames` + `Store/Service.CountActiveQuickGames` (active/open seats, no
+    `game_invitations` row; hidden games still count → a dedicated count, not a filter over the lobby list);
+    `Server.atGameLimit`/`ensureUnderGameLimit` gating `handleEnqueue` + `handleCreateInvitation`;
+    `gameListDTO.at_game_limit`; the FB `GameList` trailing `at_game_limit` (regenerated Go + TS) threaded through
+    the gateway transcode + UI codec; `lib/model` + `lobbycache` snapshot + `Lobby.svelte` (disabled tab + a muted
+    `.limit` notice); i18n `lobby.limitReached` (en authoritative + ru).
+  - **Caveat (logged):** the gate is a pre-check, not transaction-atomic — concurrent creates from one account could
+    momentarily exceed by 1–2 (harmless soft cap; the UI disables the button regardless). Strict atomicity was judged
+    a disproportionate diff across the two create paths.
+  - **No schema change → no contour DB wipe** (only a trailing FB field, no migration). Tests: backend integration
+    (`game_limit_test.go`: count rule + HTTP gate 409 + accept bypass), server unit (error mapping), gateway
+    transcode round-trip, UI codec + lobbycache unit, e2e (`gamelimit.spec.ts`). Bake-back: `docs/FUNCTIONAL.md`
+    (+`_ru`), `docs/ARCHITECTURE.md` §8, `docs/UI_DESIGN.md`, `backend/README.md`.
+
+- **CM — Channel-chat moderation + promo bot** (owner ad-hoc, not on the raw TODO list):
+  - **Locked decisions (interview):** the promo bot is a **goroutine in `cmd/bot`** (its own token, no
+    bot-link); the moderated chat's default-no-send is configured by a **human** in the group settings (the
+    bot only grants, never `setChatPermissions`); a non-eligible joiner is **left muted silently**; a
+    temporary-suspension expiry is handled by a **backend sweeper** that emits the re-evaluate event; and a new
+    **`chat_muted` role** is a chat-only mute with the **game suspension dominating**
+    (`eligible = registered AND NOT suspended AND NOT chat_muted`).
+  - **Bot API reality (verified against the docs):** a cross-bot Mini App launch must be a **URL button** to the
+    main bot's `t.me/<bot>?startapp` link — a `web_app` button signs initData with the *sending* bot's token,
+    which the main validator rejects — so the promo button reuses the UI's `VITE_TELEGRAM_LINK`. `chat_member`
+    updates arrive **only** when the bot is a chat **admin** with the "Ban users" right (the client label for the
+    Bot API `can_restrict_members`) and `chat_member` is in `allowed_updates`; bots cannot list members but can
+    `getChatMember` a single user, which is the membership guard on the block/unblock path.
+  - **Wire:** `pkg/proto/botlink/v1` gains a `ChatGateCommand` in the `Command` oneof and a unary
+    `ResolveChatEligibility`; the backend gains `notify.KindChatAccessChanged` (no payload, infra-only — never an
+    out-of-app message) and an internal `POST /api/v1/internal/chat-access` resolver; the gateway resolves the
+    join (by external_id) and the event (by user_id) through it and pushes the chat-gate command fire-and-forget
+    (at-most-once, recovered by the next moderation action or a re-join).
+  - **No schema change → no contour DB wipe:** `chat_muted` is a new `account.KnownRoles` entry (the
+    `account_roles` table is data-driven). The suspension-expiry sweeper is a new `account.SuspensionSweeper`
+    (a 1-minute window, idempotent) started in `cmd/backend`, alongside the guest reaper.
+  - **Deploy:** new `TEST_`/`PROD_` `TELEGRAM_PROMO_BOT_TOKEN` (secret), `TELEGRAM_BOT_USERNAME` and
+    `TELEGRAM_CHAT_ID` (variables); the promo link reuses the existing `*_VITE_TELEGRAM_LINK` variable as
+    `TELEGRAM_BOT_LINK`. The bot must be promoted to admin in the real discussion group, and the group default
+    set to no-send, as part of the Stage 18 prod cutover (the test contour exercises the code path).
+  - **Bake-back:** `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md` (+`_ru`), `platform/telegram/README.md`,
+    `backend/README.md`, Go Doc comments. Tests: backend resolver truth table + publish on block/unblock/role +
+    the sweeper window (unit + integration); gateway hub `ResolveChatEligibility` + the chat-gate command; bot
+    `chat_member` grant + `ApplyChatGate` getChatMember-guard; promo `/start` localization + URL button; config
+    parsing.
+  - **Post-contour-test fixes (same PR):** a live test drove three corrections. (1) **Strategy
+    inversion (the key one)** — the original "group default no-send, bot grants the eligible" cannot
+    work: Telegram intersects the chat default with each user's permission, so a per-user grant never
+    exceeds a deny-by-default group (the bot set `can_send=true` yet the user still could not write).
+    The group now **allows sending by default** and the bot only **restricts** — it mutes an ineligible
+    member (unregistered / admin-suspended / `chat_muted`) and un-mutes an eligible one it had muted,
+    acting only when the current state differs (idempotent; the bot's own change is skipped by matching
+    the actor id to the bot). A present member in a default-allow group can appear as `restricted` with
+    `is_member`, so the gate reads both. (2) **Join-before-register** — a user who joins before
+    registering is covered by no `chat_member` event, so `ProvisionTelegram` now reports first contact
+    and the Telegram auth handler emits `chat_access_changed` on it. (3) **Observability** — a startup
+    self-check logs whether the bot is an admin-with-restrict in the chat (it caught a misconfigured
+    `TELEGRAM_CHAT_ID` set to a channel id, not the discussion-group id); the per-event trace is at
+    Debug, the actual mute/unmute and warnings at Info.

README.md

@@ -22,8 +22,9 @@ supports English Scrabble, Russian Scrabble and Эрудит.
   security, cross-service contracts.
 - [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md)) —
   per-domain user stories.
-- [`docs/TESTING.md`](docs/TESTING.md) — test layers and the CI gate.
-- [`CLAUDE.md`](CLAUDE.md) — project guide and development workflow.
+- [`docs/TESTING.md`](docs/TESTING.md) — test layers and the per-stage CI gate.
+- [`PLAN.md`](PLAN.md) — the staged implementation plan and stage tracker.
+- [`CLAUDE.md`](CLAUDE.md) — project guide and the mandatory per-stage workflow.
 
 ## Build & test
 
@@ -89,7 +90,7 @@ observability stack (OTel Collector → Prometheus + Tempo → Grafana) + a fron
 services build from multi-stage distroless `*/Dockerfile`.
 
 ```sh
-docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required; pulls that DAWG release artifact
+docker build -f backend/Dockerfile -t scrabble-backend .   # pulls the DAWG release artifact
 docker build -f gateway/Dockerfile -t scrabble-gateway .   # node stage builds + embeds the UI
 docker compose -f deploy/docker-compose.yml config         # validate (needs the TEST_/PROD_ env)
 ```

assets/icons/README.md

@@ -1,18 +0,0 @@
-# Icons
-
-The whole shipped icon set is sliced from **one master** — see
-[`brand/`](brand/) for the reference generator, the pinned font and the committed
-outputs, and [`../../docs/ICON_BRANDBOOK.md`](../../docs/ICON_BRANDBOOK.md) for how the
-mark is constructed. The per-platform target map (which file goes where) is in
-[`../../docs/ICONS.md`](../../docs/ICONS.md).
-
-```sh
-cd brand
-npm i opentype.js
-node build-set.mjs          # web (ui/public) + Capacitor layers (ui/assets) + vk/ tg/ store/
-node build-android-res.mjs  # Android launcher resources (all densities + monochrome)
-```
-
-> The earlier `build/` pipeline (LiberationSans glyph outlines → favicon/apple-touch/OG)
-> was replaced by `brand/` when the icon was rebranded onto the Spectral «Э» master.
-> The separate VK loading-screen animation lives in [`../vk/`](../vk/) and is unrelated.

assets/icons/brand/.gitignore

@@ -1,2 +0,0 @@
-node_modules/
-package-lock.json

assets/icons/brand/README.md

@@ -1,32 +0,0 @@
-# Erudit icon — brand master
-
-The reference construction of the Erudit app icon. The authoritative, human-readable
-spec lives in [`docs/ICON_BRANDBOOK.md`](../../../docs/ICON_BRANDBOOK.md); this folder
-holds the machine reproduction of exactly what that document describes.
-
-| File | What |
-|------|------|
-| `build-icon.mjs` | reference generator — every dimension is a fraction of the side, matching the brand book |
-| `render-png.mjs` | rasterises an icon SVG to PNG via the `ui` package's Playwright chromium |
-| `Spectral-Bold.ttf` | the «Э» typeface (SIL OFL, `Spectral-OFL.txt`) — pinned so the letter never drifts |
-| `icon-light.svg` / `.png` | the light master (1024) |
-| `icon-dark.svg` / `.png` | the dark master (1024) |
-| `icon-construction.svg` / `.png` | the percent-annotated construction scheme (figure in the brand book) |
-
-## Regenerate
-
-```sh
-cd assets/icons/brand
-npm i opentype.js                       # the only extra dep; render uses ui's chromium
-
-node build-icon.mjs --variant light  > icon-light.svg
-node build-icon.mjs --variant dark   > icon-dark.svg
-node build-icon.mjs --variant light --scheme > icon-construction.svg
-
-node render-png.mjs icon-light.svg  icon-light.png  1024
-node render-png.mjs icon-dark.svg   icon-dark.png   1024
-node render-png.mjs icon-construction.svg icon-construction.png 2048
-```
-
-The SVGs are resolution-free; render at any size. Downstream slicing (favicon / PWA /
-iOS / Android) is a separate step — see [`docs/ICONS.md`](../../../docs/ICONS.md).

assets/icons/brand/Spectral-OFL.txt

@@ -1,93 +0,0 @@
-Copyright 2017 The Spectral Project Authors (https://github.com/productiontype/Spectral)
-
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-https://openfontlicense.org
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded, 
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.

assets/icons/brand/build-android-res.mjs

@@ -1,53 +0,0 @@
-'use strict';
-// Generate the Android launcher resources from the committed layers, at every
-// density, with NO inset (our layers already fill the 108 dp canvas) and a
-// monochrome (themed) layer. Run build-set.mjs first (it writes the layer PNGs).
-//
-//   npm i opentype.js  # (only build-icon/build-set need it; this reads PNGs)
-//   node build-set.mjs && node build-android-res.mjs
-//
-// Writes ui/android/app/src/main/res/mipmap-*/ic_launcher{,_round,_foreground,
-// _background,_monochrome}.png. The two mipmap-anydpi-v26/*.xml are committed by hand.
-import { readFileSync, writeFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-
-const DIR = dirname(fileURLToPath(import.meta.url));
-const ROOT = join(DIR, '..', '..', '..');
-const RES = join(ROOT, 'ui', 'android', 'app', 'src', 'main', 'res');
-const uri = p => 'data:image/png;base64,' + readFileSync(p).toString('base64');
-const BG = uri(join(ROOT, 'ui', 'assets', 'icon-background.png'));
-const FG = uri(join(ROOT, 'ui', 'assets', 'icon-foreground.png'));
-const MONO = uri(join(DIR, 'android-monochrome.png'));
-// The full-bleed master (square tile + master mark) — the legacy SQUARE launcher (API < 26)
-// uses it so old Android shows a large mark rather than the safe-zone foreground shrunk into
-// the middle. The round legacy icon keeps the safe-zone composite (a round mask would clip
-// the master's corner ✻).
-const MASTER = uri(join(ROOT, 'ui', 'assets', 'icon.png'));
-
-// density: [adaptive-layer px (108 dp), legacy launcher px (48 dp)]
-const D = { ldpi: [81, 36], mdpi: [108, 48], hdpi: [162, 72], xhdpi: [216, 96], xxhdpi: [324, 144], xxxhdpi: [432, 192] };
-
-const pw = await import(join(ROOT, 'ui', 'node_modules', '@playwright', 'test', 'index.js'));
-const { chromium } = pw.default ?? pw;
-const browser = await chromium.launch();
-const page = await browser.newPage({ deviceScaleFactor: 1 });
-const im = (u, s) => `<img src="${u}" width="${s}" height="${s}" style="display:block">`;
-async function shot(html, s, transparent) {
-  await page.setViewportSize({ width: s, height: s });
-  await page.setContent(`<!doctype html><meta charset=utf8><style>*{margin:0;padding:0}#r{width:${s}px;height:${s}px}</style><div id=r>${html}</div>`, { waitUntil: 'networkidle' });
-  return page.locator('#r').screenshot({ omitBackground: !!transparent });
-}
-for (const [d, [fg, lg]] of Object.entries(D)) {
-  const dir = join(RES, `mipmap-${d}`);
-  writeFileSync(join(dir, 'ic_launcher_background.png'), await shot(im(BG, fg), fg, false));
-  writeFileSync(join(dir, 'ic_launcher_foreground.png'), await shot(im(FG, fg), fg, true));
-  writeFileSync(join(dir, 'ic_launcher_monochrome.png'), await shot(im(MONO, fg), fg, true));
-  // Square launcher: the full-bleed master (large mark). Round launcher: the safe-zone
-  // composite, circle-clipped (the master's corner ✻ would be clipped by the round mask).
-  writeFileSync(join(dir, 'ic_launcher.png'), await shot(im(MASTER, lg), lg, false));
-  const round = `<div style="width:${lg}px;height:${lg}px;border-radius:50%;overflow:hidden;position:relative">${im(BG, lg)}<div style="position:absolute;inset:0">${im(FG, lg)}</div></div>`;
-  writeFileSync(join(dir, 'ic_launcher_round.png'), await shot(round, lg, true));
-  console.log('mipmap-' + d, 'ok');
-}
-await browser.close();

assets/icons/brand/build-icon.mjs

@@ -1,163 +0,0 @@
-'use strict';
-// Erudit app-icon — the reference generator. Every dimension below is a FRACTION
-// of the icon side, so this file reads the same as docs/ICON_BRANDBOOK.md and the
-// icon reproduces at any resolution. Emits one variant/layer's SVG to stdout.
-//
-//   node build-icon.mjs --variant light|dark [--layer full|background|foreground] [--scheme] > icon.svg
-//
-// Layers (for Android adaptive icons):
-//   full        the standalone master (rounded tile + mark) — iOS / PWA / favicon
-//   background  wood + grain + light/shadow, full-bleed square (the OS applies the mask)
-//   foreground  only «Э» + ✻, transparent, re-placed for the round mask (see FG_* below)
-//
-// Deps: opentype.js (npm i opentype.js). Font: ./Spectral-Bold.ttf (OFL, bundled).
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-import opentype from 'opentype.js';
-
-const DIR = dirname(fileURLToPath(import.meta.url));
-const args = process.argv.slice(2);
-const has = f => args.includes('--' + f);
-const val = (f, d) => { const i = args.indexOf('--' + f); return i >= 0 ? args[i + 1] : d; };
-
-// ---- the design, in fractions of the side ----
-const S = 1024;                       // reference side (the icon is resolution-free)
-const RADIUS   = 0.17;                // tile corner radius (full master)
-const STAR_BULB = 0.22;               // spoke-end (and hub) radius, as fraction of star radius
-const STAR_SPOKES = 6;
-const GRAIN_COLS = 6, GRAIN_W = 1 / 32, GRAIN_SHIFT = 1 / 16, GRAIN_TILT = 4;
-const SHEEN = 0.15;                   // white, transparent bottom-left -> this alpha top-right
-const SHADE = 0.15;                   // black, this alpha bottom-left -> transparent top-right
-
-// The mark, placed for the standalone master (bottom-right biased, full-bleed):
-const MASTER = { lh: 0.6055, lc: [0.4814, 0.4922], sd: 0.1729, sc: [0.7881, 0.7881] };
-// The mark, placed for the Android foreground layer (centred-ish inside the 61% safe
-// zone, nudged right 8% / down 3% for optical balance under the round mask; smaller ✻).
-// Every value is the earlier placement scaled 0.75 about the icon centre (0.5, 0.5): the
-// whole mark is 25% smaller, its «Э»↔✻ arrangement unchanged, so the ✻ that used to graze
-// the round mask now sits well inside the safe zone. Round-mask launchers (adaptive + the
-// legacy round icon) get more breathing room; the full-bleed master is untouched.
-const FOREGROUND = { lh: 0.4043, lc: [0.5176, 0.4963], sd: 0.0989, sc: [0.6970, 0.6700] };
-
-const PALETTE = {
-  light: { wood: '#e6b053', ink: '#5a3a12', grain: '#d8a54e' },
-  dark:  { wood: '#4a3316', ink: '#f2d9a0', grain: '#432e14' },
-};
-
-// Layers:
-//   full        rounded tile + master mark        (favicon.svg — browser rounds nothing)
-//   flat        square tile + master mark          (apple-touch, PWA "any" — OS rounds)
-//   background  square tile, no mark               (Android adaptive background)
-//   foreground  mark only, transparent             (Android adaptive foreground)
-//   maskable    square tile + foreground mark       (PWA maskable — safe-zone aware)
-//   monochrome  foreground mark only, flat colour  (Android 13+ themed layer)
-const LAYERS = ['full', 'flat', 'background', 'foreground', 'maskable', 'monochrome'];
-const variant = val('variant', 'light');
-const layer = val('layer', 'full');
-const P = PALETTE[variant];
-if (!P) { console.error(`unknown --variant ${variant} (light|dark)`); process.exit(1); }
-if (!LAYERS.includes(layer)) { console.error(`unknown --layer ${layer} (${LAYERS.join('|')})`); process.exit(1); }
-
-const usesForegroundPlacement = ['foreground', 'maskable', 'monochrome'].includes(layer);
-const drawBg = ['full', 'flat', 'background', 'maskable'].includes(layer);
-const drawMark = layer !== 'background';
-const MARK = usesForegroundPlacement ? FOREGROUND : MASTER;
-const inkColour = layer === 'monochrome' ? val('mono', '#ffffff') : P.ink;
-const RX = layer === 'full' ? RADIUS * S : 0;   // only the standalone master keeps rounded corners
-const font = opentype.parse(readFileSync(join(DIR, 'Spectral-Bold.ttf')).buffer);
-
-// «Э» outline scaled so its ink bounding box is MARK.lh of the side, box centred on MARK.lc.
-function letterSvg() {
-  const g = font.charToGlyph('Э');
-  const h0 = (() => { const b = g.getPath(0, 0, 1000).getBoundingBox(); return b.y2 - b.y1; })();
-  const scale = (MARK.lh * S) / h0;
-  const p = g.getPath(0, 0, 1000 * scale);
-  const bb = p.getBoundingBox();
-  const w = bb.x2 - bb.x1, h = bb.y2 - bb.y1;
-  const tx = MARK.lc[0] * S - (bb.x1 + w / 2);
-  const ty = MARK.lc[1] * S - (bb.y1 + h / 2);
-  return { svg: `<path transform="translate(${tx.toFixed(2)} ${ty.toFixed(2)})" d="${p.toPathData(2)}" fill="${inkColour}"/>`,
-           box: { x: bb.x1 + tx, y: bb.y1 + ty, w, h } };
-}
-
-// Teardrop-spoked asterisk ✻: each spoke tapers to a point at the centre and ends
-// in a round bulb; a central disc equal to the bulb fuses them.
-function starPath() {
-  const cx = MARK.sc[0] * S, cy = MARK.sc[1] * S, Rout = MARK.sd * S / 2;
-  const rb = Rout * STAR_BULB, R = Rout - rb;
-  const L = Math.sqrt(R * R - rb * rb), theta = Math.asin(rb / R);
-  const rot = (v, t) => [v[0] * Math.cos(t) - v[1] * Math.sin(t), v[0] * Math.sin(t) + v[1] * Math.cos(t)];
-  let d = '';
-  for (let k = 0; k < STAR_SPOKES; k++) {
-    const a = -Math.PI / 2 + k * 2 * Math.PI / STAR_SPOKES;
-    const u = [Math.cos(a), Math.sin(a)];
-    const d1 = rot(u, theta), d2 = rot(u, -theta);
-    const T1 = [cx + L * d1[0], cy + L * d1[1]], T2 = [cx + L * d2[0], cy + L * d2[1]];
-    d += `M${cx.toFixed(2)} ${cy.toFixed(2)} L${T1[0].toFixed(2)} ${T1[1].toFixed(2)} A${rb.toFixed(2)} ${rb.toFixed(2)} 0 1 0 ${T2[0].toFixed(2)} ${T2[1].toFixed(2)} Z `;
-  }
-  d += `M${cx} ${cy} m${-rb} 0 a${rb} ${rb} 0 1 0 ${2 * rb} 0 a${rb} ${rb} 0 1 0 ${-2 * rb} 0 Z`;
-  return `<path d="${d}" fill="${inkColour}"/>`;
-}
-
-function grain() {
-  const colW = S / GRAIN_COLS, sw = GRAIN_W * S, shift = GRAIN_SHIFT * S;
-  const yTop = -0.2 * S, yBot = 1.2 * S, cy = S / 2;
-  let s = '';
-  for (let i = 1; i <= GRAIN_COLS; i++) {
-    const xr = i * colW - shift, x = xr - sw, cx = xr - sw / 2;
-    s += `<rect x="${x.toFixed(2)}" y="${yTop.toFixed(2)}" width="${sw.toFixed(2)}" height="${(yBot - yTop).toFixed(2)}" fill="${P.grain}" transform="rotate(${GRAIN_TILT} ${cx.toFixed(2)} ${cy.toFixed(2)})"/>`;
-  }
-  return `<g clip-path="url(#tile)">${s}</g>`;
-}
-
-let body = '';
-const L = letterSvg();
-if (drawBg) {                           // tile + grain + light/shadow (the background)
-  body += `<rect width="${S}" height="${S}" rx="${RX}" fill="${P.wood}"/>`
-    + `<defs><clipPath id="tile"><rect width="${S}" height="${S}" rx="${RX}"/></clipPath>`
-    +   `<linearGradient id="sheen" gradientUnits="userSpaceOnUse" x1="0" y1="${S}" x2="${S}" y2="0"><stop offset="0" stop-color="#fff" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity="${SHEEN}"/></linearGradient>`
-    +   `<linearGradient id="shade" gradientUnits="userSpaceOnUse" x1="0" y1="${S}" x2="${S}" y2="0"><stop offset="0" stop-color="#000" stop-opacity="${SHADE}"/><stop offset="1" stop-color="#000" stop-opacity="0"/></linearGradient>`
-    + `</defs>`
-    + grain()
-    + `<rect width="${S}" height="${S}" fill="url(#sheen)" clip-path="url(#tile)"/>`
-    + `<rect width="${S}" height="${S}" fill="url(#shade)" clip-path="url(#tile)"/>`;
-}
-if (drawMark) body += L.svg + starPath();   // the mark
-if (has('scheme')) body += scheme(L);
-
-process.stdout.write(`<svg xmlns="http://www.w3.org/2000/svg" width="${S}" height="${S}" viewBox="0 0 ${S} ${S}">${body}</svg>\n`);
-
-// Percent-based construction overlay for the brand book (full master only).
-function scheme(L) {
-  const pc = n => (100 * n / S).toFixed(1) + '%';
-  const GC = '#0f172a', BX = '#d81b60', AC = '#0d9488';
-  const halo = 'paint-order="stroke" stroke="#fff" stroke-width="4"';
-  const cx = MARK.sc[0] * S, cy = MARK.sc[1] * S, sd = MARK.sd * S;
-  let g = `<g font-family="'Helvetica Neue',Arial,sans-serif">`;
-  for (let f = 1; f <= 3; f++) {
-    const p = f * S / 4;
-    g += `<line x1="${p}" y1="0" x2="${p}" y2="${S}" stroke="${GC}" stroke-opacity="0.18" stroke-width="1.2"/>`;
-    g += `<line x1="0" y1="${p}" x2="${S}" y2="${p}" stroke="${GC}" stroke-opacity="0.18" stroke-width="1.2"/>`;
-    g += `<text x="${p + 4}" y="20" font-size="17" font-weight="700" fill="${GC}" ${halo}>${f * 25}%</text>`;
-    g += `<text x="4" y="${p - 4}" font-size="17" font-weight="700" fill="${GC}" ${halo}>${f * 25}%</text>`;
-  }
-  g += `<line x1="${0.14 * S}" y1="${0.86 * S}" x2="${0.86 * S}" y2="${0.14 * S}" stroke="${AC}" stroke-width="3" stroke-dasharray="3 8" stroke-linecap="round"/>`;
-  g += `<circle cx="${0.86 * S}" cy="${0.14 * S}" r="6" fill="${AC}"/><circle cx="${0.14 * S}" cy="${0.86 * S}" r="6" fill="${AC}"/>`;
-  g += `<text x="${0.86 * S - 6}" y="${0.14 * S - 12}" text-anchor="end" font-size="18" font-weight="700" fill="${AC}" ${halo}>light: white 0%→15%</text>`;
-  g += `<text x="${0.14 * S + 10}" y="${0.86 * S + 26}" font-size="18" font-weight="700" fill="${AC}" ${halo}>shadow: black 15%→0%</text>`;
-  const { x, y, w, h } = L.box;
-  g += `<rect x="${x.toFixed(1)}" y="${y.toFixed(1)}" width="${w.toFixed(1)}" height="${h.toFixed(1)}" fill="none" stroke="${BX}" stroke-width="2.5"/>`;
-  g += `<line x1="${MARK.lc[0] * S}" y1="${MARK.lc[1] * S - 16}" x2="${MARK.lc[0] * S}" y2="${MARK.lc[1] * S + 16}" stroke="${BX}" stroke-width="2.5"/><line x1="${MARK.lc[0] * S - 16}" y1="${MARK.lc[1] * S}" x2="${MARK.lc[0] * S + 16}" y2="${MARK.lc[1] * S}" stroke="${BX}" stroke-width="2.5"/>`;
-  g += `<text x="${x.toFixed(1)}" y="${(y - 10).toFixed(1)}" font-size="19" font-weight="700" fill="${BX}" ${halo}>«Э» Spectral Bold · box H ${pc(h)} · W ${pc(w)}</text>`;
-  g += `<text x="${x.toFixed(1)}" y="${(y + h + 24).toFixed(1)}" font-size="18" font-weight="700" fill="${BX}" ${halo}>box center ${pc(MARK.lc[0] * S)} / ${pc(MARK.lc[1] * S)}</text>`;
-  g += `<rect x="${cx - sd / 2}" y="${cy - sd / 2}" width="${sd}" height="${sd}" fill="none" stroke="${BX}" stroke-width="2.5"/>`;
-  g += `<line x1="${cx}" y1="${cy - 14}" x2="${cx}" y2="${cy + 14}" stroke="${BX}" stroke-width="2.5"/><line x1="${cx - 14}" y1="${cy}" x2="${cx + 14}" y2="${cy}" stroke="${BX}" stroke-width="2.5"/>`;
-  g += `<text x="${(cx + sd / 2).toFixed(1)}" y="${(cy - sd / 2 - 10).toFixed(1)}" text-anchor="end" font-size="18" font-weight="700" fill="${BX}" ${halo}>✻ Ø ${pc(sd)} · center ${pc(cx)} / ${pc(cy)}</text>`;
-  g += `<text x="${RX + 14}" y="${RX - 6}" font-size="17" font-weight="700" fill="${GC}" ${halo}>corner r = 17%</text>`;
-  g += `<path d="M4 ${RX} A ${RX} ${RX} 0 0 1 ${RX} 4" fill="none" stroke="${GC}" stroke-width="2" stroke-dasharray="5 5"/>`;
-  g += `<rect x="${0.03 * S}" y="${S - 96}" width="${0.94 * S}" height="74" rx="12" fill="#0f172a" fill-opacity="0.82"/>`;
-  g += `<text x="${0.055 * S}" y="${S - 64}" font-size="18" font-weight="600" fill="#fff">Wood grain: 6 equal columns; a vertical stripe on each column's right edge,</text>`;
-  g += `<text x="${0.055 * S}" y="${S - 40}" font-size="18" font-weight="600" fill="#fff">width 1/32 of side; the whole set shifted left 1/16; every stripe tilted 4°.</text>`;
-  return g + `</g>`;
-}

assets/icons/brand/build-set.mjs

@@ -1,105 +0,0 @@
-'use strict';
-// Slice the whole shipped icon set from the brand master (build-icon.mjs). Renders
-// with the ui package's Playwright chromium. See docs/ICONS.md for the target map.
-//
-//   npm i opentype.js && node build-set.mjs
-//
-// Writes: ui/public/* (web), ui/assets/* (Capacitor layers), ./vk/* and ./store/*
-// (manual-upload art). Wiring (manifest, html, Android res) is done separately.
-import { execFileSync } from 'node:child_process';
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-
-const DIR = dirname(fileURLToPath(import.meta.url));
-const UI = join(DIR, '..', '..', '..', 'ui');
-const PUB = join(UI, 'public'), ASSETS = join(UI, 'assets');
-const VK = join(DIR, 'vk'), STORE = join(DIR, 'store'), TG = join(DIR, 'tg');
-[VK, STORE, TG].forEach(d => mkdirSync(d, { recursive: true }));
-
-// one SVG string for a variant+layer from the reference generator
-const svgFor = (variant, layer) =>
-  execFileSync('node', [join(DIR, 'build-icon.mjs'), '--variant', variant, '--layer', layer], { encoding: 'utf8' });
-
-const pw = await import(join(UI, 'node_modules', '@playwright', 'test', 'index.js'));
-const { chromium } = pw.default ?? pw;
-const browser = await chromium.launch();
-const page = await browser.newPage();
-
-async function pngFromSvg(svg, size, transparent) {
-  await page.setViewportSize({ width: size, height: size });
-  await page.setContent(`<!doctype html><meta charset=utf8><style>*{margin:0;padding:0}svg{display:block;width:${size}px;height:${size}px}</style>${svg}`, { waitUntil: 'networkidle' });
-  return page.locator('svg').screenshot({ omitBackground: !!transparent });
-}
-async function shootHtml(html, w, h) {
-  await page.setViewportSize({ width: w, height: h });
-  await page.setContent(html, { waitUntil: 'networkidle' });
-  return page.screenshot();
-}
-function icoFromPNG(png, sizePx) {
-  const h = Buffer.alloc(22);
-  h.writeUInt16LE(0, 0); h.writeUInt16LE(1, 2); h.writeUInt16LE(1, 4);
-  h.writeUInt8(sizePx, 6); h.writeUInt8(sizePx, 7);
-  h.writeUInt16LE(1, 10); h.writeUInt16LE(32, 12);
-  h.writeUInt32LE(png.length, 14); h.writeUInt32LE(22, 18);
-  return Buffer.concat([h, png]);
-}
-const write = (p, buf) => { writeFileSync(p, buf); console.log('wrote', p.replace(join(DIR, '..', '..', '..'), '.'), buf.length, 'b'); };
-
-// ---- pre-render the SVG sources we need ----
-const S = {
-  fullLight: svgFor('light', 'full'), fullDark: svgFor('dark', 'full'),
-  flatLight: svgFor('light', 'flat'), flatDark: svgFor('dark', 'flat'),
-  maskLight: svgFor('light', 'maskable'), maskDark: svgFor('dark', 'maskable'),
-  bgLight: svgFor('light', 'background'), fgLight: svgFor('light', 'foreground'),
-  monoLight: svgFor('light', 'monochrome'),
-};
-
-// ---- favicon.svg: light + dark in one file, toggled by prefers-color-scheme ----
-const inner = svg => svg.replace(/^<svg[^>]*>/, '').replace(/<\/svg>\s*$/, '');
-const faviconSvg =
-  `<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024">`
-  + `<style>.d{display:none}@media(prefers-color-scheme:dark){.l{display:none}.d{display:inline}}</style>`
-  + `<g class="l">${inner(S.fullLight)}</g><g class="d">${inner(S.fullDark)}</g></svg>\n`;
-write(join(PUB, 'favicon.svg'), Buffer.from(faviconSvg));
-
-// ---- web rasters ----
-write(join(PUB, 'favicon.ico'), icoFromPNG(await pngFromSvg(S.flatLight, 32, false), 32));
-write(join(PUB, 'apple-touch-icon.png'), await pngFromSvg(S.flatLight, 180, false));
-write(join(PUB, 'icon-192.png'), await pngFromSvg(S.flatLight, 192, false));
-write(join(PUB, 'icon-512.png'), await pngFromSvg(S.flatLight, 512, false));
-write(join(PUB, 'icon-192-dark.png'), await pngFromSvg(S.flatDark, 192, false));
-write(join(PUB, 'icon-512-dark.png'), await pngFromSvg(S.flatDark, 512, false));
-write(join(PUB, 'icon-maskable-512.png'), await pngFromSvg(S.maskLight, 512, false));
-write(join(PUB, 'icon-maskable-512-dark.png'), await pngFromSvg(S.maskDark, 512, false));
-
-// ---- Capacitor layers (ui/assets) ----
-write(join(ASSETS, 'icon.png'), await pngFromSvg(S.flatLight, 1024, false));          // legacy single
-write(join(ASSETS, 'icon-foreground.png'), await pngFromSvg(S.fgLight, 1024, true));   // adaptive fg
-write(join(ASSETS, 'icon-background.png'), await pngFromSvg(S.bgLight, 1024, false));  // adaptive bg
-write(join(DIR, 'android-monochrome.png'), await pngFromSvg(S.monoLight, 1024, true)); // themed layer (wired manually)
-
-// ---- VK (no rounding — flat light) ----
-for (const px of [576, 278, 150, 32]) write(join(VK, `vk-${px}.png`), await pngFromSvg(S.flatLight, px, false));
-
-// ---- Telegram bot: square, no rounding (TG crops the avatar to a circle) ----
-write(join(TG, 'tg-512.png'), await pngFromSvg(S.flatLight, 512, false));   // bot avatar + Mini App icon
-
-// ---- store art ----
-write(join(STORE, 'rustore-512.png'), await pngFromSvg(S.flatLight, 512, false));
-
-// ---- wordmark banner (board-green bg + master tile + «Эрудит» / Игра в слова) ----
-const b64 = readFileSync(join(DIR, 'Spectral-Bold.ttf')).toString('base64');
-const banner = (w, h, tile, t1, t2, gap, pad) => `<!doctype html><meta charset=utf8><style>
-@font-face{font-family:Spectral;src:url(data:font/ttf;base64,${b64});font-weight:700}
-*{margin:0;padding:0;box-sizing:border-box}
-body{width:${w}px;height:${h}px;background:#2a3330;display:flex;align-items:center;gap:${gap}px;padding:0 ${pad}px;font-family:Spectral}
-.tile{width:${tile}px;height:${tile}px;flex:none}.tile svg{width:${tile}px;height:${tile}px;display:block}
-.wm{color:#e7ece8;text-align:center}.t1{font-weight:700;font-size:${t1}px;line-height:1.02;letter-spacing:-2px}
-.t2{font-weight:700;font-size:${t2}px;line-height:1.1;color:#cdd6cf;margin-top:6px}
-</style><div class=tile>${S.fullLight}</div><div class=wm><div class=t1>«Эрудит»</div><div class=t2>Игра в слова</div></div>`;
-write(join(PUB, 'og-image.png'), await shootHtml(banner(1200, 630, 300, 150, 74, 64, 96), 1200, 630));
-write(join(TG, 'tg-demo-640x360.png'), await shootHtml(banner(640, 360, 150, 72, 38, 30, 44), 640, 360));
-
-await browser.close();
-console.log('done');

assets/icons/brand/icon-dark-android-background.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024"><rect width="1024" height="1024" rx="0" fill="#4a3316"/><defs><clipPath id="tile"><rect width="1024" height="1024" rx="0"/></clipPath><linearGradient id="sheen" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#fff" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity="0.15"/></linearGradient><linearGradient id="shade" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#000" stop-opacity="0.15"/><stop offset="1" stop-color="#000" stop-opacity="0"/></linearGradient></defs><g clip-path="url(#tile)"><rect x="74.67" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 90.67 512.00)"/><rect x="245.33" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 261.33 512.00)"/><rect x="416.00" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 432.00 512.00)"/><rect x="586.67" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 602.67 512.00)"/><rect x="757.33" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 773.33 512.00)"/><rect x="928.00" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 944.00 512.00)"/></g><rect width="1024" height="1024" fill="url(#sheen)" clip-path="url(#tile)"/><rect width="1024" height="1024" fill="url(#shade)" clip-path="url(#tile)"/></svg>

assets/icons/brand/icon-dark-android-foreground.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024"><path transform="translate(237.62 774.88)" d="M250.04-34.91Q326.35-34.91 368.57-91.33Q410.78-147.75 410.78-243.55Q410.78-249.23 410.78-254.91L254.10-254.91L208.64-185.91L195.65-185.91L195.65-368.57L208.64-368.57L254.10-299.56L407.53-299.56Q396.98-392.92 351.52-447.72Q306.06-502.52 241.11-502.52Q217.57-502.52 198.90-498.46Q180.22-494.40 162.36-482.22L83.62-354.77L69-354.77L77.93-505.76Q112.84-522.81 154.25-533.37Q195.65-543.92 259.78-543.92Q319.86-543.92 371.41-523.22Q422.96-502.52 460.71-465.58Q498.46-428.64 519.57-378.31Q540.67-327.98 540.67-267.90Q540.67-188.34 504.55-125.83Q468.42-63.32 405.10-27.60Q341.78 8.12 259.78 8.12Q200.52 8.12 150.59-3.25Q100.67-14.61 67.38-34.10L56.02-171.29L69.82-171.29L142.88-63.32Q165.61-50.33 191.59-42.62Q217.57-34.91 250.04-34.91" fill="#f2d9a0"/><path d="M781.00 744.04 L795.25 695.59 A14.85 14.85 0 1 0 766.76 695.59 Z M781.00 744.04 L830.08 732.15 A14.85 14.85 0 1 0 815.84 707.48 Z M781.00 744.04 L815.84 780.60 A14.85 14.85 0 1 0 830.08 755.93 Z M781.00 744.04 L766.76 792.49 A14.85 14.85 0 1 0 795.25 792.49 Z M781.00 744.04 L731.93 755.93 A14.85 14.85 0 1 0 746.17 780.60 Z M781.00 744.04 L746.17 707.48 A14.85 14.85 0 1 0 731.93 732.15 Z M781.0048 744.0384 m-14.845952 0 a14.845952 14.845952 0 1 0 29.691904 0 a14.845952 14.845952 0 1 0 -29.691904 0 Z" fill="#f2d9a0"/></svg>

assets/icons/brand/icon-dark.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024"><rect width="1024" height="1024" rx="174.08" fill="#4a3316"/><defs><clipPath id="tile"><rect width="1024" height="1024" rx="174.08"/></clipPath><linearGradient id="sheen" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#fff" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity="0.15"/></linearGradient><linearGradient id="shade" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#000" stop-opacity="0.15"/><stop offset="1" stop-color="#000" stop-opacity="0"/></linearGradient></defs><g clip-path="url(#tile)"><rect x="74.67" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 90.67 512.00)"/><rect x="245.33" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 261.33 512.00)"/><rect x="416.00" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 432.00 512.00)"/><rect x="586.67" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 602.67 512.00)"/><rect x="757.33" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 773.33 512.00)"/><rect x="928.00" y="-204.80" width="32.00" height="1433.60" fill="#432e14" transform="rotate(4 944.00 512.00)"/></g><rect width="1024" height="1024" fill="url(#sheen)" clip-path="url(#tile)"/><rect width="1024" height="1024" fill="url(#shade)" clip-path="url(#tile)"/><path transform="translate(157.86 804.91)" d="M280.84-39.21Q366.55-39.21 413.96-102.58Q461.38-165.95 461.38-273.54Q461.38-279.93 461.38-286.31L285.40-286.31L234.34-208.80L219.75-208.80L219.75-413.96L234.34-413.96L285.40-336.46L457.73-336.46Q445.88-441.32 394.81-502.86Q343.75-564.41 270.81-564.41Q244.37-564.41 223.39-559.85Q202.42-555.29 182.36-541.62L93.92-398.46L77.50-398.46L87.53-568.06Q126.74-587.21 173.24-599.06Q219.75-610.91 291.78-610.91Q359.25-610.91 417.15-587.66Q475.05-564.41 517.45-522.92Q559.85-481.44 583.56-424.90Q607.27-368.37 607.27-300.90Q607.27-211.54 566.69-141.33Q526.12-71.12 454.99-31Q383.87 9.12 291.78 9.12Q225.22 9.12 169.14-3.65Q113.06-16.41 75.68-38.30L62.92-192.39L78.42-192.39L160.48-71.12Q186.01-56.53 215.19-47.87Q244.37-39.21 280.84-39.21" fill="#f2d9a0"/><path d="M807.01 807.01 L825.70 743.46 A19.48 19.48 0 1 0 788.33 743.46 Z M807.01 807.01 L871.40 791.42 A19.48 19.48 0 1 0 852.71 759.05 Z M807.01 807.01 L852.71 854.97 A19.48 19.48 0 1 0 871.40 822.61 Z M807.01 807.01 L788.33 870.57 A19.48 19.48 0 1 0 825.70 870.57 Z M807.01 807.01 L742.63 822.61 A19.48 19.48 0 1 0 761.32 854.97 Z M807.01 807.01 L761.32 759.05 A19.48 19.48 0 1 0 742.63 791.42 Z M807.0144 807.0144 m-19.475456 0 a19.475456 19.475456 0 1 0 38.950912 0 a19.475456 19.475456 0 1 0 -38.950912 0 Z" fill="#f2d9a0"/></svg>

assets/icons/brand/icon-light-android-background.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024"><rect width="1024" height="1024" rx="0" fill="#e6b053"/><defs><clipPath id="tile"><rect width="1024" height="1024" rx="0"/></clipPath><linearGradient id="sheen" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#fff" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity="0.15"/></linearGradient><linearGradient id="shade" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#000" stop-opacity="0.15"/><stop offset="1" stop-color="#000" stop-opacity="0"/></linearGradient></defs><g clip-path="url(#tile)"><rect x="74.67" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 90.67 512.00)"/><rect x="245.33" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 261.33 512.00)"/><rect x="416.00" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 432.00 512.00)"/><rect x="586.67" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 602.67 512.00)"/><rect x="757.33" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 773.33 512.00)"/><rect x="928.00" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 944.00 512.00)"/></g><rect width="1024" height="1024" fill="url(#sheen)" clip-path="url(#tile)"/><rect width="1024" height="1024" fill="url(#shade)" clip-path="url(#tile)"/></svg>

assets/icons/brand/icon-light-android-foreground.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024"><path transform="translate(237.62 774.88)" d="M250.04-34.91Q326.35-34.91 368.57-91.33Q410.78-147.75 410.78-243.55Q410.78-249.23 410.78-254.91L254.10-254.91L208.64-185.91L195.65-185.91L195.65-368.57L208.64-368.57L254.10-299.56L407.53-299.56Q396.98-392.92 351.52-447.72Q306.06-502.52 241.11-502.52Q217.57-502.52 198.90-498.46Q180.22-494.40 162.36-482.22L83.62-354.77L69-354.77L77.93-505.76Q112.84-522.81 154.25-533.37Q195.65-543.92 259.78-543.92Q319.86-543.92 371.41-523.22Q422.96-502.52 460.71-465.58Q498.46-428.64 519.57-378.31Q540.67-327.98 540.67-267.90Q540.67-188.34 504.55-125.83Q468.42-63.32 405.10-27.60Q341.78 8.12 259.78 8.12Q200.52 8.12 150.59-3.25Q100.67-14.61 67.38-34.10L56.02-171.29L69.82-171.29L142.88-63.32Q165.61-50.33 191.59-42.62Q217.57-34.91 250.04-34.91" fill="#5a3a12"/><path d="M781.00 744.04 L795.25 695.59 A14.85 14.85 0 1 0 766.76 695.59 Z M781.00 744.04 L830.08 732.15 A14.85 14.85 0 1 0 815.84 707.48 Z M781.00 744.04 L815.84 780.60 A14.85 14.85 0 1 0 830.08 755.93 Z M781.00 744.04 L766.76 792.49 A14.85 14.85 0 1 0 795.25 792.49 Z M781.00 744.04 L731.93 755.93 A14.85 14.85 0 1 0 746.17 780.60 Z M781.00 744.04 L746.17 707.48 A14.85 14.85 0 1 0 731.93 732.15 Z M781.0048 744.0384 m-14.845952 0 a14.845952 14.845952 0 1 0 29.691904 0 a14.845952 14.845952 0 1 0 -29.691904 0 Z" fill="#5a3a12"/></svg>

assets/icons/brand/icon-light.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024"><rect width="1024" height="1024" rx="174.08" fill="#e6b053"/><defs><clipPath id="tile"><rect width="1024" height="1024" rx="174.08"/></clipPath><linearGradient id="sheen" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#fff" stop-opacity="0"/><stop offset="1" stop-color="#fff" stop-opacity="0.15"/></linearGradient><linearGradient id="shade" gradientUnits="userSpaceOnUse" x1="0" y1="1024" x2="1024" y2="0"><stop offset="0" stop-color="#000" stop-opacity="0.15"/><stop offset="1" stop-color="#000" stop-opacity="0"/></linearGradient></defs><g clip-path="url(#tile)"><rect x="74.67" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 90.67 512.00)"/><rect x="245.33" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 261.33 512.00)"/><rect x="416.00" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 432.00 512.00)"/><rect x="586.67" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 602.67 512.00)"/><rect x="757.33" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 773.33 512.00)"/><rect x="928.00" y="-204.80" width="32.00" height="1433.60" fill="#d8a54e" transform="rotate(4 944.00 512.00)"/></g><rect width="1024" height="1024" fill="url(#sheen)" clip-path="url(#tile)"/><rect width="1024" height="1024" fill="url(#shade)" clip-path="url(#tile)"/><path transform="translate(157.86 804.91)" d="M280.84-39.21Q366.55-39.21 413.96-102.58Q461.38-165.95 461.38-273.54Q461.38-279.93 461.38-286.31L285.40-286.31L234.34-208.80L219.75-208.80L219.75-413.96L234.34-413.96L285.40-336.46L457.73-336.46Q445.88-441.32 394.81-502.86Q343.75-564.41 270.81-564.41Q244.37-564.41 223.39-559.85Q202.42-555.29 182.36-541.62L93.92-398.46L77.50-398.46L87.53-568.06Q126.74-587.21 173.24-599.06Q219.75-610.91 291.78-610.91Q359.25-610.91 417.15-587.66Q475.05-564.41 517.45-522.92Q559.85-481.44 583.56-424.90Q607.27-368.37 607.27-300.90Q607.27-211.54 566.69-141.33Q526.12-71.12 454.99-31Q383.87 9.12 291.78 9.12Q225.22 9.12 169.14-3.65Q113.06-16.41 75.68-38.30L62.92-192.39L78.42-192.39L160.48-71.12Q186.01-56.53 215.19-47.87Q244.37-39.21 280.84-39.21" fill="#5a3a12"/><path d="M807.01 807.01 L825.70 743.46 A19.48 19.48 0 1 0 788.33 743.46 Z M807.01 807.01 L871.40 791.42 A19.48 19.48 0 1 0 852.71 759.05 Z M807.01 807.01 L852.71 854.97 A19.48 19.48 0 1 0 871.40 822.61 Z M807.01 807.01 L788.33 870.57 A19.48 19.48 0 1 0 825.70 870.57 Z M807.01 807.01 L742.63 822.61 A19.48 19.48 0 1 0 761.32 854.97 Z M807.01 807.01 L761.32 759.05 A19.48 19.48 0 1 0 742.63 791.42 Z M807.0144 807.0144 m-19.475456 0 a19.475456 19.475456 0 1 0 38.950912 0 a19.475456 19.475456 0 1 0 -38.950912 0 Z" fill="#5a3a12"/></svg>

assets/icons/brand/package.json

@@ -1,12 +0,0 @@
-{
-  "name": "erudit-icon-brand",
-  "private": true,
-  "type": "module",
-  "description": "Reference generator for the Erudit app-icon set (see docs/ICON_BRANDBOOK.md).",
-  "scripts": {
-    "build": "node build-set.mjs && node build-android-res.mjs"
-  },
-  "dependencies": {
-    "opentype.js": "^1.3.4"
-  }
-}

assets/icons/brand/render-png.mjs

@@ -1,21 +0,0 @@
-'use strict';
-// Rasterise an icon SVG to PNG at a given size, using the `ui` package's cached
-// Playwright chromium (no extra install). Usage:
-//   node render-png.mjs <in.svg> <out.png> [size=1024]
-import { readFileSync, writeFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-
-const DIR = dirname(fileURLToPath(import.meta.url));
-const pw = await import(join(DIR, '..', '..', '..', 'ui', 'node_modules', '@playwright', 'test', 'index.js'));
-const { chromium } = pw.default ?? pw;
-
-const [, , svgPath, pngPath, size] = process.argv;
-const S = Number(size) || 1024;
-const svg = readFileSync(svgPath, 'utf8');
-const b = await chromium.launch();
-const pg = await b.newPage({ viewport: { width: S, height: S }, deviceScaleFactor: 1 });
-await pg.setContent(`<!doctype html><meta charset=utf8><style>*{margin:0;padding:0}</style>${svg}`, { waitUntil: 'networkidle' });
-writeFileSync(pngPath, await pg.locator('svg').screenshot({ omitBackground: true }));
-await b.close();
-console.log('wrote', pngPath, S + 'px');

assets/vk/README.md

@@ -1,115 +0,0 @@
-# Erudit — VK loading-screen logo (Lottie)
-
-Animated logo for the **VK app loading screen** (shown before the SPA assets load).
-The Erudit «Э» tile (score `8`) **drops in under gravity, lands with a soft squash —
-its left/right edges bulging into a cushion — then springs back up**, looping. A light
-"glint" is caught at the moment of the bounce.
-
-| File | Purpose |
-|------|---------|
-| `erudit-loader.json` | The Lottie to upload to VK. |
-| `erudit-loader-preview.gif` | Looping preview. Rendered on a green "baize" background **only in the preview** — the real asset has a **transparent** background. |
-| `build/` | The reproducible build pipeline (see *Regenerate*). |
-
-**VK requirements met:** 96×96 px · vector Lottie JSON · ≤ 24 KB (~11 KB) · seamless
-~1.1 s loop · transparent background.
-
-Design reference: a photo of the physical wooden Erudit tile.
-
----
-
-## How it works
-
-A single flat layer holds the tile — a rounded-rect **face path**, the two glyphs, and
-a thin border — and everything is driven by that layer's transform plus a few colour /
-shape tracks. The anchor sits on the tile's **bottom edge**, so the squash happens
-against the floor.
-
-### Bounce (gravity)
-`position.y` of the bottom edge goes apex → floor → apex with **no dwell** (the apex is
-an instantaneous turn-around). The fall uses a strong **ease-in** (accelerate) and the
-rise a strong **ease-out** (decelerate), so it reads as real gravity. While falling fast
-the tile slightly **stretches** (tall+thin); that is the squash-and-stretch setup.
-
-### Soft cushion (squash)
-On contact the layer **squashes** (scaleY↓, scaleX↑) about the bottom anchor, with a
-touch of skew. Crucially the squash/cushion is **decoupled from the fall speed** — it
-eases in and out *slowly* (`ES`), so the landing feels soft even though the fall is
-fast. The squash is deliberately gentle (≈ 86 % / 112 %).
-
-### The cushion shape (the hard part)
-The face is **not** a plain rounded rect — it is a path whose left/right contour bows
-out into a convex cushion on impact:
-- the rest rounded-rect outline is sampled (fine corner arcs + edge mids), and on impact
-  every point is pushed outward by a smooth **barrel** profile `f(y) = b·(1 − (y/HH)²)`
-  (max at the middle, fading to zero at the top/bottom);
-- so the **whole side — corners included — bows out as one piece**, never just the
-  straight middle;
-- bezier handles are computed as a **chordal spline** (handle length ∝ the adjacent
-  chord), which stays smooth across the uneven corner/edge point spacing. This is what
-  keeps the corner↔cushion junction kink-free — both at rest and fully bulged — which a
-  naïve uniform Catmull-Rom (or moving discrete points with fixed tangents) does not.
-
-### Glint
-At the bounce the face flashes a little lighter (`FACE_GLINT`) and the glyphs warm
-toward brown-red (`BLACK_LIT`), then settle back. A cheap, warm "catch the light".
-
-### Border & background
-The tile carries a thin static **border** a touch darker than the face (`BORDER`) so it
-reads on any background. The **green baize background is added only when rendering the
-preview GIF** — the Lottie itself is transparent.
-
-### Player compatibility
-Only plain 2-D shapes (`ddd:0`) — no 3-D layers, expressions or effects — so every
-Lottie player (lottie-web on the web, rlottie on native) renders it identically.
-
----
-
-## Glyphs
-
-`Э` (U+042D) and `8` are **real outlines from LiberationSans-Regular** — metric-
-compatible with Arial, matching the game's `--font: system-ui … Arial` stack
-(see `ui/src/app.css`). `build/extract.js` pulls the contours into `build/glyphs.json`
-as Lottie cubic paths; a hair of same-colour stroke adds a touch of weight.
-
----
-
-## Regenerate
-
-Requirements: Node ≥ 18. `extract.js` additionally needs `opentype.js`
-(`npm i opentype.js`); **`generate.js` has no dependencies**.
-
-```sh
-cd assets/vk
-
-# 1. (optional) re-extract the glyphs — only if you change the font:
-#    default font: /usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf
-node build/extract.js [/path/to/font.ttf]      # -> build/glyphs.json
-
-# 2. build the animation (reads build/glyphs.json):
-node build/generate.js erudit-loader.json      # -> erudit-loader.json
-
-# 3. (optional) live preview — needs lottie-web (npm i lottie-web):
-node build/build-preview.js erudit-loader.json preview.html
-#    then open preview.html in a browser.
-```
-
-The preview GIF is assembled by rendering the Lottie frame-by-frame (lottie-web canvas,
-filled with the green baize) and stitching with `ffmpeg`; the live HTML preview is the
-quickest way to eyeball changes.
-
-## Tunables (top of `build/generate.js`)
-
-| Symbol | Meaning |
-|--------|---------|
-| `OP`, `FR` | loop length (frames) / fps — overall speed |
-| `T_HIT / T_PEAK / T_LIFT / T_REC` | beats: contact / squash peak / lift-off / cushion recovered |
-| `EI / EO / ES` | easings: fast fall / fast rise / slow soft cushion |
-| `APEX`, `FLOOR` | bottom-edge screen-y at the top of the bounce / at rest |
-| `HW`, `HH`, `CR` | tile half-width / half-height / corner radius |
-| `scl` squash values | the squash amount (scaleX↑ / scaleY↓) |
-| `bulge` `b` | cushion depth (how far the sides bow out) |
-| `FACE / FACE_GLINT` | wood face / glint flash |
-| `BORDER` | tile rim colour |
-| `BLACK / BLACK_LIT` | glyph / glyph-at-glint (brown-red) |
-| preview bg `#3C7858` | the green-baize colour used **only** in the GIF |

assets/vk/build/build-preview.js

@@ -1,31 +0,0 @@
-'use strict';
-const fs = require('fs');
-const data = fs.readFileSync(process.argv[2] || 'erudit.json', 'utf8');
-const lottiePath = __dirname + '/node_modules/lottie-web/build/player/lottie.min.js';
-const html = `<!doctype html><html><head><meta charset="utf8"><style>
-body{margin:0;background:#2b2b2b;font-family:sans-serif;color:#ccc}
-.row{display:flex;gap:18px;padding:18px;align-items:flex-end;flex-wrap:wrap}
-.cell{text-align:center}
-.chk{background-image:linear-gradient(45deg,#8a8a8a 25%,transparent 25%),linear-gradient(-45deg,#8a8a8a 25%,transparent 25%),linear-gradient(45deg,transparent 75%,#8a8a8a 75%),linear-gradient(-45deg,transparent 75%,#8a8a8a 75%);background-size:16px 16px;background-position:0 0,0 8px,8px -8px,-8px 0;background-color:#b5b5b5}
-.s96{width:96px;height:96px}.big{width:336px;height:336px}small{font-size:11px}
-</style></head><body><div class="row" id="row"></div>
-<script src="./lottie.min.js"></script>
-<script>
-const animationData=${data};window.AD=animationData;
-const row=document.getElementById('row');window.anims=[];
-function make(cls,frame,label){
-  const cell=document.createElement('div');cell.className='cell';
-  const box=document.createElement('div');box.className='chk '+cls;cell.appendChild(box);
-  cell.appendChild(document.createElement('br'));
-  const cap=document.createElement('small');cap.textContent=label;cell.appendChild(cap);
-  row.appendChild(cell);
-  const a=lottie.loadAnimation({container:box,renderer:'svg',loop:false,autoplay:false,animationData:JSON.parse(JSON.stringify(animationData))});
-  a.addEventListener('DOMLoaded',()=>a.goToAndStop(frame,true));
-  window.anims.push(a);
-}
-[0,22,45,68].forEach(f=>make('s96',f,'f'+f));
-make('big',22,'f22 x3.5');
-window.__ready=true;
-</script></body></html>`;
-fs.writeFileSync(process.argv[3] || 'preview.html', html);
-console.log('wrote', process.argv[3] || 'preview.html');

assets/vk/build/extract.js

@@ -1,67 +0,0 @@
-'use strict';
-// Extract the Cyrillic "Э" (U+042D) and the digit "8" outlines from a grotesque
-// font (LiberationSans = Arial-metric, matching the game's system-ui/Arial stack)
-// and emit Lottie cubic-bezier contours, centred at the origin, y-down.
-const opentype = require('opentype.js');
-const fs = require('fs');
-
-const FONT = process.argv[2] || '/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf';
-const b = fs.readFileSync(FONT);
-const font = opentype.parse(b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength));
-const FS = 1000; // em scale
-
-function glyphContours(ch) {
-  const p = font.charToGlyph(ch).getPath(0, 0, FS); // baseline at y=0, y-down
-  const contours = [];
-  let cur = null, prev = null;
-  for (const c of p.commands) {
-    if (c.type === 'M') {
-      if (cur) contours.push(cur);
-      cur = [{ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] }];
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'L') {
-      cur.push({ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'C') {
-      cur[cur.length - 1].o = [c.x1, c.y1];
-      cur.push({ v: [c.x, c.y], i: [c.x2, c.y2], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Q') {
-      const c1 = [prev.x + 2 / 3 * (c.x1 - prev.x), prev.y + 2 / 3 * (c.y1 - prev.y)];
-      const c2 = [c.x + 2 / 3 * (c.x1 - c.x), c.y + 2 / 3 * (c.y1 - c.y)];
-      cur[cur.length - 1].o = c1;
-      cur.push({ v: [c.x, c.y], i: c2, o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Z') {
-      if (cur && cur.length > 1) {
-        const last = cur[cur.length - 1], first = cur[0];
-        if (Math.hypot(last.v[0] - first.v[0], last.v[1] - first.v[1]) < 1e-3) {
-          first.i = last.i;            // fold the duplicate closing point into the first
-          cur.pop();
-        }
-      }
-      if (cur) { contours.push(cur); cur = null; }
-    }
-  }
-  if (cur) contours.push(cur);
-
-  let minx = Infinity, miny = Infinity, maxx = -Infinity, maxy = -Infinity;
-  const out = contours.map(ct => {
-    const v = [], i = [], o = [];
-    ct.forEach(pt => {
-      v.push(pt.v);
-      i.push([pt.i[0] - pt.v[0], pt.i[1] - pt.v[1]]);
-      o.push([pt.o[0] - pt.v[0], pt.o[1] - pt.v[1]]);
-      minx = Math.min(minx, pt.v[0]); maxx = Math.max(maxx, pt.v[0]);
-      miny = Math.min(miny, pt.v[1]); maxy = Math.max(maxy, pt.v[1]);
-    });
-    return { i, o, v, c: true };
-  });
-  return { contours: out, bbox: { x: minx, y: miny, w: maxx - minx, h: maxy - miny } };
-}
-
-const E = glyphContours('Э');
-const D8 = glyphContours('8');
-fs.writeFileSync('glyphs.json', JSON.stringify({ em: FS, E, D8 }));
-console.log('Э bbox', E.bbox, 'contours', E.contours.map(c => c.v.length));
-console.log('8 bbox', D8.bbox, 'contours', D8.contours.map(c => c.v.length));

assets/vk/build/generate.js

@@ -1,153 +0,0 @@
-'use strict';
-// VK preloader Lottie: a flat wooden Erudit tile ("Э" + score "8") that drops in
-// under gravity, squashes on impact (convex cushion bulging out the left/right edges
-// + a touch of skew), and springs back up — looping. A light "glint" is caught at the
-// moment of the bounce. Pure 2D shapes (ddd:0). Glyphs are real LiberationSans
-// outlines (Arial-metric, = the game's font stack); see extract.js -> glyphs.json.
-const fs = require('fs');
-const G = JSON.parse(fs.readFileSync(__dirname + '/glyphs.json', 'utf8'));
-
-// ---- canvas / timing -------------------------------------------------------
-const W = 96, H = 96, cx = 48;
-const FR = 30, OP = 34;                      // ~1.13 s loop (dynamic, 25% faster)
-// keyframe beats (frames): fast fall -> soft squash -> lift -> fast rise -> apex (no dwell)
-const T_HIT = 13, T_PEAK = 18, T_LIFT = 19, T_REC = 28;
-
-// ---- geometry --------------------------------------------------------------
-const HW = 26, HH = 26, CR = 6;              // tile half-width / half-height / corner radius
-const FLOOR = 90, APEX = 60;                 // bottom-centre screen-y at rest / at the top of the bounce
-
-// ---- palette ---------------------------------------------------------------
-const col = h => [parseInt(h.slice(1,3),16)/255, parseInt(h.slice(3,5),16)/255, parseInt(h.slice(5,7),16)/255];
-const FACE = col('#D9B978');                 // wood face (flat)
-const FACE_GLINT = col('#E7CD95');           // face flash caught on impact (gentle, not blinding)
-const BORDER = col('#B49559');               // tile rim: a touch darker than the face, reads on any bg
-const BLACK = col('#1A1A1A');
-const BLACK_LIT = col('#421A0B');            // glyph warms to brown-red on the glint
-const lerp = (a, b, t) => a.map((v, i) => v + (b[i] - v) * t);
-
-// ---- property / easing helpers ---------------------------------------------
-const still = v => ({ a: 0, k: v });
-const EI = { o: { x: [0.82], y: [0] }, i: { x: [1], y: [1] } };  // strong accelerate (gravity fall)
-const EO = { o: { x: [0], y: [0] }, i: { x: [0.18], y: [1] } };  // strong decelerate (rise to apex)
-const ES = { o: { x: [0.42], y: [0] }, i: { x: [0.58], y: [1] } }; // soft/slow (the cushion)
-function anim(samples) {                      // samples: {t, v, e?} ; e = easing toward the NEXT key
-  return { a: 1, k: samples.map((s, idx) => {
-    const kf = { t: s.t, s: s.v };
-    if (idx < samples.length - 1) { const e = s.e || ES; kf.o = e.o; kf.i = e.i; }
-    return kf;
-  }) };
-}
-const animColor = s => anim(s.map(x => ({ t: x.t, v: [...x.v, 1], e: x.e })));
-
-// ---- shape helpers ---------------------------------------------------------
-const tr = () => ({ ty: 'tr', p: still([0,0]), a: still([0,0]), s: still([100,100]), r: still(0), o: still(100) });
-const grp = (items, nm) => ({ ty: 'gr', it: [...items, tr()], nm });
-const fill = c => ({ ty: 'fl', c, o: still(100), r: 1, bm: 0 });
-const stroke = (c,w) => ({ ty: 'st', c: still(c), o: still(100), w: still(w), lc: 2, lj: 2, ml: 4, bm: 0 });
-function glyph(gd, hpx, px, py, bold, colour, nm) {  // font glyph -> filled+stroked group
-  const sc = hpx / gd.bbox.h;
-  const bcx = gd.bbox.x + gd.bbox.w / 2, bcy = gd.bbox.y + gd.bbox.h / 2;
-  const shapes = gd.contours.map(ct => ({
-    ty: 'sh', d: 1, ks: still({
-      i: ct.i.map(p => [p[0]*sc, p[1]*sc]), o: ct.o.map(p => [p[0]*sc, p[1]*sc]),
-      v: ct.v.map(p => [(p[0]-bcx)*sc + px, (p[1]-bcy)*sc + py]), c: true,
-    }),
-  }));
-  return grp([...shapes, fill(colour), stroke(BLACK, bold)], nm);
-}
-
-// Sample the rest rounded-rect outline (clockwise): fine corner arcs + one mid point
-// per straight edge, so a smooth interpolant reproduces it cleanly.
-function arc(ccx, ccy, a0, a1, n) {
-  const out = [];
-  for (let i = 0; i < n; i++) { const a = (a0 + (a1 - a0) * i / (n - 1)) * Math.PI / 180; out.push([ccx + CR*Math.cos(a), ccy + CR*Math.sin(a)]); }
-  return out;
-}
-const REST = (() => {
-  const NC = 7, yi = HH - CR, xi = HW - CR;
-  const C = [ arc(xi,-yi,-90,0,NC), arc(xi,yi,0,90,NC), arc(-xi,yi,90,180,NC), arc(-xi,-yi,180,270,NC) ];
-  const pts = [];
-  for (let k = 0; k < 4; k++) {
-    pts.push(...C[k]);
-    const a = C[k][NC-1], b = C[(k+1)%4][0];
-    pts.push([(a[0]+b[0])/2, (a[1]+b[1])/2]);   // straight-edge mid point (keeps the edge straight)
-  }
-  return pts;
-})();
-// The whole left/right contour (corners + side) bows out by one smooth barrel profile;
-// Catmull-Rom tangents (from neighbours) make every junction C1-smooth -> no kink, the
-// corners follow the cushion and the cushion melts into the corners, bulged or not.
-function facePath(b) {
-  const f = y => b * (1 - (y/HH) * (y/HH));                       // 0 at top/bottom, max at the middle
-  const V = REST.map(([x, y]) => [x + Math.sign(x) * f(y), y]);   // push the sides out, top/bottom stay
-  const n = V.length, I = [], O = [];
-  for (let k = 0; k < n; k++) {
-    const p0 = V[(k-1+n)%n], p1 = V[k], p2 = V[(k+1)%n];
-    let dx = p2[0]-p0[0], dy = p2[1]-p0[1];                       // tangent direction (neighbours)
-    const dl = Math.hypot(dx, dy) || 1; dx /= dl; dy /= dl;
-    const ln = Math.hypot(p2[0]-p1[0], p2[1]-p1[1]) / 3;          // handles ~ 1/3 of the adjacent chord
-    const lp = Math.hypot(p1[0]-p0[0], p1[1]-p0[1]) / 3;          // -> chordal spline, no overshoot/facets
-    O.push([dx*ln, dy*ln]); I.push([-dx*lp, -dy*lp]);
-  }
-  return { i: I, o: O, v: V, c: true };
-}
-const facePathKeys = samples => ({ a: 1, k: samples.map((s, idx) => {
-  const kf = { t: s.t, s: [facePath(s.b)] };
-  if (idx < samples.length - 1) { const e = s.e || ES; kf.o = e.o; kf.i = e.i; }
-  return kf;
-}) });
-
-// ---- animation tracks ------------------------------------------------------
-// bottom-centre screen-y (the tile rests/squashes on its bottom edge)
-const posY = anim([
-  { t: 0,      v: [cx, APEX, 0],  e: EI },           // apex -> immediately falls (no dwell)
-  { t: T_HIT,  v: [cx, FLOOR, 0], e: ES },           // FAST fall (accelerate) -> floor
-  { t: T_LIFT, v: [cx, FLOOR, 0], e: EO },           // sit on the floor while the cushion absorbs
-  { t: OP,     v: [cx, APEX, 0] },                   // FAST rise (decelerate) -> apex = loop start
-]);
-// scale about the bottom anchor: stretch while falling, gentle/slow cushion squash on impact
-const scl = anim([
-  { t: 0,        v: [100, 100, 100], e: ES },
-  { t: T_HIT-5,  v: [95, 106, 100], e: ES },         // stretch while falling fast
-  { t: T_HIT,    v: [104, 95, 100], e: ES },         // touch down
-  { t: T_PEAK,   v: [112, 86, 100], e: ES },         // soft squash peak (gentler, less plче)
-  { t: T_REC,    v: [100, 100, 100], e: ES },        // slow cushion release -> soft landing
-  { t: OP,       v: [100, 100, 100] },
-]);
-// a touch of skew through the squash (organic deform), back to 0
-const skw = anim([
-  { t: T_HIT, v: [0], e: ES }, { t: T_PEAK, v: [4], e: ES }, { t: T_REC, v: [0] }, { t: OP, v: [0] },
-]);
-// left/right cushion bulge: 0 -> gentle peak -> 0 (never inward)
-const bulge = facePathKeys([
-  { t: T_HIT, b: 0, e: ES }, { t: T_PEAK, b: 4, e: ES }, { t: T_REC, b: 0 }, { t: OP, b: 0 },
-]);
-// glint: face + glyph catch the light at the bounce
-const faceCol = animColor([
-  { t: T_HIT-2, v: FACE, e: ES }, { t: T_PEAK, v: FACE_GLINT, e: ES }, { t: T_REC, v: FACE }, { t: OP, v: FACE },
-]);
-const glyphCol = animColor([
-  { t: T_HIT-2, v: BLACK, e: ES }, { t: T_PEAK, v: BLACK_LIT, e: ES }, { t: T_REC, v: BLACK }, { t: OP, v: BLACK },
-]);
-
-// ---- layer (face + glyphs share the bounce/squash transform) ---------------
-const faceShape = grp([ { ty: 'sh', d: 1, ks: bulge }, fill(faceCol), stroke(BORDER, 1.8) ], 'face');
-const glyphE = glyph(G.E,  32, 0, -1, 1.0, glyphCol, 'E');                 // centred Э
-const glyph8 = glyph(G.D8, 8.5, HW-6.5, HH-7.5, 0.5, glyphCol, 'score');   // 8 in the corner
-
-const tile = {
-  ddd: 0, ind: 1, ty: 4, nm: 'tile', sr: 1,
-  ks: { o: still(100), r: still(0), p: posY, a: still([0, HH, 0]), s: scl, sk: skw, sa: still(0) },
-  ao: 0, shapes: [ glyph8, glyphE, faceShape ], ip: 0, op: OP, st: 0, bm: 0,
-};
-
-const root = {
-  v: '5.7.4', fr: FR, ip: 0, op: OP, w: W, h: H, nm: 'erudit-vk-loader', ddd: 0,
-  assets: [], layers: [ tile ], markers: [],
-};
-
-const out = process.argv[2] || 'erudit.json';
-const round = (k, v) => (typeof v === 'number' ? Math.round(v * 100) / 100 : v);
-fs.writeFileSync(out, JSON.stringify(root, round));
-console.log('wrote', out, fs.statSync(out).size, 'bytes');

backend/Dockerfile

@@ -7,14 +7,12 @@
 # (GOPRIVATE), so the build stage needs git and network.
 #
 # Build from the repository root so go.work, go.work.sum, pkg/ and backend/ are all
-# in the Docker context. DICT_VERSION has no default — the caller supplies the
-# scrabble-dictionary release tag (compose/CI pass it; see deploy/README.md
-# "Bumping the dictionary version"):
-#   docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .
+# in the Docker context:
+#   docker build -f backend/Dockerfile -t scrabble-backend .
 
 # --- dictionary artifact -----------------------------------------------------
 FROM alpine:3.20 AS dawg
-ARG DICT_VERSION
+ARG DICT_VERSION=v1.2.1
 RUN apk add --no-cache curl tar
 RUN mkdir -p /dawg \
  && curl -fsSL -o /tmp/dawg.tar.gz \
@@ -44,19 +42,14 @@ FROM gcr.io/distroless/static-debian12:nonroot
 # Re-declare the build arg in this stage so it labels the seed dictionary. One
 # DICT_VERSION drives both the artifact the dawg stage downloads and the version
 # label the binary pins, so the resident version equals the release tag.
-ARG DICT_VERSION
+ARG DICT_VERSION=v1.2.1
 COPY --from=build /out/backend /usr/local/bin/backend
 # Own the seed dictionary as the nonroot runtime user (UID 65532): a named volume
 # mounted at /opt/dawg inherits this ownership on first use, so the admin console
 # can write new version subdirectories at runtime. The volume preserves uploaded
-# versions across deploys and, once seeded, is not re-seeded (ARCHITECTURE.md §5).
+# versions across deploys and, once seeded, is not re-seeded — so after bootstrap
+# every dictionary change goes through the console, not a rebuild (ARCHITECTURE.md §5).
 COPY --from=dawg --chown=65532:65532 /dawg /opt/dawg
-# A second, UNSHADOWED copy of the build's DAWGs: the /opt/dawg volume mount hides the
-# image's copy there, so this is where engine.DeliverVersion reads the build version from
-# to add it (add-only) to the volume on boot — the deploy-delivers path that lets a bumped
-# BACKEND_DICT_VERSION go live for new games without an admin upload (ARCHITECTURE.md §5).
-COPY --from=dawg --chown=65532:65532 /dawg /opt/dawg-seed
 ENV BACKEND_DICT_DIR=/opt/dawg
-ENV BACKEND_DICT_SEED_DIR=/opt/dawg-seed
 ENV BACKEND_DICT_VERSION=${DICT_VERSION}
 ENTRYPOINT ["/usr/local/bin/backend"]

backend/README.md

@@ -33,25 +33,18 @@ real game seating the caller with an **empty opponent seat** (status `open`) or,
 another player already waits for the same variant and per-turn word rule, seats the
 caller into that open game and starts it — and
 friend-game invitations (invite → accept, starting a 2–4 player game once every
-invitee accepts). **Per-tier, per-kind active-game caps** limit a player's simultaneous
-unfinished games by kind — `vs_ai`, `random` (quick auto-match), `friends` — with separate
-guest and durable-account tiers held in the single-row `backend.config` table (a `-1` means
-unlimited), read through an in-memory cache (`internal/gamelimits`) and tuned live in the admin
-(`/_gm/limits`, no redeploy). Each game is tagged with its `games.game_kind` on creation;
-`game.Service.AtGameLimit` counts the account's `active`/`open` games of a kind against the
-tier's cap. The server refuses `lobby/enqueue` (random/vs_ai) with **409 `game_limit_reached`**
-at the cap, and the `invitations` (friends) path enforces the durable friends cap and refuses a
-**guest** outright (guests cannot use friends); accepting an invitation is exempt. The
-`games.list` response carries an `at_game_limit` flag (the random-kind cap) for the lobby.
+invitee accepts). A **simultaneous-game cap** (`game.MaxActiveQuickGames` = 10) limits a
+player's active quick games — status `active`/`open`, excluding invitation-linked friend
+games (`game.Service.CountActiveQuickGames`); the server refuses `lobby/enqueue` and
+`invitations` creation with **409 `game_limit_reached`** at the cap (accepting an invitation
+is exempt), and the `games.list` response carries an `at_game_limit` flag for the lobby.
 `internal/social` owns the friend graph (request/accept),
 per-user blocks, and per-game chat with nudges folded in as a message kind; chat
 messages are length-capped, content-filtered (no links/emails/phone numbers,
 including obfuscated forms) and stored with the sender's IP. Each message carries an
 `unread_seats` read bitmask (a set bit per recipient seat still to read it); `MarkRead`
-clears a reader's bit when they open the move history or chat, a wired `NudgeClearer`
-clears a nudge when its recipient moves, and a wired `NudgeExpirer` clears **all** of a game's
-nudges when it finishes (any completion path) — the first two record the publish-to-read latency,
-the completion expiry does not (it is not a read); chat messages stay unread on completion.
+clears a reader's bit when they open the move history or chat, and a wired `NudgeClearer`
+clears a nudge when its recipient moves — both record the publish-to-read latency.
 A friend request (or block) aimed at a **disguised pooled robot** is recorded per game+seat
 in `robot_friend_requests` / `robot_blocks`, never against the shared robot account; a
 background reaper drops a robot friend request once its game has been finished for **7 days**.
@@ -105,10 +98,7 @@ state, lobby enqueue, chat). The social/account/history operations under
 `/api/v1/user`: `friends/*` (request/respond/cancel/unfriend,
 list/incoming, the one-time `code` issue/redeem), `blocks/*`, `invitations/*`
 (create/accept/decline/cancel/list), `PUT profile`, `email/{request,confirm}`,
-`stats`, `games/:id/gcg` (finished-only), and the payments `wallet` /
-`wallet/catalog` (`GET` — the context-visible chip segments + benefits, and the
-storefront catalog) / `wallet/buy` (`POST` — a chip spend on a value), served by
-`internal/payments` behind the store-compliance gate. The `internal/notify` hub feeds a
+`stats`, and `games/:id/gcg` (finished-only). The `internal/notify` hub feeds a
 second listener — `internal/pushgrpc`, a gRPC server (`BACKEND_GRPC_ADDR`) streaming
 live events (your-turn, opponent-moved, chat, nudge, match-found, notify) to the
 gateway. The gateway-only `POST /api/v1/internal/push-target` (a user's
@@ -140,38 +130,21 @@ so `/internal/push-target` returns the recipient's `preferred_language` as the r
 language for out-of-app push; no per-bot routing remains. The console also manages the **advertising banner** (`/_gm/banners` +
 `/_gm/banner-settings`, `internal/ads`): operator campaigns with a percent weight, an optional
 window and bilingual messages, plus the global display timings. `GET /api/v1/user/profile` attaches
-the resolved, weighted campaign feed for an **eligible** viewer (no active **no-ads** benefit
-applicable in the current context and no **`no_banner`** role; the message language picked by
-`preferred_language`); changing those inputs
-publishes a `notify` `banner` re-poll signal so the client shows/hides it in place.
-The same gate drives the post-move interstitial config (`Profile.ads`, `adsFor`). The user card
-also carries a **finance panel** (`payments.AccountStatement`): the account's chip balances per
-funding segment, benefits per origin, the recorded refund risk, and the append-only ledger history
-(newest first) — read straight from the payments tables, uncached. The **catalog editor**
-(`/_gm/catalog`, `handlers_admin_catalog.go`) is the source of truth for products (D32): create /
-edit / archive-unarchive (the `product.active` flag) products, their atoms and per-rail prices, and
-hard-delete only a **never-transacted** product (an order/ledger reference forces archive-only,
-backed by the FK); a `tournament`-bearing product is composable but not sellable yet. The user card
-also carries an admin **grant** panel: grant raw benefit atoms (hints / no-ads days / forever) or a
-defined **value product** (a reward bundle, including an archived one), origin-picked; both write an
-`admin_grant` ledger row via `payments.Grant` / `GrantProduct` and **refuse** a chips or `tournament`
-atom (never grant currency; no tournament target yet). Each fund row in the panel carries a **Refund**
-action (`payments.RefundOrderFull`): a full-order refund the operator records after refunding on the
-rail — a `refund` ledger row + a floor-0 chip revoke, idempotent. A **ledger CSV export**
-(`/_gm/ledger.csv`, `payments.LedgerExport`) dumps the whole append-only ledger for tax +
-reconciliation. The shared wire
+the resolved, weighted campaign feed for an **eligible** viewer (`!paid_account && hint_balance == 0
+&& !no_banner` role, the message language picked by `preferred_language`); changing those inputs
+publishes a `notify` `banner` re-poll signal so the client shows/hides it in place. The shared wire
 contracts live in the sibling [`../pkg`](../pkg) module.
 
 **Account linking & merge** (`/api/v1/user/link/*`). `internal/link`
 orchestrates it: an email confirm-code or a gateway-validated Telegram identity is
 attached to the current account, and when the identity already has its own account
-the two are merged in one transaction (`internal/accountmerge`) — stats summed,
-identities/games/chat/complaints transferred,
+the two are merged in one transaction (`internal/accountmerge`) — stats and the hint
+wallet summed, `paid_account` ORed, identities/games/chat/complaints transferred,
 friends/blocks de-duplicated, the secondary kept as a `merged_into` tombstone (so a
 shared finished game's foreign keys hold); a shared **active** game blocks the merge.
 The current account is primary, except a guest initiator whose linked identity has a
 durable owner — then the durable account wins and a fresh session is minted for it.
-The `accounts.merged_into`/`merged_at` columns back this. This supersedes the
+The `accounts.paid_account`/`merged_into`/`merged_at` columns back this. This supersedes the
 former `email.bind.*` edge surface (the `RequestCode`/`ConfirmCode` primitives stay).
 
 Rate-limit observability: the gateway posts its periodic rejection
@@ -239,13 +212,11 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 | `BACKEND_LOBBY_ROBOT_WAIT` | `10s` | Auto-match wait before a robot is substituted for a missing human. |
 | `BACKEND_LOBBY_REAPER_INTERVAL` | `1s` | How often the substitution reaper scans for over-waited players. |
 | `BACKEND_ROBOT_DRIVE_INTERVAL` | `30s` | How often the robot driver scans for due robot turns. |
-| `BACKEND_SMTP_HOST` | — | Confirm-code relay host. **Empty selects the development log mailer** (the code is logged, not sent). |
-| `BACKEND_SMTP_PORT` | `587` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
-| `BACKEND_SMTP_TLS` | — | Transport security: `ssl` (implicit TLS from connect) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); set it for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
-| `BACKEND_SMTP_USERNAME` | — | SMTP AUTH user; empty relays without authentication. |
-| `BACKEND_SMTP_PASSWORD` | — | SMTP AUTH password. |
-| `BACKEND_SMTP_FROM` | `no-reply@localhost` | From address. A deployed contour must use the prod domain (the relay only accepts its verified sender domain). |
-| `BACKEND_PUBLIC_BASE_URL` | — | Canonical public origin (scheme + host) for links in the email. **Required when `BACKEND_SMTP_HOST` is set.** Never derived from a request Host header (anti-injection). |
+| `BACKEND_SMTP_HOST` | — | Email relay host. **Empty selects the development log mailer** (the confirm-code is logged, not sent). |
+| `BACKEND_SMTP_PORT` | `587` | Email relay port. |
+| `BACKEND_SMTP_USERNAME` | — | SMTP user; empty relays without authentication. |
+| `BACKEND_SMTP_PASSWORD` | — | SMTP password. |
+| `BACKEND_SMTP_FROM` | `no-reply@localhost` | Envelope/From address for confirm-codes. |
 | `BACKEND_CONNECTOR_ADDR` | — | the gateway bot-link relay gRPC address for admin-console operator broadcasts. Empty disables broadcasts. |
 | `BACKEND_GUEST_REAP_INTERVAL` | `1h` | How often the abandoned-guest reaper sweeps. |
 | `BACKEND_GUEST_RETENTION` | `720h` | Account age past which a guest with no game seat is deleted. |
@@ -257,7 +228,7 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 ```sh
 docker run -d --name scrabble-pg -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres:17-alpine
 # DAWGs: extract the dictionary release artifact (or point at a local scrabble-solver/dawg):
-mkdir -p /tmp/dawg && curl -fsSL https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/v1.3.0/scrabble-dawg-v1.3.0.tar.gz | tar xz -C /tmp/dawg
+mkdir -p /tmp/dawg && curl -fsSL https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/v1.2.1/scrabble-dawg-v1.2.1.tar.gz | tar xz -C /tmp/dawg
 BACKEND_POSTGRES_DSN='postgres://postgres:dev@localhost:5432/postgres?search_path=backend&sslmode=disable' \
   BACKEND_DICT_DIR=/tmp/dawg \
   GOPRIVATE='gitea.iliadenisov.ru/*' \

backend/cmd/backend/main.go

@@ -3,8 +3,8 @@
 // loads the dictionaries into the engine registry, warms the session cache,
 // constructs the game domain and starts its turn-timeout sweeper, constructs the
 // lobby and social domains, then serves the HTTP listener with the infrastructure
-// probes and the /api/v1 route group, behind which the domains expose their HTTP
-// endpoints to the gateway.
+// probes and the /api/v1 route-group skeleton. Domain HTTP endpoints are added
+// with the gateway in a later stage described in PLAN.md.
 package main
 
 import (
@@ -20,7 +20,6 @@ import (
 
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/accountmerge"
-	"scrabble/backend/internal/adminalert"
 	"scrabble/backend/internal/ads"
 	"scrabble/backend/internal/banview"
 	"scrabble/backend/internal/config"
@@ -28,15 +27,12 @@ import (
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/feedback"
 	"scrabble/backend/internal/game"
-	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/link"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/notify"
-	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/pushgrpc"
 	"scrabble/backend/internal/ratewatch"
-	"scrabble/backend/internal/render"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/server"
 	"scrabble/backend/internal/session"
@@ -47,10 +43,6 @@ import (
 // telemetryShutdownTimeout bounds the OpenTelemetry flush during process exit.
 const telemetryShutdownTimeout = 5 * time.Second
 
-// adminAlertInterval is how often the operator-alert worker checks for new feedback /
-// complaints; a burst within one interval coalesces into a single digest email.
-const adminAlertInterval = 5 * time.Minute
-
 func main() {
 	cfg, err := config.Load()
 	if err != nil {
@@ -111,12 +103,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	}
 	logger.Info("database migrations applied")
 
-	// Deliver the build's dictionary version onto the persistent volume if a redeploy
-	// bumped it (add-only; old versions in-flight games pin are untouched), so the new
-	// dictionary is resident and can be activated below without an admin upload.
-	if err := engine.DeliverVersion(cfg.Game.DictDir, cfg.Game.DictSeedDir, cfg.Game.DictVersion); err != nil {
-		return fmt.Errorf("deliver dictionary version: %w", err)
-	}
 	registry, err := engine.OpenWithVersions(cfg.Game.DictDir, cfg.Game.DictVersion)
 	if err != nil {
 		return fmt.Errorf("load dictionaries: %w", err)
@@ -124,7 +110,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	defer func() { _ = registry.Close() }()
 	logger.Info("dictionaries loaded",
 		zap.String("dir", cfg.Game.DictDir),
-		zap.String("seed_dir", cfg.Game.DictSeedDir),
 		zap.String("version", cfg.Game.DictVersion))
 
 	// Admin console: an optional backend client to the Telegram connector
@@ -154,27 +139,16 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	accounts := account.NewStore(db)
 	accounts.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/account"))
 	games := game.NewService(game.NewStore(db), accounts, registry, cfg.Game, logger)
-	// Reconcile the active dictionary version with the registry: the build version
-	// (delivered above) becomes active so a redeploy that bumped it goes live for new
-	// games, except a newer version installed out-of-band through the admin console,
-	// which is not downgraded by a restart (docs/ARCHITECTURE.md §5).
+	// Reconcile the persisted active dictionary version with the registry: a
+	// version activated through the admin console (and written to the dictionary
+	// volume) is adopted again after a restart; otherwise the configured seed
+	// version is kept and persisted (docs/ARCHITECTURE.md §5).
 	if err := games.InitActiveVersion(ctx); err != nil {
 		return fmt.Errorf("init active dictionary version: %w", err)
 	}
 	logger.Info("active dictionary version", zap.String("version", games.ActiveVersion()))
 	games.SetNotifier(hub)
 	games.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/game"))
-
-	// Active-game limit config: the per-tier, per-kind caps in backend.config, read once into an
-	// in-memory cache at boot and refreshed when the admin edits them. A boot-time load fails fast if
-	// the single config row is missing; the game domain reads the cache on every new-game gate.
-	gameLimits := gamelimits.NewService(gamelimits.NewStore(db))
-	if err := gameLimits.Load(ctx); err != nil {
-		return fmt.Errorf("load game-limit config: %w", err)
-	}
-	games.SetGameLimits(gameLimits)
-	logger.Info("game-limit config loaded")
-
 	go games.RunSweeper(ctx, cfg.Game.TimeoutSweepInterval)
 	logger.Info("game turn-timeout sweeper started",
 		zap.Duration("interval", cfg.Game.TimeoutSweepInterval))
@@ -187,15 +161,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.Duration("interval", cfg.GuestReapInterval),
 		zap.Duration("retention", cfg.GuestRetention))
 
-	// Purge the account-deletion legal dossier past its retention TTL: the
-	// retained-identities journal, and the feedback thread + dossier PII of long-deleted
-	// accounts (chat is kept). Checked daily; the TTL is a two-year policy constant.
-	retentionReaper := account.NewRetentionReaper(accounts, account.RetentionTTL, logger)
-	go retentionReaper.Run(ctx, 24*time.Hour)
-	logger.Info("retention reaper started",
-		zap.Duration("interval", 24*time.Hour),
-		zap.Duration("retention", account.RetentionTTL))
-
 	// Re-evaluate moderated-chat write access when a temporary block self-expires:
 	// no operator action fires then, so the sweeper emits the chat-access-changed
 	// event for lapsed blocks and the gateway re-pushes the chat-gate command.
@@ -208,21 +173,15 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// Lobby & social domains. Their REST and stream surface lives in the gateway,
 	// so they are handed to the server (like the route groups) for the handlers.
 	mailer := newMailer(cfg.SMTP, logger)
-	emails := account.NewEmailService(accounts, mailer, cfg.PublicBaseURL)
-	// Throttle confirm-code sends per recipient: at most one per minute and five per
-	// rolling hour, guarding against email bombing and the relay's own quota.
-	emails.SetSendLimiter(account.NewSendLimiter(time.Minute, 5))
+	emails := account.NewEmailService(accounts, mailer)
 	// Account linking & merge: the orchestrator over the account, merge and
 	// session layers. Wired to the /api/v1/user/link REST surface below.
-	merger := accountmerge.NewMerger(db)
-	links := link.NewService(emails, accounts, merger, sessions)
+	links := link.NewService(emails, accounts, accountmerge.NewMerger(db), sessions)
 	socialSvc := social.NewService(social.NewStore(db), accounts, games)
 	socialSvc.SetNotifier(hub)
 	socialSvc.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/social"))
-	// A nudge the recipient answered by moving is marked read on the move path; every nudge in a
-	// game is marked read when the game finishes (a stale badge), on any completion path.
+	// A nudge the recipient answered by moving is marked read on the move path.
 	games.SetNudgeClearer(socialSvc.ClearNudges)
-	games.SetNudgeExpirer(socialSvc.ExpireNudges)
 	// Reap per-game disguised-robot friend requests once their game is long finished
 	// (the robot ignores them; the row only pins the in-game "request sent" state).
 	robotReqReaper := social.NewRobotFriendRequestReaper(socialSvc, logger)
@@ -233,16 +192,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	feedbackSvc := feedback.NewService(feedback.NewStore(db), accounts)
 	feedbackSvc.SetNotifier(hub)
 
-	// Operator alert emails on new feedback / word complaints, coalesced into one digest
-	// per interval. Inert unless a distinct admin sender and recipient are configured.
-	if cfg.SMTP.AdminFrom != "" && cfg.SMTP.AdminTo != "" {
-		// The alert digest carries no admin-console link on purpose — an admin URL must not
-		// travel in an email (a mail provider could cache or index it); see adminalert.New.
-		alerts := adminalert.New(mailer, feedbackSvc, games, cfg.SMTP.AdminFrom, cfg.SMTP.AdminTo, logger)
-		go alerts.Run(ctx, adminAlertInterval)
-		logger.Info("admin alert worker started", zap.Duration("interval", adminAlertInterval))
-	}
-
 	// Robot opponent: provision its durable account pool (a hard startup
 	// dependency, like the dictionaries) and start its move driver. The matchmaker
 	// substitutes a pooled robot for a missing human after the wait window.
@@ -281,35 +230,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// block and the banner admin console section.
 	adsSvc := ads.NewService(ads.NewStore(db))
 
-	// In-game currency domain (data foundation): the payments schema behind a
-	// narrow interface. A boot-time reachability check fails fast if the schema
-	// did not migrate; the wallet routes are registered when that surface lands.
-	paymentsSvc := payments.NewService(payments.NewStore(db))
-	if err := paymentsSvc.Ping(ctx); err != nil {
-		return fmt.Errorf("payments schema unreachable: %w", err)
-	}
-	logger.Info("payments domain ready")
-
-	// Warm the public-offer price list cache so /offer/ serves the current catalog from the first
-	// request; it is reprojected lazily thereafter on any catalog edit. Non-fatal — a transient
-	// failure here only defers the projection to the first read.
-	if _, err := paymentsSvc.OfferPricing(ctx); err != nil {
-		logger.Warn("offer pricing warm failed; will project on first request", zap.Error(err))
-	}
-
-	// Wire the payments surface into the domains that consume it: the online-game hint wallet
-	// and the account-merge wallet fold. Done after the reachability check so a broken payments
-	// schema fails boot before anything depends on it.
-	games.SetHintWallet(paymentsSvc)
-	merger.SetPayments(paymentsSvc)
-
-	// The image-render sidecar client for the PNG export artifact; nil (PNG
-	// download answers 404) when BACKEND_RENDERER_URL is unset.
-	var renderer *render.Client
-	if cfg.RendererURL != "" {
-		renderer = render.New(cfg.RendererURL)
-	}
-
 	srv := server.New(cfg.HTTPAddr, server.Deps{
 		Logger:        logger,
 		DB:            db,
@@ -330,12 +250,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		RateWatch:     rateWatch,
 		BanView:       banView,
 		Ads:           adsSvc,
-		Payments:      paymentsSvc,
-		GameLimits:    gameLimits,
 		Notifier:      hub,
-		ExportSignKey: cfg.ExportSignKey,
-		Renderer:      renderer,
-		Robokassa:     cfg.Robokassa,
 	})
 	pushSrv := pushgrpc.NewServer(cfg.GRPCAddr, hub, logger)
 
@@ -344,13 +259,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	logger.Info("servers starting",
 		zap.String("http_addr", cfg.HTTPAddr),
 		zap.String("grpc_addr", cfg.GRPCAddr))
-	// Sweep expired pending payment orders on a cadence (cosmetic hygiene; a late valid callback
-	// still credits). Runs until ctx is cancelled.
-	go runOrderReaper(ctx, paymentsSvc, logger)
-	// Deliver pending payment_events to connected clients as an in-app wallet-refresh push (the
-	// credit already landed in the ledger; a return-focus poll is the client-side fallback).
-	go runPaymentDispatcher(ctx, paymentsSvc, hub, logger)
-
 	errc := make(chan error, 2)
 	go func() { errc <- pushSrv.Run(ctx) }()
 	go func() { errc <- srv.Run(ctx) }()
@@ -360,52 +268,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	return err
 }
 
-// runOrderReaper periodically expires pending payment orders past their configured lifetime, until
-// ctx is cancelled. Expiry is cosmetic: a later valid provider callback still credits an expired
-// order.
-func runOrderReaper(ctx context.Context, p *payments.Service, log *zap.Logger) {
-	t := time.NewTicker(5 * time.Minute)
-	defer t.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			if n, err := p.ExpireOrders(ctx); err != nil {
-				log.Warn("order reaper: sweep failed", zap.Error(err))
-			} else if n > 0 {
-				log.Info("order reaper: expired pending orders", zap.Int("count", n))
-			}
-		}
-	}
-}
-
-// runPaymentDispatcher delivers pending payment_events to connected clients as a wallet-refresh
-// signal (KindNotification / "payment"), marking each delivered, until ctx is cancelled. The credit
-// already committed to the ledger; this is only the in-app push so an open wallet updates in place.
-func runPaymentDispatcher(ctx context.Context, p *payments.Service, pub notify.Publisher, log *zap.Logger) {
-	t := time.NewTicker(3 * time.Second)
-	defer t.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			evs, err := p.UndispatchedEvents(ctx, 50)
-			if err != nil {
-				log.Warn("payment dispatcher: read failed", zap.Error(err))
-				continue
-			}
-			for _, e := range evs {
-				pub.Publish(notify.Notification(e.AccountID, notify.NotifyPayment))
-				if err := p.MarkEventDispatched(ctx, e.EventID); err != nil {
-					log.Warn("payment dispatcher: mark failed", zap.String("event", e.EventID.String()), zap.Error(err))
-				}
-			}
-		}
-	}
-}
-
 // newMailer builds the confirm-code mailer: an SMTP relay when a host is
 // configured, otherwise the development log mailer (the code is logged, not sent).
 func newMailer(cfg account.SMTPConfig, logger *zap.Logger) account.Mailer {

backend/cmd/dictgen/main.go

@@ -1,193 +0,0 @@
-// Command dictgen dumps golden parity vectors from the committed dawg
-// dictionaries so the TypeScript dawg reader can be checked byte-for-byte
-// against the authoritative Go dafsa reader.
-//
-// For each *.dawg file it writes, into the output directory:
-//
-//   - <name>.words.bin — every stored word as alphabet-index bytes, in index
-//     order, framed as [1-byte length][length index bytes]. The word at stream
-//     position k has IndexOfB == k.
-//   - <name>.neg.bin — negative lookups (sequences whose IndexOfB is -1), same
-//     framing, to exercise the not-found path at varying depths.
-//   - <name>.meta.json — NumAdded/NumNodes/NumEdges plus the alphabet size, for
-//     a header-parse sanity cross-check on the TS side.
-//
-// It is a development tool (not built into any service), analogous to
-// cmd/jetgen. Run it from the repository root:
-//
-//	go run ./backend/cmd/dictgen -dawg-dir ../scrabble-solver/dawg -out <dir>
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"math/rand"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// meta is the per-dictionary sanity payload cross-checked by the TS reader.
-type meta struct {
-	NumAdded int `json:"numAdded"`
-	NumNodes int `json:"numNodes"`
-	NumEdges int `json:"numEdges"`
-	Alphabet int `json:"alphabet"`
-}
-
-func main() {
-	dawgDir := flag.String("dawg-dir", "../scrabble-solver/dawg", "directory holding the .dawg files")
-	outDir := flag.String("out", "", "output directory for the golden files (required)")
-	negCount := flag.Int("neg", 20000, "number of negative lookups to emit per dictionary")
-	flag.Parse()
-
-	if *outDir == "" {
-		fail("-out is required")
-	}
-	if err := os.MkdirAll(*outDir, 0o755); err != nil {
-		fail("mkdir out: %v", err)
-	}
-
-	files, err := filepath.Glob(filepath.Join(*dawgDir, "*.dawg"))
-	if err != nil {
-		fail("glob: %v", err)
-	}
-	sort.Strings(files)
-	if len(files) == 0 {
-		fail("no .dawg files in %s", *dawgDir)
-	}
-
-	for _, f := range files {
-		if err := process(f, *outDir, *negCount); err != nil {
-			fail("%s: %v", filepath.Base(f), err)
-		}
-	}
-}
-
-// process emits the golden files for a single dawg dictionary.
-func process(path, outDir string, negCount int) error {
-	name := strings.TrimSuffix(filepath.Base(path), ".dawg")
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-	finder, err := dawg.Read(bytes.NewReader(data), 0)
-	if err != nil {
-		return fmt.Errorf("read dawg: %w", err)
-	}
-	defer finder.Close()
-
-	// Stream every stored word in index order; keep a decimated sample and the
-	// maximum alphabet index for negative generation.
-	wf, err := os.Create(filepath.Join(outDir, name+".words.bin"))
-	if err != nil {
-		return err
-	}
-	bw := bufio.NewWriter(wf)
-
-	var (
-		count  int
-		maxIx  byte
-		sample [][]byte
-	)
-	finder.EnumerateB(func(index int, word []byte, final bool) int {
-		if !final {
-			return 0 // Continue
-		}
-		if index != count {
-			panic(fmt.Sprintf("%s: enumerate index gap: got %d want %d", name, index, count))
-		}
-		writeWord(bw, word)
-		for _, b := range word {
-			if b > maxIx {
-				maxIx = b
-			}
-		}
-		if count%4 == 0 && len(sample) < 60000 {
-			sample = append(sample, append([]byte(nil), word...))
-		}
-		count++
-		return 0 // Continue
-	})
-	if err := bw.Flush(); err != nil {
-		return err
-	}
-	if err := wf.Close(); err != nil {
-		return err
-	}
-	if count != finder.NumAdded() {
-		return fmt.Errorf("word count %d != NumAdded %d", count, finder.NumAdded())
-	}
-
-	alphabet := int(maxIx) + 1
-
-	// Negatives: mutate sampled real words and keep the ones the reader rejects.
-	nf, err := os.Create(filepath.Join(outDir, name+".neg.bin"))
-	if err != nil {
-		return err
-	}
-	nbw := bufio.NewWriter(nf)
-	rng := rand.New(rand.NewSource(1))
-	neg := 0
-	for neg < negCount && len(sample) > 0 {
-		base := sample[rng.Intn(len(sample))]
-		cand := append([]byte(nil), base...)
-		switch rng.Intn(3) {
-		case 0: // extend by one index
-			cand = append(cand, byte(rng.Intn(alphabet)))
-		case 1: // flip one index
-			if len(cand) > 0 {
-				cand[rng.Intn(len(cand))] = byte(rng.Intn(alphabet))
-			}
-		case 2: // drop the tail and flip the new last index
-			if len(cand) > 1 {
-				cand = cand[:len(cand)-1]
-				cand[len(cand)-1] = byte(rng.Intn(alphabet))
-			}
-		}
-		if finder.IndexOfB(cand) == -1 {
-			writeWord(nbw, cand)
-			neg++
-		}
-	}
-	if err := nbw.Flush(); err != nil {
-		return err
-	}
-	if err := nf.Close(); err != nil {
-		return err
-	}
-
-	m := meta{NumAdded: finder.NumAdded(), NumNodes: finder.NumNodes(), NumEdges: finder.NumEdges(), Alphabet: alphabet}
-	mb, err := json.MarshalIndent(m, "", "  ")
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(outDir, name+".meta.json"), mb, 0o644); err != nil {
-		return err
-	}
-
-	fmt.Printf("%-12s words=%d negatives=%d alphabet=%d nodes=%d edges=%d\n",
-		name, count, neg, alphabet, finder.NumNodes(), finder.NumEdges())
-	return nil
-}
-
-// writeWord frames one index-byte word as [length][bytes].
-func writeWord(w *bufio.Writer, word []byte) {
-	if len(word) > 255 {
-		panic(fmt.Sprintf("word too long to frame: %d", len(word)))
-	}
-	w.WriteByte(byte(len(word)))
-	w.Write(word)
-}
-
-func fail(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, "dictgen: "+format+"\n", args...)
-	os.Exit(1)
-}

backend/cmd/jetgen/main.go

@@ -9,8 +9,7 @@
 //  1. start a postgres:17-alpine container via testcontainers-go
 //  2. open it with search_path=backend and apply the embedded goose migrations
 //  3. drop goose's bookkeeping table so jet does not generate a model for it
-//  4. run jet's PostgreSQL generator for the backend and payments schemas into
-//     internal/postgres/jet (one subdirectory per schema)
+//  4. run jet's PostgreSQL generator for schema=backend into internal/postgres/jet
 package main
 
 import (
@@ -37,7 +36,6 @@ const (
 	superuserPassword  = "scrabble"
 	superuserDatabase  = "scrabble_backend"
 	backendSchema      = "backend"
-	paymentsSchema     = "payments"
 	containerStartup   = 90 * time.Second
 	jetOutputDirSuffix = "internal/postgres/jet"
 )
@@ -107,16 +105,11 @@ func run(ctx context.Context) error {
 		return fmt.Errorf("drop goose_db_version: %w", err)
 	}
 
-	// Each schema generates into its own jet/<schema>/ subdirectory (the
-	// generator wipes only that subtree), so the two calls do not clobber each
-	// other. GenerateDB takes the schema explicitly, so the connection's
-	// search_path=backend does not affect the payments introspection.
-	for _, schema := range []string{backendSchema, paymentsSchema} {
-		if err := jetpostgres.GenerateDB(db, schema, outputDir); err != nil {
-			return fmt.Errorf("jet generate schema=%s: %w", schema, err)
-		}
-		log.Printf("jetgen: generated jet code into %s (schema=%s)", outputDir, schema)
+	if err := jetpostgres.GenerateDB(db, backendSchema, outputDir); err != nil {
+		return fmt.Errorf("jet generate: %w", err)
 	}
+
+	log.Printf("jetgen: generated jet code into %s (schema=%s)", outputDir, backendSchema)
 	return nil
 }
 

backend/cmd/movegen/main.go

@@ -1,417 +0,0 @@
-// Command movegen emits golden conformance fixtures for the client-side move
-// generator port (ui/src/lib/dict). It is a dev tool, run by hand; its output is
-// committed so the TypeScript parity tests run without a Go toolchain.
-//
-// For each small sample dictionary (English and Russian — the latter reaches
-// alphabet index 32, exercising the 33-letter cross-set boundary) it writes:
-//
-//   - sample_<tag>.dawg           the serialized dictionary (the reader/cursor fixture)
-//   - sample_<tag>.words.json     the stored words + their alphabet indexes
-//   - sample_<tag>.gen.json       ranked move-generation results from the real solver,
-//     for a handful of positions, plus the ruleset the TS
-//     side rebuilds to score identically
-//
-// Positions are built with only the solver's public API: an empty board, and
-// two-ply positions reached by applying the solver's own top move (so no internal
-// encoding is needed). Regenerate with:
-//
-//	go run ./backend/cmd/movegen -out ui/src/lib/dict/testdata
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"flag"
-	"log"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"gitea.iliadenisov.ru/developer/scrabble-solver/board"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rack"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/scrabble"
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// sampleWordsEN is the English sample dictionary, in strictly increasing
-// alphabet-index order (the builder requires it). Shared prefixes (car/care/cars),
-// shared suffixes (cats/dogs), internal-final nodes (do, an) and a one-letter word.
-var sampleWordsEN = []string{
-	"a", "an", "and", "ant",
-	"car", "care", "cared", "cares", "cars", "cat", "cats",
-	"do", "doe", "does", "dog", "dogs", "done", "dot",
-}
-
-// sampleWordsRU is the Russian sample dictionary, in strictly increasing index
-// order. It deliberately includes words starting with я (index 32) so the ported
-// cross-set handles alphabet indexes past JS's 31-bit shift boundary.
-var sampleWordsRU = []string{"ад", "ар", "оса", "я", "яд", "яр"}
-
-// sampleFixture is the JSON committed with the .dawg so the TypeScript cursor test
-// knows the exact word set (as alphabet indexes) to expect from enumeration.
-type sampleFixture struct {
-	Alphabet string   `json:"alphabet"`
-	NumAdded int      `json:"numAdded"`
-	Words    []string `json:"words"`
-	Indexes  [][]int  `json:"indexes"`
-}
-
-// genFixture is the move-generation golden set for one sample dictionary.
-type genFixture struct {
-	Ruleset genRuleset `json:"ruleset"`
-	Cases   []genCase  `json:"cases"`
-}
-
-// genRuleset is the scoring data the TS side rebuilds so evaluate() matches the Go
-// solver: letter values, premium multipliers per square, the centre, rack size and bonus.
-type genRuleset struct {
-	Size       int     `json:"size"`
-	Cols       int     `json:"cols"`
-	Center     int     `json:"center"`
-	RackSize   int     `json:"rackSize"`
-	Bingo      int     `json:"bingo"`
-	Values     []int   `json:"values"`
-	LetterMult [][]int `json:"letterMult"`
-	WordMult   [][]int `json:"wordMult"`
-}
-
-// genTile is one placed tile (a board tile or a move placement).
-type genTile struct {
-	Row    int  `json:"row"`
-	Col    int  `json:"col"`
-	Letter int  `json:"letter"`
-	Blank  bool `json:"blank"`
-}
-
-// genRack is a rack as a multiset of letter indexes plus a blank count.
-type genRack struct {
-	Letters []int `json:"letters"`
-	Blanks  int   `json:"blanks"`
-}
-
-// genMove is one ranked generated play: its orientation, placed tiles and total score.
-type genMove struct {
-	Dir   int       `json:"dir"`
-	Tiles []genTile `json:"tiles"`
-	Score int       `json:"score"`
-}
-
-// genCase is one generation position: the tiles already on the board (empty when
-// none), the rack, the mode/rule and the ranked moves the solver returns.
-type genCase struct {
-	Name             string    `json:"name"`
-	Placed           []genTile `json:"placed"`
-	Rack             genRack   `json:"rack"`
-	Mode             int       `json:"mode"`
-	IgnoreCrossWords bool      `json:"ignoreCrossWords"`
-	Moves            []genMove `json:"moves"`
-}
-
-func main() {
-	out := flag.String("out", "ui/src/lib/dict/testdata", "output directory for fixtures")
-	dawgDir := flag.String("dawg-dir", "", "when set, emit real-dictionary move-gen golden from the .dawg files in this dir (conformance mode) instead of the committed samples")
-	flag.Parse()
-
-	if err := os.MkdirAll(*out, 0o755); err != nil {
-		log.Fatalf("movegen: mkdir %s: %v", *out, err)
-	}
-
-	if *dawgDir != "" {
-		buildReal(*dawgDir, *out)
-		return
-	}
-
-	emitRulesets()
-
-	buildSample(*out, "en", rules.English(), sampleWordsEN, []genCase{
-		emptyCase("empty-cared", englishRack("caredts", 0), scrabble.Both, false),
-		emptyCase("empty-dogs", englishRack("dogsent", 0), scrabble.Both, false),
-		emptyCase("empty-blank", englishRack("caret", 1), scrabble.Both, false),
-		emptyCase("empty-single-word", englishRack("caredts", 0), scrabble.Both, true),
-	})
-
-	buildSample(*out, "ru", rules.RussianScrabble(), sampleWordsRU, []genCase{
-		emptyCase("empty-yad", russianRack("ядрасо", 0), scrabble.Both, false),
-	})
-}
-
-// buildSample writes the dawg, the word fixture and the generation golden set for
-// one sample dictionary. Two-ply cases are appended: the solver's own top move from
-// the first non-empty result is applied, then generation runs again on the new rack.
-func buildSample(out, tag string, rs *rules.Ruleset, words []string, cases []genCase) {
-	idx := rs.Alphabet
-	b := dawg.New(idx)
-	indexes := make([][]int, 0, len(words))
-	for _, w := range words {
-		if err := b.Add(w); err != nil {
-			log.Fatalf("movegen[%s]: add %q: %v", tag, w, err)
-		}
-		enc, err := idx.Encode(w)
-		if err != nil {
-			log.Fatalf("movegen[%s]: encode %q: %v", tag, w, err)
-		}
-		ints := make([]int, len(enc))
-		for i, x := range enc {
-			ints[i] = int(x)
-		}
-		indexes = append(indexes, ints)
-	}
-	finder := b.Finish()
-
-	writeJSON(filepath.Join(out, "sample_"+tag+".words.json"), sampleFixture{
-		Alphabet: tag, NumAdded: finder.NumAdded(), Words: words, Indexes: indexes,
-	})
-	dawgPath := filepath.Join(out, "sample_"+tag+".dawg")
-	if _, err := finder.Save(dawgPath); err != nil {
-		log.Fatalf("movegen[%s]: save %s: %v", tag, dawgPath, err)
-	}
-
-	s := scrabble.NewSolver(rs, finder)
-	for i := range cases {
-		runCase(s, rs, &cases[i], nil)
-	}
-	// A two-ply position from the first standard case that produced a move.
-	if two := twoPly(s, rs, cases); two != nil {
-		cases = append(cases, *two)
-	}
-
-	writeJSON(filepath.Join(out, "sample_"+tag+".gen.json"), genFixture{
-		Ruleset: rulesetOf(rs), Cases: cases,
-	})
-	log.Printf("movegen[%s]: %d words, %d cases", tag, finder.NumAdded(), len(cases))
-}
-
-// realVariant maps a shipped dictionary file to the ruleset that scores it and the racks
-// the conformance positions use. smallRack/blankRack keep the first-move (empty board)
-// lists bounded on a dense dictionary; fullRack drives a deep 7-tile mid-game position,
-// kept small by the anchors around the already-placed word.
-type realVariant struct {
-	file, variant, smallRack, blankRack, fullRack string
-	rs                                            *rules.Ruleset
-}
-
-// buildReal emits move-generation golden from the real shipped dictionaries in dawgDir —
-// the full alphabets and deep graphs the tiny samples cannot reach — one
-// <variant>.movegen.json per variant. Like the dictgen/validategen vectors it is
-// regenerated in CI and never committed, so it pins no dictionary version into the repo.
-func buildReal(dawgDir, out string) {
-	reals := []realVariant{
-		{"en_sowpods", "scrabble_en", "aine", "ain", "aeinrst", rules.English()},
-		{"ru_scrabble", "scrabble_ru", "аеин", "аен", "аеиноср", rules.RussianScrabble()},
-		{"ru_erudit", "erudit_ru", "аеин", "аен", "аеиноср", rules.Erudit()},
-	}
-	for _, v := range reals {
-		data, err := os.ReadFile(filepath.Join(dawgDir, v.file+".dawg"))
-		if err != nil {
-			log.Fatalf("movegen[%s]: read dawg: %v", v.variant, err)
-		}
-		finder, err := dawg.Read(bytes.NewReader(data), 0)
-		if err != nil {
-			log.Fatalf("movegen[%s]: parse dawg: %v", v.variant, err)
-		}
-		s := scrabble.NewSolver(v.rs, finder)
-
-		cases := []genCase{
-			emptyCase("first-move", encRack(v.rs, v.smallRack, 0), scrabble.Both, false),
-			emptyCase("first-move-blank", encRack(v.rs, v.blankRack, 1), scrabble.Both, false),
-		}
-		for i := range cases {
-			runCase(s, v.rs, &cases[i], nil)
-		}
-		// A deep 7-tile mid-game: place the top first move, then generate again. The
-		// anchors around the placed word bound the list while still exercising a full rack,
-		// deep left/right extension and wide cross-sets over the real graph.
-		full := encRack(v.rs, v.fullRack, 0)
-		b := board.New(v.rs.Rows, v.rs.Cols)
-		if m1 := s.GenerateMovesOpts(b, toRack(v.rs.Size(), full), scrabble.Both, scrabble.PlayOptions{}); len(m1) > 0 {
-			mid := genCase{Name: "mid-game", Rack: full, Mode: int(scrabble.Both)}
-			runCase(s, v.rs, &mid, tilesOf(m1[0].Tiles))
-			cases = append(cases, mid)
-		}
-
-		writeJSON(filepath.Join(out, v.variant+".movegen.json"), genFixture{Ruleset: rulesetOf(v.rs), Cases: cases})
-		total := 0
-		for _, c := range cases {
-			total += len(c.Moves)
-		}
-		_ = finder.Close()
-		log.Printf("movegen[%s]: %d cases, %d golden moves", v.variant, len(cases), total)
-	}
-}
-
-// encRack encodes a rack given as the variant's letters (plus a blank count) into the
-// index-based genRack the fixtures carry.
-func encRack(rs *rules.Ruleset, letters string, blanks int) genRack {
-	enc, err := rs.Alphabet.Encode(letters)
-	if err != nil {
-		log.Fatalf("movegen: encode rack %q: %v", letters, err)
-	}
-	idx := make([]int, len(enc))
-	for i, b := range enc {
-		idx[i] = int(b)
-	}
-	return genRack{Letters: idx, Blanks: blanks}
-}
-
-// runCase fills a case's Moves by generating on a board holding the given placed
-// tiles (nil = empty board).
-func runCase(s *scrabble.Solver, rs *rules.Ruleset, c *genCase, placed []genTile) {
-	bd := board.New(rs.Rows, rs.Cols)
-	for _, t := range placed {
-		bd.Set(t.Row, t.Col, cellByte(t.Letter, t.Blank))
-	}
-	c.Placed = placed
-	rk := toRack(rs.Size(), c.Rack)
-	moves := s.GenerateMovesOpts(bd, rk, scrabble.Mode(c.Mode), scrabble.PlayOptions{IgnoreCrossWords: c.IgnoreCrossWords})
-	c.Moves = movesOf(moves)
-}
-
-// twoPly reaches a mid-game position by applying the top move of the first standard
-// case that generated one, then generates again with a fresh rack of the same tiles.
-func twoPly(s *scrabble.Solver, rs *rules.Ruleset, cases []genCase) *genCase {
-	for _, c := range cases {
-		if c.IgnoreCrossWords || len(c.Moves) == 0 {
-			continue
-		}
-		placed := c.Moves[0].Tiles
-		next := genCase{Name: "two-ply", Rack: c.Rack, Mode: int(scrabble.Both)}
-		runCase(s, rs, &next, placed)
-		return &next
-	}
-	return nil
-}
-
-// cellByte encodes a board cell the way internal/encoding.Cell does (bits 0-5 hold
-// letter+1, bit 7 marks a blank). Duplicated here because that package is internal
-// to the solver module and cannot be imported.
-func cellByte(letter int, blank bool) byte {
-	v := byte(letter+1) & 0x3f
-	if blank {
-		v |= 0x80
-	}
-	return v
-}
-
-func toRack(size int, r genRack) rack.Rack {
-	rk := rack.New(size)
-	for _, l := range r.Letters {
-		rk.Add(byte(l))
-	}
-	for i := 0; i < r.Blanks; i++ {
-		rk.AddBlank()
-	}
-	return rk
-}
-
-func rulesetOf(rs *rules.Ruleset) genRuleset {
-	lm := make([][]int, rs.Rows)
-	wm := make([][]int, rs.Rows)
-	for r := 0; r < rs.Rows; r++ {
-		lm[r] = make([]int, rs.Cols)
-		wm[r] = make([]int, rs.Cols)
-		for c := 0; c < rs.Cols; c++ {
-			p := rs.Premium(r, c)
-			lm[r][c] = p.LetterMult()
-			wm[r][c] = p.WordMult()
-		}
-	}
-	return genRuleset{
-		Size: rs.Size(), Cols: rs.Cols, Center: rs.Center, RackSize: rs.RackSize,
-		Bingo: rs.Bingo, Values: rs.Values, LetterMult: lm, WordMult: wm,
-	}
-}
-
-func movesOf(ms []scrabble.Move) []genMove {
-	out := make([]genMove, len(ms))
-	for i, m := range ms {
-		out[i] = genMove{Dir: int(m.Dir), Tiles: tilesOf(m.Tiles), Score: m.Score}
-	}
-	return out
-}
-
-func tilesOf(ps []scrabble.Placement) []genTile {
-	out := make([]genTile, len(ps))
-	for i, p := range ps {
-		out[i] = genTile{Row: p.Row, Col: p.Col, Letter: int(p.Letter), Blank: p.Blank}
-	}
-	return out
-}
-
-// emptyCase builds an empty-board case (Moves filled later by runCase).
-func emptyCase(name string, r genRack, mode scrabble.Mode, ignoreCross bool) genCase {
-	return genCase{Name: name, Rack: r, Mode: int(mode), IgnoreCrossWords: ignoreCross}
-}
-
-// englishRack builds a rack from lowercase a-z letters (index = letter-'a').
-func englishRack(letters string, blanks int) genRack {
-	idx := make([]int, 0, len(letters))
-	for _, ch := range letters {
-		idx = append(idx, int(ch-'a'))
-	}
-	return genRack{Letters: idx, Blanks: blanks}
-}
-
-// russianRack builds a rack from the Russian sample letters used above.
-func russianRack(letters string, blanks int) genRack {
-	m := map[rune]int{'а': 0, 'д': 4, 'о': 15, 'р': 17, 'с': 18, 'я': 32}
-	idx := make([]int, 0, len([]rune(letters)))
-	for _, ch := range letters {
-		i, ok := m[ch]
-		if !ok {
-			log.Fatalf("movegen: russianRack: no index for %q", string(ch))
-		}
-		idx = append(idx, i)
-	}
-	return genRack{Letters: idx, Blanks: blanks}
-}
-
-// emitRulesets writes the per-variant static ruleset data (tile values, bag counts, blanks,
-// bingo, rack size) the offline engine mirrors in ui/src/lib/localgame/ruleset.ts, so a TS
-// parity test can pin that hand-copied table to the Go rulesets (scrabble-solver/rules).
-func emitRulesets() {
-	type rsFix struct {
-		Size     int      `json:"size"`
-		RackSize int      `json:"rackSize"`
-		Bingo    int      `json:"bingo"`
-		Blanks   int      `json:"blanks"`
-		Values   []int    `json:"values"`
-		Counts   []int    `json:"counts"`
-		Letters  []string `json:"letters"`
-	}
-	out := map[string]rsFix{}
-	for _, v := range []struct {
-		name string
-		rs   *rules.Ruleset
-	}{
-		{"scrabble_en", rules.English()},
-		{"scrabble_ru", rules.RussianScrabble()},
-		{"erudit_ru", rules.Erudit()},
-	} {
-		letters := make([]string, v.rs.Size())
-		for i := range letters {
-			ch, err := v.rs.Alphabet.Character(byte(i))
-			if err != nil {
-				log.Fatalf("movegen: %s letter %d: %v", v.name, i, err)
-			}
-			letters[i] = strings.ToUpper(ch)
-		}
-		out[v.name] = rsFix{Size: v.rs.Size(), RackSize: v.rs.RackSize, Bingo: v.rs.Bingo, Blanks: v.rs.Blanks, Values: v.rs.Values, Counts: v.rs.Counts, Letters: letters}
-	}
-	dir := filepath.Join("ui", "src", "lib", "localgame", "testdata")
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		log.Fatalf("movegen: mkdir %s: %v", dir, err)
-	}
-	writeJSON(filepath.Join(dir, "rulesets.json"), out)
-	log.Printf("movegen: wrote %s (3 variants)", filepath.Join(dir, "rulesets.json"))
-}
-
-func writeJSON(path string, v any) {
-	data, err := json.MarshalIndent(v, "", "  ")
-	if err != nil {
-		log.Fatalf("movegen: marshal %s: %v", path, err)
-	}
-	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
-		log.Fatalf("movegen: write %s: %v", path, err)
-	}
-}

backend/cmd/validategen/main.go

@@ -1,486 +0,0 @@
-// Command validategen produces golden conformance fixtures for the TypeScript
-// move validator (ui/src/lib/dict/validate.ts). For each variant it self-plays
-// greedy games with the authoritative scrabble-solver engine to build realistic
-// board positions, then records a battery of candidate plays — the engine's own
-// top move, letter-mutated variants, random scatters and (on the empty board) an
-// off-centre translation — each paired with the ground-truth result of
-// ValidatePlayOpts (legal, score, the words formed). The TS conformance test
-// replays these and must agree exactly.
-//
-// It is a development tool (not built into any service), analogous to
-// cmd/dictgen. Run it from the repository root:
-//
-//	go run ./backend/cmd/validategen -dawg-dir ../scrabble-solver/dawg -out <dir>
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"math/rand"
-	"os"
-	"path/filepath"
-
-	"gitea.iliadenisov.ru/developer/scrabble-solver/board"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rack"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/scrabble"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/selfplay"
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// blankTile marks a blank tile in a drawn hand (matches selfplay).
-const blankTile byte = 0xff
-
-// variantSpec pairs a variant label with its ruleset and dawg file.
-type variantSpec struct {
-	name  string
-	rules *rules.Ruleset
-	dawg  string
-}
-
-// cell is an occupied board square or a placement (alphabet-index letter).
-type cell struct {
-	R, C, Letter int
-	Blank        bool
-}
-
-// word mirrors scrabble.Word in index space.
-type word struct {
-	Row, Col, Dir int
-	Letters       []int
-	Blanks        []bool
-	Score         int
-}
-
-// fixture is one candidate play with the engine's ground-truth verdict.
-type fixture struct {
-	Board            int    `json:"board"` // index into the boards list
-	Dir              int    `json:"dir"`
-	IgnoreCrossWords bool   `json:"ignoreCrossWords"`
-	Tiles            []cell `json:"tiles"`
-	Legal            bool   `json:"legal"`
-	Score            int    `json:"score"`
-	Bonus            int    `json:"bonus"`
-	Main             *word  `json:"main,omitempty"`
-	Cross            []word `json:"cross,omitempty"`
-}
-
-// alphaEntry mirrors one row of the per-variant alphabet table the server sends the
-// client (index, concrete letter as the ruleset emits it, tile value), so the adapter
-// cross-test can drive the letter-space client path exactly as production does.
-type alphaEntry struct {
-	Index  int    `json:"index"`
-	Letter string `json:"letter"`
-	Value  int    `json:"value"`
-}
-
-// variantFile is the whole conformance payload for one variant.
-type variantFile struct {
-	Variant  string       `json:"variant"`
-	Rows     int          `json:"rows"`
-	Cols     int          `json:"cols"`
-	Center   int          `json:"center"`
-	RackSize int          `json:"rackSize"`
-	Bingo    int          `json:"bingo"`
-	Values   []int        `json:"values"`
-	Premiums []int        `json:"premiums"` // row-major rules.Premium codes
-	Alphabet []alphaEntry `json:"alphabet"`
-	Boards   [][]cell     `json:"boards"`
-	Fixtures []fixture    `json:"fixtures"`
-}
-
-func main() {
-	dawgDir := flag.String("dawg-dir", "../scrabble-solver/dawg", "directory holding the .dawg files")
-	outDir := flag.String("out", "", "output directory for the fixture files (required)")
-	games := flag.Int("games", 6, "self-play games per (variant, rule)")
-	plies := flag.Int("plies", 40, "maximum plies captured per game")
-	flag.Parse()
-	if *outDir == "" {
-		fail("-out is required")
-	}
-	if err := os.MkdirAll(*outDir, 0o755); err != nil {
-		fail("mkdir out: %v", err)
-	}
-
-	specs := []variantSpec{
-		{"scrabble_en", rules.English(), "en_sowpods.dawg"},
-		{"scrabble_ru", rules.RussianScrabble(), "ru_scrabble.dawg"},
-		{"erudit_ru", rules.Erudit(), "ru_erudit.dawg"},
-	}
-	for _, sp := range specs {
-		if err := generate(sp, *dawgDir, *outDir, *games, *plies); err != nil {
-			fail("%s: %v", sp.name, err)
-		}
-	}
-}
-
-func generate(sp variantSpec, dawgDir, outDir string, games, plies int) error {
-	data, err := os.ReadFile(filepath.Join(dawgDir, sp.dawg))
-	if err != nil {
-		return err
-	}
-	finder, err := dawg.Read(bytes.NewReader(data), 0)
-	if err != nil {
-		return fmt.Errorf("read dawg: %w", err)
-	}
-	defer finder.Close()
-
-	rs := sp.rules
-	solver := scrabble.NewSolver(rs, finder)
-
-	out := variantFile{
-		Variant: sp.name, Rows: rs.Rows, Cols: rs.Cols, Center: rs.Center,
-		RackSize: rs.RackSize, Bingo: rs.Bingo, Values: rs.Values,
-		Premiums: premiumCodes(rs), Alphabet: alphabetOf(rs),
-	}
-
-	// Capture under both the standard rule and the single-word rule, building the
-	// board with the same rule so positions are reachable under it.
-	for _, ignore := range []bool{false, true} {
-		opts := scrabble.PlayOptions{IgnoreCrossWords: ignore}
-		for g := range games {
-			seed := int64(g*1000) + boolseed(ignore) + variantSeed(sp.name)
-			playAndCapture(&out, rs, solver, opts, seed, plies)
-		}
-	}
-
-	b, err := json.Marshal(&out)
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(outDir, sp.name+".fixtures.json"), b, 0o644); err != nil {
-		return err
-	}
-	fmt.Printf("%-12s boards=%d fixtures=%d\n", sp.name, len(out.Boards), len(out.Fixtures))
-	return nil
-}
-
-// playAndCapture greedily self-plays one game, recording candidate plays against
-// each board position along the way.
-func playAndCapture(out *variantFile, rs *rules.Ruleset, solver *scrabble.Solver, opts scrabble.PlayOptions, seed int64, plies int) {
-	rng := rand.New(rand.NewSource(seed))
-	bag := selfplay.NewBag(rs, seed)
-	b := board.New(rs.Rows, rs.Cols)
-	hands := [2][]byte{bag.Draw(rs.RackSize), bag.Draw(rs.RackSize)}
-
-	passes := 0
-	for turn := range plies {
-		p := turn % 2
-		rk := rackOf(hands[p], rs.Size())
-		moves := solver.GenerateMovesOpts(b, rk, scrabble.Both, opts)
-		if len(moves) == 0 {
-			if passes++; passes >= 4 {
-				break
-			}
-			continue
-		}
-		passes = 0
-		top := moves[0]
-
-		boardIdx := len(out.Boards)
-		out.Boards = append(out.Boards, boardCells(b))
-		captureCandidates(out, rs, solver, opts, b, boardIdx, top, rng)
-
-		scrabble.Apply(b, top)
-		hands[p] = removeUsed(hands[p], top)
-		if need := rs.RackSize - len(hands[p]); need > 0 {
-			hands[p] = append(hands[p], bag.Draw(need)...)
-		}
-		if len(hands[p]) == 0 && bag.Len() == 0 {
-			break
-		}
-	}
-}
-
-// captureCandidates records the engine's top move plus derived candidates for one
-// board, each with its ValidatePlayOpts verdict.
-func captureCandidates(out *variantFile, rs *rules.Ruleset, solver *scrabble.Solver, opts scrabble.PlayOptions, b *board.Board, boardIdx int, top scrabble.Move, rng *rand.Rand) {
-	size := rs.Size()
-	record := func(tiles []scrabble.Placement) {
-		if len(tiles) == 0 {
-			return
-		}
-		out.Fixtures = append(out.Fixtures, makeFixture(solver, opts, b, boardIdx, tiles))
-	}
-
-	// The engine's own top move (legal).
-	record(top.Tiles)
-
-	// Letter-mutated variants: usually reject on the dictionary, occasionally form
-	// a different legal word.
-	for range 3 {
-		mut := clonePlacements(top.Tiles)
-		i := rng.Intn(len(mut))
-		mut[i].Letter = byte((int(mut[i].Letter) + 1 + rng.Intn(size-1)) % size)
-		record(mut)
-	}
-
-	// Random scatters: exercise geometry, dictionary and connectivity paths.
-	for range 3 {
-		record(randomScatter(b, size, 2+rng.Intn(4), rng))
-	}
-
-	// Single tiles abutting the board exercise the direction inference — a single
-	// tile is ambiguous, its orientation resolved from which axis it extends.
-	for range 3 {
-		if t, ok := randomAdjacentSingle(b, size, rng); ok {
-			record([]scrabble.Placement{t})
-		}
-	}
-
-	// On the empty board, an off-centre translation of the first move exercises the
-	// first-move centre rule.
-	if b.IsEmpty() {
-		shifted := clonePlacements(top.Tiles)
-		ok := true
-		for i := range shifted {
-			shifted[i].Row++
-			shifted[i].Col++
-			if !b.InBounds(shifted[i].Row, shifted[i].Col) {
-				ok = false
-				break
-			}
-		}
-		if ok {
-			record(shifted)
-		}
-	}
-}
-
-// makeFixture validates a candidate against board b and serializes it with its
-// ground truth. Word breakdown is recorded only for legal plays (the TS test
-// checks words only then); an illegal play records legal=false alone.
-func makeFixture(solver *scrabble.Solver, opts scrabble.PlayOptions, b *board.Board, boardIdx int, tiles []scrabble.Placement) fixture {
-	// Infer the orientation exactly as the backend evaluate does (dir-less), so the
-	// fixture matches the real eval path and pins the client's ported inference.
-	dir := playDirectionMirror(solver, b, tiles, opts)
-	fx := fixture{
-		Board:            boardIdx,
-		Dir:              int(dir),
-		IgnoreCrossWords: opts.IgnoreCrossWords,
-		Tiles:            placementCells(tiles),
-	}
-	m, err := solver.ValidatePlayOpts(b, dir, tiles, opts)
-	if err == nil {
-		fx.Legal = true
-		fx.Score = m.Score
-		fx.Bonus = m.Bonus
-		fx.Main = toWord(m.Main)
-		for _, cw := range m.Cross {
-			fx.Cross = append(fx.Cross, *toWord(cw))
-		}
-	}
-	return fx
-}
-
-func placementCells(ts []scrabble.Placement) []cell {
-	cs := make([]cell, len(ts))
-	for i, t := range ts {
-		cs[i] = cell{R: t.Row, C: t.Col, Letter: int(t.Letter), Blank: t.Blank}
-	}
-	return cs
-}
-
-func toWord(w scrabble.Word) *word {
-	letters := make([]int, len(w.Letters))
-	for i, l := range w.Letters {
-		letters[i] = int(l)
-	}
-	return &word{
-		Row: w.Row, Col: w.Col, Dir: int(w.Dir),
-		Letters: letters, Blanks: append([]bool(nil), w.Blanks...), Score: w.Score,
-	}
-}
-
-func alphabetOf(rs *rules.Ruleset) []alphaEntry {
-	n := rs.Alphabet.Size()
-	out := make([]alphaEntry, n)
-	for i := range n {
-		ch, _ := rs.Alphabet.Character(byte(i))
-		out[i] = alphaEntry{Index: i, Letter: ch, Value: rs.Values[i]}
-	}
-	return out
-}
-
-func premiumCodes(rs *rules.Ruleset) []int {
-	codes := make([]int, rs.Rows*rs.Cols)
-	for i := range codes {
-		codes[i] = int(rs.PremiumAt(i))
-	}
-	return codes
-}
-
-func boardCells(b *board.Board) []cell {
-	var cs []cell
-	for r := 0; r < b.Rows(); r++ {
-		for c := 0; c < b.Cols(); c++ {
-			if b.Filled(r, c) {
-				v := b.At(r, c)
-				cs = append(cs, cell{R: r, C: c, Letter: int(v&0x3f) - 1, Blank: v&0x80 != 0})
-			}
-		}
-	}
-	return cs
-}
-
-func clonePlacements(ts []scrabble.Placement) []scrabble.Placement {
-	return append([]scrabble.Placement(nil), ts...)
-}
-
-// randomScatter picks n distinct empty in-bounds squares with random letters.
-func randomScatter(b *board.Board, size, n int, rng *rand.Rand) []scrabble.Placement {
-	seen := map[[2]int]bool{}
-	var ts []scrabble.Placement
-	for tries := 0; tries < n*20 && len(ts) < n; tries++ {
-		r := rng.Intn(b.Rows())
-		c := rng.Intn(b.Cols())
-		if seen[[2]int{r, c}] || b.Filled(r, c) {
-			continue
-		}
-		seen[[2]int{r, c}] = true
-		ts = append(ts, scrabble.Placement{Row: r, Col: c, Letter: byte(rng.Intn(size)), Blank: rng.Intn(10) == 0})
-	}
-	return ts
-}
-
-// randomAdjacentSingle picks a random empty in-bounds square abutting at least one
-// filled square, with a random letter — a single-tile play whose orientation the
-// inference must resolve. It returns ok=false on an empty board.
-func randomAdjacentSingle(b *board.Board, size int, rng *rand.Rand) (scrabble.Placement, bool) {
-	var cands [][2]int
-	for r := 0; r < b.Rows(); r++ {
-		for c := 0; c < b.Cols(); c++ {
-			if b.Filled(r, c) {
-				continue
-			}
-			if b.Filled(r-1, c) || b.Filled(r+1, c) || b.Filled(r, c-1) || b.Filled(r, c+1) {
-				cands = append(cands, [2]int{r, c})
-			}
-		}
-	}
-	if len(cands) == 0 {
-		return scrabble.Placement{}, false
-	}
-	rc := cands[rng.Intn(len(cands))]
-	return scrabble.Placement{Row: rc[0], Col: rc[1], Letter: byte(rng.Intn(size)), Blank: rng.Intn(10) == 0}, true
-}
-
-// playDirectionMirror mirrors engine (*Game).playDirection: the geometric
-// resolution, except a single tile under the single-word rule tries both
-// orientations through the solver and keeps the higher-scoring legal one (H wins
-// ties). It reproduces the orientation the backend evaluate infers.
-func playDirectionMirror(solver *scrabble.Solver, b *board.Board, placements []scrabble.Placement, opts scrabble.PlayOptions) scrabble.Direction {
-	geo := resolveDirectionMirror(b, placements)
-	if len(placements) != 1 || !opts.IgnoreCrossWords {
-		return geo
-	}
-	best, found, bestScore := geo, false, 0
-	for _, dir := range [...]scrabble.Direction{scrabble.Horizontal, scrabble.Vertical} {
-		m, err := solver.ValidatePlayOpts(b, dir, placements, opts)
-		if err != nil {
-			continue
-		}
-		if !found || m.Score > bestScore {
-			best, found, bestScore = dir, true, m.Score
-		}
-	}
-	return best
-}
-
-// resolveDirectionMirror mirrors engine.resolveDirection.
-func resolveDirectionMirror(b *board.Board, placements []scrabble.Placement) scrabble.Direction {
-	if len(placements) >= 2 {
-		row := placements[0].Row
-		for _, p := range placements[1:] {
-			if p.Row != row {
-				return scrabble.Vertical
-			}
-		}
-		return scrabble.Horizontal
-	}
-	if len(placements) == 1 {
-		p := placements[0]
-		h := runLengthMirror(b, p.Row, p.Col, scrabble.Horizontal)
-		v := runLengthMirror(b, p.Row, p.Col, scrabble.Vertical)
-		if v >= 2 && v > h {
-			return scrabble.Vertical
-		}
-		if h >= 2 {
-			return scrabble.Horizontal
-		}
-		if v >= 2 {
-			return scrabble.Vertical
-		}
-	}
-	return scrabble.Horizontal
-}
-
-// runLengthMirror mirrors engine.runLength.
-func runLengthMirror(b *board.Board, row, col int, dir scrabble.Direction) int {
-	dr, dc := 0, 1
-	if dir == scrabble.Vertical {
-		dr, dc = 1, 0
-	}
-	n := 1
-	for r, c := row-dr, col-dc; b.Filled(r, c); r, c = r-dr, c-dc {
-		n++
-	}
-	for r, c := row+dr, col+dc; b.Filled(r, c); r, c = r+dr, c+dc {
-		n++
-	}
-	return n
-}
-
-// rackOf builds a generation rack from a hand of tiles (reimplemented from the
-// unexported selfplay helper).
-func rackOf(tiles []byte, size int) rack.Rack {
-	r := rack.New(size)
-	for _, t := range tiles {
-		if t == blankTile {
-			r.AddBlank()
-		} else {
-			r.Add(t)
-		}
-	}
-	return r
-}
-
-// removeUsed returns the hand with the tiles consumed by m removed.
-func removeUsed(tiles []byte, m scrabble.Move) []byte {
-	out := append([]byte(nil), tiles...)
-	for _, p := range m.Tiles {
-		want := p.Letter
-		if p.Blank {
-			want = blankTile
-		}
-		for i, t := range out {
-			if t == want {
-				out = append(out[:i], out[i+1:]...)
-				break
-			}
-		}
-	}
-	return out
-}
-
-func boolseed(b bool) int64 {
-	if b {
-		return 500000
-	}
-	return 0
-}
-
-func variantSeed(name string) int64 {
-	var s int64
-	for _, r := range name {
-		s = s*131 + int64(r)
-	}
-	return s
-}
-
-func fail(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, "validategen: "+format+"\n", args...)
-	os.Exit(1)
-}

backend/go.mod

@@ -13,7 +13,6 @@ require (
 	github.com/pressly/goose/v3 v3.27.1
 	github.com/testcontainers/testcontainers-go v0.42.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
-	github.com/wneessen/go-mail v0.7.3
 	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0
@@ -110,7 +109,7 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

backend/go.sum

@@ -279,8 +279,6 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
-github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
@@ -402,8 +400,6 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=

backend/internal/account/account.go

@@ -22,13 +22,12 @@ import (
 	"scrabble/backend/internal/postgres/jet/backend/table"
 )
 
-// Identity kinds recognised by the backend. Telegram and VK are platform identities,
-// auto-confirmed on first contact. Email is modelled as an identity alongside them; its
-// confirmed flag is driven by the email confirm-code flow. Robot is a synthetic kind:
-// each pooled robot opponent is a durable account bound to one robot identity.
+// Identity kinds recognised by the backend. Email is modelled as an identity
+// alongside platform identities; its confirmed flag is driven by the email
+// confirm-code flow. Robot is a synthetic kind: each pooled
+// robot opponent is a durable account bound to one robot identity.
 const (
 	KindTelegram = "telegram"
-	KindVK       = "vk"
 	KindEmail    = "email"
 	KindRobot    = "robot"
 )
@@ -43,7 +42,9 @@ var ErrNotFound = errors.New("account: not found")
 // local-time window (in TimeZone) during which the player is asleep, so the
 // turn-timeout sweeper does not auto-resign them inside it. (The robot opponent's
 // own sleep is anchored to its human opponent's timezone with a per-game drift,
-// computed in internal/robot, not from a robot account's away window.)
+// computed in internal/robot, not from a robot account's away window.) HintBalance
+// is the player's wallet of purchasable hints, spent after a game's per-seat
+// allowance.
 type Account struct {
 	ID                  uuid.UUID
 	DisplayName         string
@@ -51,6 +52,7 @@ type Account struct {
 	TimeZone            string
 	AwayStart           time.Time
 	AwayEnd             time.Time
+	HintBalance         int
 	BlockChat           bool
 	BlockFriendRequests bool
 	// VariantPreferences is the set of game variants (engine.Variant stable labels:
@@ -66,6 +68,10 @@ type Account struct {
 	// true (the default): the platform side-service skips out-of-app push for the
 	// account.
 	NotificationsInAppOnly bool
+	// PaidAccount marks a lifetime one-time-payment account. It is a service field
+	// (no purchase flow yet); an account linking & merge ORs it so a paid status is
+	// never lost when accounts are consolidated.
+	PaidAccount bool
 	// MergedInto is the primary account a retired (merged) secondary points at, or
 	// uuid.Nil for a live account. A tombstone keeps the row so the no-cascade
 	// foreign keys of a shared finished game stay valid.
@@ -113,47 +119,6 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
 	return s.provision(ctx, kind, externalID, provisionSeed{})
 }
 
-// ProvisionEmail returns the account owning the email identity externalID, creating
-// it on first contact with browserTZ — the client's detected "±HH:MM" UTC offset —
-// seeded into its time zone, language seeded from the client's UI language, and its
-// display name seeded from the email's local part (so it is not left nameless). Like
-// ProvisionByIdentity it is race-safe and leaves an existing account untouched, so a
-// returning user's saved zone, language and name are never overwritten. The email account is
-// created here (the code-request step), not at the later login, so this is where its
-// zone and language are seeded. It is created flagged is_guest with an unconfirmed
-// email identity: an abandoned, never-confirmed login is then reaped like any guest,
-// freeing the reserved address, and confirming the code clears the guest flag.
-func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ, language string) (Account, error) {
-	return s.provision(ctx, KindEmail, externalID, provisionSeed{
-		displayName:       emailDisplayName(externalID),
-		timeZone:          seedZone(browserTZ),
-		preferredLanguage: supportedLanguage(language),
-		isGuest:           true,
-	})
-}
-
-// emailDisplayName derives a display name from an email address — the local part
-// before '@', trimmed and capped to the column width — so a new email account is not
-// left nameless. It is only the first-contact seed; the user can rename it later.
-func emailDisplayName(email string) string {
-	local, _, _ := strings.Cut(email, "@")
-	local = strings.TrimSpace(local)
-	if r := []rune(local); len(r) > maxDisplayName {
-		local = strings.TrimRight(string(r[:maxDisplayName]), " ")
-	}
-	return local
-}
-
-// supportedLanguage returns code normalised to a supported UI language ("en" or
-// "ru"), or "" when it maps to neither, so a new account keeps the 'en' default. It
-// accepts region-tagged codes ("ru-RU").
-func supportedLanguage(code string) string {
-	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(code)), "-"); lang == "en" || lang == "ru" {
-		return lang
-	}
-	return ""
-}
-
 // ProvisionRobot provisions (or finds) the durable account backing a robot pool
 // member: a KindRobot identity carrying displayName, with chat blocked but friend
 // requests NOT blocked — a request to a robot is accepted as pending and, since the
@@ -195,7 +160,7 @@ func (s *Store) ProvisionRobot(ctx context.Context, externalID, displayName stri
 // is never overwritten. The created flag lets the auth handler re-evaluate moderated-
 // chat write access on first registration — the path of a user who joined the chat
 // before registering, whom no chat_member event covers.
-func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName, browserTZ string) (Account, bool, error) {
+func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName string) (Account, bool, error) {
 	// Pre-check whether the identity already exists so the caller can act on first
 	// contact. A race with a concurrent create only over- or under-reports created for
 	// that one call, which the idempotent chat-access re-evaluation tolerates.
@@ -204,31 +169,7 @@ func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode,
 	if err != nil && !created {
 		return Account{}, false, err
 	}
-	seed := telegramSeed(languageCode, username, firstName)
-	seed.timeZone = seedZone(browserTZ)
-	acc, err := s.provision(ctx, KindTelegram, externalID, seed)
-	return acc, created, err
-}
-
-// ProvisionVK provisions (or finds) the account bound to a VK identity, reporting
-// whether this call created it (first contact). On first contact only, it seeds the new
-// account's preferred language from the VK languageCode (vk_language, when it maps to a
-// supported language) and its display name sanitized from displayName — the name read
-// client-side via VKWebAppGetUserInfo, since VK omits it from the signed launch params —
-// falling back to a generated placeholder when it yields no letters; an already-existing
-// account is returned unchanged, so a later profile edit is never overwritten.
-func (s *Store) ProvisionVK(ctx context.Context, externalID, languageCode, displayName, browserTZ string) (Account, bool, error) {
-	// Pre-check whether the identity already exists so the caller can act on first
-	// contact (mirrors ProvisionTelegram); a create race only mis-reports created for
-	// that one call.
-	_, err := s.findByIdentity(ctx, KindVK, externalID)
-	created := errors.Is(err, ErrNotFound)
-	if err != nil && !created {
-		return Account{}, false, err
-	}
-	seed := vkSeed(languageCode, displayName)
-	seed.timeZone = seedZone(browserTZ)
-	acc, err := s.provision(ctx, KindVK, externalID, seed)
+	acc, err := s.provision(ctx, KindTelegram, externalID, telegramSeed(languageCode, username, firstName))
 	return acc, created, err
 }
 
@@ -256,38 +197,20 @@ func (s *Store) provision(ctx context.Context, kind, externalID string, seed pro
 }
 
 // provisionSeed carries the optional create-time profile seed for a brand-new
-// account (first contact). Empty fields fall back to the accounts table defaults,
-// so an unknown language keeps the 'en' default, an empty name keeps the ” default
-// and an empty time zone keeps the 'UTC' default.
+// account (Telegram first contact). Empty fields fall back to the accounts table
+// defaults, so an unknown language keeps the 'en' default and an empty name keeps
+// the ” default.
 type provisionSeed struct {
 	preferredLanguage string
 	displayName       string
-	timeZone          string
-	// isGuest creates the account flagged is_guest. It is set for an email-login
-	// account, which stays a guest until the address is confirmed (so an abandoned,
-	// never-confirmed login is reaped and its address freed); confirming clears the
-	// flag. Platform identities (telegram/vk) are durable from creation.
-	isGuest bool
-}
-
-// seedZone returns browserTZ when it is a well-formed zone to persist at account
-// creation (a "±HH:MM" offset or a loadable IANA name), else "" so the new account
-// falls back to the accounts table's 'UTC' default. The client reports the device's
-// detected offset deterministically; a bad value is dropped rather than guessed at.
-func seedZone(browserTZ string) string {
-	if validZone(browserTZ) {
-		return browserTZ
-	}
-	return ""
 }
 
 // telegramSeed derives the create-time seed from Telegram launch fields: a
 // supported preferred language from languageCode (an ISO-639 code, possibly
-// region-tagged like "ru-RU"), and a display name. The name precedence is the real
-// name (firstName, sanitized to the editable format) → the @username taken verbatim
-// (already a valid handle, only trimmed and length-capped, never character-stripped)
-// → a generated placeholder in the seeded language (placeholderDisplayName), reached
-// only when firstName has no usable letters and no username is set.
+// region-tagged like "ru-RU"), and a display name sanitized from firstName or,
+// failing that, username (sanitizeDisplayName strips disallowed characters to the
+// editable format). When neither yields any letters, it falls back to a generated
+// placeholder in the seeded language (placeholderDisplayName).
 func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	var seed provisionSeed
 	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(languageCode)), "-"); lang == "en" || lang == "ru" {
@@ -295,13 +218,7 @@ func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	}
 	name := sanitizeDisplayName(firstName)
 	if name == "" {
-		// The real name yielded nothing usable: fall back to the @username verbatim
-		// (Telegram guarantees a valid handle), only trimmed and capped to the column
-		// width — never character-stripped like the real name.
-		name = strings.TrimSpace(username)
-		if r := []rune(name); len(r) > maxDisplayName {
-			name = strings.TrimRight(string(r[:maxDisplayName]), " ")
-		}
+		name = sanitizeDisplayName(username)
 	}
 	if name == "" {
 		name = placeholderDisplayName(seed.preferredLanguage)
@@ -310,24 +227,6 @@ func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	return seed
 }
 
-// vkSeed derives the create-time seed from VK launch fields: a supported preferred
-// language from languageCode (vk_language, normally a 2-letter code) and a display name
-// from displayName (sanitized to the editable format), falling back to a generated
-// placeholder in the seeded language when the name yields no usable letters. Unlike
-// telegramSeed there is no @username fallback — VK provides only the name.
-func vkSeed(languageCode, displayName string) provisionSeed {
-	var seed provisionSeed
-	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(languageCode)), "-"); lang == "en" || lang == "ru" {
-		seed.preferredLanguage = lang
-	}
-	name := sanitizeDisplayName(displayName)
-	if name == "" {
-		name = placeholderDisplayName(seed.preferredLanguage)
-	}
-	seed.displayName = name
-	return seed
-}
-
 // GetByID loads the account identified by id, or ErrNotFound when it is absent.
 func (s *Store) GetByID(ctx context.Context, id uuid.UUID) (Account, error) {
 	stmt := postgres.SELECT(table.Accounts.AllColumns).
@@ -386,21 +285,6 @@ func (s *Store) Identities(ctx context.Context, accountID uuid.UUID) ([]Identity
 	return out, nil
 }
 
-// HasConfirmedEmail reports whether the account owns a confirmed email identity — the direct-rail
-// recovery anchor a first purchase requires (D36).
-func (s *Store) HasConfirmedEmail(ctx context.Context, accountID uuid.UUID) (bool, error) {
-	ids, err := s.Identities(ctx, accountID)
-	if err != nil {
-		return false, err
-	}
-	for _, id := range ids {
-		if id.Kind == "email" && id.Confirmed {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
 // ListAccounts returns accounts for the admin user list, newest first, paginated
 // by limit and offset.
 func (s *Store) ListAccounts(ctx context.Context, limit, offset int) ([]Account, error) {
@@ -477,22 +361,16 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 
 	var created Account
 	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Seed the new row's display name, language and time zone (first contact); an
-		// empty seed reproduces the table defaults ('', 'en' and 'UTC') the other callers
-		// relied on, so their behaviour is unchanged. time_zone is written explicitly (the
-		// detected offset, or 'UTC' equal to the column default) so a seeded zone lands at
-		// creation while an unseeded one stays UTC.
+		// Seed the new row's display name and language (Telegram first contact); an
+		// empty seed reproduces the table defaults ('' and 'en') the other callers
+		// relied on, so their behaviour is unchanged.
 		lang := seed.preferredLanguage
 		if lang == "" {
 			lang = "en"
 		}
-		tz := seed.timeZone
-		if tz == "" {
-			tz = "UTC"
-		}
 		insertAccount := table.Accounts.
-			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone, table.Accounts.IsGuest).
-			VALUES(accountID, seed.displayName, lang, tz, seed.isGuest).
+			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage).
+			VALUES(accountID, seed.displayName, lang).
 			RETURNING(table.Accounts.AllColumns)
 
 		var row model.Accounts
@@ -506,7 +384,7 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 			table.Identities.Kind,
 			table.Identities.ExternalID,
 			table.Identities.Confirmed,
-		).VALUES(identityID, accountID, kind, externalID, kind == KindTelegram || kind == KindVK)
+		).VALUES(identityID, accountID, kind, externalID, kind == KindTelegram)
 		if _, err := insertIdentity.ExecContext(ctx, tx); err != nil {
 			return err
 		}
@@ -531,29 +409,15 @@ const guestDisplayName = "Guest"
 // ProvisionGuest creates a fresh ephemeral guest account: a durable row carrying
 // no identity, flagged is_guest, so it can hold a session and a game seat (both
 // foreign-key the accounts table) while being excluded from statistics, friends
-// and history. Guests are not reused — each bootstrap mints a new account. browserTZ
-// (the client's detected "±HH:MM" UTC offset) seeds the guest's time zone, falling
-// back to the 'UTC' default when empty or malformed.
-func (s *Store) ProvisionGuest(ctx context.Context, browserTZ, language string) (Account, error) {
+// and history. Guests are not reused — each bootstrap mints a new account.
+func (s *Store) ProvisionGuest(ctx context.Context) (Account, error) {
 	accountID, err := uuid.NewV7()
 	if err != nil {
 		return Account{}, fmt.Errorf("account: new guest id: %w", err)
 	}
-	tz := seedZone(browserTZ)
-	if tz == "" {
-		tz = "UTC"
-	}
-	// Seed the interface language from the client's detected locale (validated to a supported
-	// one), so a fresh guest's language-dependent server content — the ad banner, bot messages —
-	// is right from first contact rather than the 'en' column default until the client's later
-	// language reconcile catches up. An unsupported or absent code keeps the 'en' default.
-	lang := supportedLanguage(language)
-	if lang == "" {
-		lang = "en"
-	}
 	stmt := table.Accounts.
-		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest, table.Accounts.TimeZone, table.Accounts.PreferredLanguage).
-		VALUES(accountID, guestDisplayName, true, tz, lang).
+		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest).
+		VALUES(accountID, guestDisplayName, true).
 		RETURNING(table.Accounts.AllColumns)
 
 	var row model.Accounts
@@ -564,6 +428,52 @@ func (s *Store) ProvisionGuest(ctx context.Context, browserTZ, language string)
 	return modelToAccount(row), nil
 }
 
+// SpendHint atomically decrements the account's hint wallet by one, returning
+// true when a hint was spent and false when the balance was already empty. The
+// guarded UPDATE keeps it safe under concurrent spends across the player's games.
+func (s *Store) SpendHint(ctx context.Context, id uuid.UUID) (bool, error) {
+	stmt := table.Accounts.
+		UPDATE(table.Accounts.HintBalance, table.Accounts.UpdatedAt).
+		SET(table.Accounts.HintBalance.SUB(postgres.Int(1)), postgres.TimestampzT(time.Now().UTC())).
+		WHERE(
+			table.Accounts.AccountID.EQ(postgres.UUID(id)).
+				AND(table.Accounts.HintBalance.GT(postgres.Int(0))),
+		)
+	res, err := stmt.ExecContext(ctx, s.db)
+	if err != nil {
+		return false, fmt.Errorf("account: spend hint %s: %w", id, err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("account: spend hint rows %s: %w", id, err)
+	}
+	return n > 0, nil
+}
+
+// GrantHints adds n hints to the account's wallet and returns the new balance. n must be
+// positive: the additive update can only raise the balance, never lower it, so it enforces the
+// admin console's raise-only rule by construction and stays correct under a concurrent SpendHint.
+// It returns ErrNotFound when no account matches.
+func (s *Store) GrantHints(ctx context.Context, id uuid.UUID, n int) (int, error) {
+	if n <= 0 {
+		return 0, fmt.Errorf("account: grant hints %s: n must be positive, got %d", id, n)
+	}
+	stmt := table.Accounts.
+		UPDATE(table.Accounts.HintBalance, table.Accounts.UpdatedAt).
+		SET(table.Accounts.HintBalance.ADD(postgres.Int(int64(n))), postgres.TimestampzT(time.Now().UTC())).
+		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(id))).
+		RETURNING(table.Accounts.HintBalance)
+
+	var row model.Accounts
+	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
+		if errors.Is(err, qrm.ErrNoRows) {
+			return 0, ErrNotFound
+		}
+		return 0, fmt.Errorf("account: grant hints %s: %w", id, err)
+	}
+	return int(row.HintBalance), nil
+}
+
 // FlagHighRate stamps the soft "suspected high-rate" marker with at, only when
 // the account is not already flagged — the first sustained episode wins, and a
 // re-flag after an operator clear starts a fresh timestamp. An infra marker, not
@@ -619,10 +529,12 @@ func modelToAccount(row model.Accounts) Account {
 		TimeZone:               row.TimeZone,
 		AwayStart:              row.AwayStart,
 		AwayEnd:                row.AwayEnd,
+		HintBalance:            int(row.HintBalance),
 		BlockChat:              row.BlockChat,
 		BlockFriendRequests:    row.BlockFriendRequests,
 		IsGuest:                row.IsGuest,
 		NotificationsInAppOnly: row.NotificationsInAppOnly,
+		PaidAccount:            row.PaidAccount,
 		MergedInto:             mergedInto,
 		FlaggedHighRateAt:      flaggedHighRateAt,
 		CreatedAt:              row.CreatedAt,

backend/internal/account/email.go

@@ -5,7 +5,6 @@ import (
 	crand "crypto/rand"
 	"crypto/sha256"
 	"database/sql"
-	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -27,22 +26,6 @@ const (
 	emailCodeTTL = 15 * time.Minute
 	// emailCodeMaxAttempts caps wrong-code submissions before a code is dead.
 	emailCodeMaxAttempts = 5
-	// linkTokenBytes is the entropy of a confirm deeplink token: 256 bits.
-	linkTokenBytes = 32
-	// emailConfirmPath is the SPA route the one-tap confirm deeplink opens (the token
-	// is appended). The SPA is served under /app/ behind a hash router.
-	emailConfirmPath = "/app/#/confirm/"
-)
-
-// Confirmation purposes recorded on a pending confirm-code row. They select what
-// verifying the code or the deeplink token does: sign in (login), link/confirm the
-// address on the current account (link), or replace the account's confirmed email with
-// a new address (change). Account deletion adds a further purpose in a later stage.
-const (
-	purposeLogin  = "login"
-	purposeLink   = "link"
-	purposeChange = "change"
-	purposeDelete = "delete"
 )
 
 // Errors returned by the email confirm-code flow.
@@ -63,12 +46,6 @@ var (
 	ErrTooManyAttempts = errors.New("account: too many confirmation attempts")
 	// ErrCodeMismatch is returned when the submitted code does not match.
 	ErrCodeMismatch = errors.New("account: confirmation code does not match")
-	// ErrTooManyRequests is returned when confirm-code sends to an address are being
-	// requested too frequently (the resend cooldown or the rolling-hour cap).
-	ErrTooManyRequests = errors.New("account: too many code requests")
-	// ErrNoEmail is returned when an email-code step-up is requested for an account that
-	// holds no confirmed email (the caller must use the typed-phrase path instead).
-	ErrNoEmail = errors.New("account: no confirmed email")
 )
 
 // EmailService runs the email confirm-code flow: it issues a 6-digit code over a
@@ -78,82 +55,14 @@ var (
 // account is refused (ErrEmailTaken) — merging two accounts is the link/merge flow —
 // and using an email as a login reuses this mechanism.
 type EmailService struct {
-	store   *Store
-	mailer  Mailer
-	baseURL string
-	limiter *SendLimiter
-	now     func() time.Time
+	store  *Store
+	mailer Mailer
+	now    func() time.Time
 }
 
-// NewEmailService constructs an EmailService over store, sending via mailer. baseURL
-// is the canonical public origin (scheme + host) used to build the one-tap confirm
-// deeplink and the email footer landing link; an empty baseURL omits the deeplink
-// (development / log mailer).
-func NewEmailService(store *Store, mailer Mailer, baseURL string) *EmailService {
-	return &EmailService{store: store, mailer: mailer, baseURL: baseURL, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// SetSendLimiter installs a per-recipient send throttle. When unset (nil), sends are
-// not throttled — production wires a limiter; tests leave it off.
-func (s *EmailService) SetSendLimiter(l *SendLimiter) { s.limiter = l }
-
-// allowSend reports whether a confirm-code send to email is permitted now, recording
-// it when so. A nil limiter permits every send.
-func (s *EmailService) allowSend(email string) bool {
-	return s.limiter == nil || s.limiter.Allow(email)
-}
-
-// issueCode generates a fresh confirm-code and one-tap deeplink token for (accountID,
-// email), replaces any prior pending confirmation, and mails the branded code in
-// locale; purpose selects the email wording and what verifying does. omitLink drops the
-// one-tap deeplink from the email (account deletion, or a login requested from an installed
-// PWA). Only the SHA-256 hashes of the code and token are stored.
-func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string, omitLink bool) error {
-	code, codeHash, err := generateCode()
-	if err != nil {
-		return err
-	}
-	token, tokenHash, err := generateLinkToken()
-	if err != nil {
-		return err
-	}
-	if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, tokenHash, purpose, s.now().Add(emailCodeTTL)); err != nil {
-		return err
-	}
-	// Omit the one-tap deeplink when asked: for a login from an installed PWA (the link would
-	// open in a separate browser whose minted session cannot reach the PWA), or for account
-	// deletion (a prefetch or stray click must not delete an account — the delete code is entered
-	// in the app only, and ConfirmByToken refuses a delete token).
-	deeplink := s.confirmURL(token, locale)
-	if purpose == purposeDelete || omitLink {
-		deeplink = ""
-	}
-	msg, err := renderConfirmationEmail(purpose, code, deeplink, s.baseURL, locale)
-	if err != nil {
-		return err
-	}
-	msg.To = email
-	return s.mailer.Send(ctx, msg)
-}
-
-// confirmURL builds the absolute one-tap confirm deeplink for token in locale, or ""
-// when no public base URL is configured. The locale rides the fragment as ?lang so the
-// confirm screen (opened in a browser with no session) renders in the email's language.
-func (s *EmailService) confirmURL(token, locale string) string {
-	if s.baseURL == "" {
-		return ""
-	}
-	return strings.TrimRight(s.baseURL, "/") + emailConfirmPath + token + "?lang=" + normalizeLocale(locale)
-}
-
-// accountLocale returns the account's preferred UI language for localising email,
-// defaulting to "en" when the account cannot be loaded.
-func (s *EmailService) accountLocale(ctx context.Context, accountID uuid.UUID) string {
-	acc, err := s.store.GetByID(ctx, accountID)
-	if err != nil {
-		return "en"
-	}
-	return acc.PreferredLanguage
+// NewEmailService constructs an EmailService over store, sending via mailer.
+func NewEmailService(store *Store, mailer Mailer) *EmailService {
+	return &EmailService{store: store, mailer: mailer, now: func() time.Time { return time.Now().UTC() }}
 }
 
 // RequestCode issues a fresh confirm-code for email to accountID and mails it,
@@ -164,9 +73,6 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
 	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
 	if err != nil {
 		return err
@@ -177,7 +83,16 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 		}
 		return ErrEmailTaken
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
+	code, hash, err := generateCode()
+	if err != nil {
+		return err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }
 
 // ConfirmCode verifies code for accountID and email. On success it attaches a
@@ -208,38 +123,34 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 	if err := s.store.confirmEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	// Binding the first confirmed email promotes a guest to a durable account, matching the
-	// link and deeplink flows (defence-in-depth: no confirmed-email path leaves is_guest set).
-	if err := s.store.ClearGuest(ctx, accountID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, accountID)
 }
 
 // RequestLoginCode issues a login confirm-code to the account that owns email,
-// provisioning a fresh (unconfirmed) guest account when the email is new — it becomes
-// durable once the code is confirmed. It is the unauthenticated email-login entry
-// point and, unlike RequestCode, does not refuse an already-confirmed email — that is
-// the ordinary returning-user login. The code is mailed to the address, so only its
-// real owner can complete the login. On first contact browserTZ (the client's
-// detected "±HH:MM" UTC offset) seeds the new account's time zone and language its UI
-// language. When pwa is set (the request came from an installed PWA) the login email omits the
-// one-tap confirm link — it would open in a separate browser, out of the PWA's reach — so the
-// code is entered in the same window. It returns the target account id for the subsequent
-// LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string, pwa bool) (uuid.UUID, error) {
+// provisioning a fresh (unconfirmed) durable account when the email is new. It is
+// the unauthenticated email-login entry point and, unlike RequestCode,
+// does not refuse an already-confirmed email — that is the ordinary returning-user
+// login. The code is mailed to the address, so only its real owner can complete
+// the login. It returns the target account id for the subsequent LoginWithCode.
+func (s *EmailService) RequestLoginCode(ctx context.Context, email string) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if !s.allowSend(addr) {
-		return uuid.UUID{}, ErrTooManyRequests
-	}
-	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ, language)
+	acc, err := s.store.ProvisionByIdentity(ctx, KindEmail, addr)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language, pwa); err != nil {
+	code, hash, err := generateCode()
+	if err != nil {
+		return uuid.UUID{}, err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, acc.ID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return uuid.UUID{}, err
+	}
+	subject := "Your Scrabble login code"
+	body := fmt.Sprintf("Your login code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	if err := s.mailer.Send(ctx, addr, subject, body); err != nil {
 		return uuid.UUID{}, err
 	}
 	return acc.ID, nil
@@ -278,104 +189,9 @@ func (s *EmailService) LoginWithCode(ctx context.Context, email, code string) (A
 	if err := s.store.confirmEmailLogin(ctx, conf.id, acc.ID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	if err := s.store.ClearGuest(ctx, acc.ID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, acc.ID)
 }
 
-// LinkConfirmation is the outcome of confirming a one-tap deeplink token: what the
-// transport layer must finish. Purpose is the pending row's purpose. For a login,
-// Account is the account to sign in. For a link, Account is the account the email was
-// (or would be) attached to; NeedsMerge is set when another account (MergeOwner)
-// already owns the address, so the caller drives the interactive merge instead of a
-// plain link — the token is left unconsumed for that merge step.
-type LinkConfirmation struct {
-	Purpose    string
-	Account    uuid.UUID
-	NeedsMerge bool
-	MergeOwner uuid.UUID
-}
-
-// IsLogin reports whether the confirmation is a login (the caller mints a session)
-// rather than a link (attach the identity, or drive a merge).
-func (r LinkConfirmation) IsLogin() bool { return r.Purpose == purposeLogin }
-
-// ConfirmByToken verifies a one-tap deeplink token and performs its purpose. A login
-// confirms the email identity, clears the guest flag and returns the account to sign
-// in. A link attaches the confirmed email to the pending account when the address is
-// free, or reports NeedsMerge when another account already owns it (leaving the token
-// live so the caller's merge step can re-verify). It returns ErrNoPendingCode when the
-// token matches no live confirmation and ErrCodeExpired when it has lapsed. The token
-// is high-entropy, so there is no wrong-attempt counter.
-func (s *EmailService) ConfirmByToken(ctx context.Context, token string) (LinkConfirmation, error) {
-	pend, err := s.store.pendingByTokenHash(ctx, hashCode(token))
-	if err != nil {
-		return LinkConfirmation{}, err
-	}
-	if s.now().After(pend.expiresAt) {
-		return LinkConfirmation{}, ErrCodeExpired
-	}
-	switch pend.purpose {
-	case purposeLogin:
-		if err := s.store.confirmEmailLogin(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLogin, Account: pend.accountID}, nil
-	case purposeLink:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok {
-			if owner == pend.accountID {
-				if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-					return LinkConfirmation{}, err
-				}
-				return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-			}
-			return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID, NeedsMerge: true, MergeOwner: owner}, nil
-		}
-		if err := s.store.confirmEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		// Binding the first email promotes a guest to a durable account, matching the
-		// code-based link flow (which clears the guest flag in the link service).
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-	case purposeChange:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok && owner != pend.accountID {
-			// The new address is confirmed by a different account: refuse without
-			// disclosing it (anti-enumeration). Unlike a link, a change never merges.
-			return LinkConfirmation{}, ErrEmailTaken
-		}
-		if ok && owner == pend.accountID {
-			if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-				return LinkConfirmation{}, err
-			}
-			return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-		}
-		if err := s.store.replaceEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-	case purposeDelete:
-		// Deletion is confirmed in the app with the code, never via a one-tap link.
-		return LinkConfirmation{}, fmt.Errorf("account: deletion cannot be confirmed by link")
-	default:
-		return LinkConfirmation{}, fmt.Errorf("account: unsupported confirmation purpose %q", pend.purpose)
-	}
-}
-
 // emailConfirmation is a pending confirm-code row in domain form.
 type emailConfirmation struct {
 	id        uuid.UUID
@@ -404,30 +220,9 @@ func (s *Store) confirmedEmailAccount(ctx context.Context, email string) (uuid.U
 	return row.AccountID, true, nil
 }
 
-// confirmedEmailOf returns the account's confirmed email address and true, or ("", false)
-// when it holds none. It backs the deletion step-up, which mails a code to the account's
-// own address.
-func (s *Store) confirmedEmailOf(ctx context.Context, accountID uuid.UUID) (string, bool, error) {
-	stmt := postgres.SELECT(table.Identities.ExternalID).
-		FROM(table.Identities).
-		WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))).
-				AND(table.Identities.Confirmed.EQ(postgres.Bool(true))),
-		).LIMIT(1)
-	var row model.Identities
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return "", false, nil
-		}
-		return "", false, fmt.Errorf("account: confirmed email of %s: %w", accountID, err)
-	}
-	return row.ExternalID, true, nil
-}
-
 // replacePendingConfirmation clears any pending code for (accountID, email) and
 // inserts a fresh one, inside one transaction.
-func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash, linkTokenHash, purpose string, expiresAt time.Time) error {
+func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash string, expiresAt time.Time) error {
 	id, err := uuid.NewV7()
 	if err != nil {
 		return fmt.Errorf("account: new confirmation id: %w", err)
@@ -444,8 +239,7 @@ func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.U
 		ins := table.EmailConfirmations.INSERT(
 			table.EmailConfirmations.ConfirmationID, table.EmailConfirmations.AccountID,
 			table.EmailConfirmations.Email, table.EmailConfirmations.CodeHash, table.EmailConfirmations.ExpiresAt,
-			table.EmailConfirmations.LinkTokenHash, table.EmailConfirmations.Purpose,
-		).VALUES(id, accountID, email, codeHash, expiresAt, linkTokenHash, purpose)
+		).VALUES(id, accountID, email, codeHash, expiresAt)
 		if _, err := ins.ExecContext(ctx, tx); err != nil {
 			return fmt.Errorf("insert confirmation: %w", err)
 		}
@@ -478,54 +272,6 @@ func (s *Store) latestPendingConfirmation(ctx context.Context, accountID uuid.UU
 	}, nil
 }
 
-// pendingConfirmation is a pending confirm-code row loaded by its deeplink token, in
-// domain form.
-type pendingConfirmation struct {
-	id        uuid.UUID
-	accountID uuid.UUID
-	email     string
-	purpose   string
-	expiresAt time.Time
-}
-
-// pendingByTokenHash loads the unconsumed confirmation whose deeplink token hashes to
-// tokenHash, or ErrNoPendingCode. The high-entropy token needs no attempt counter, so
-// a partial-unique index guarantees at most one match.
-func (s *Store) pendingByTokenHash(ctx context.Context, tokenHash string) (pendingConfirmation, error) {
-	stmt := postgres.SELECT(table.EmailConfirmations.AllColumns).
-		FROM(table.EmailConfirmations).
-		WHERE(
-			table.EmailConfirmations.LinkTokenHash.EQ(postgres.String(tokenHash)).
-				AND(table.EmailConfirmations.ConsumedAt.IS_NULL()),
-		).LIMIT(1)
-	var row model.EmailConfirmations
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return pendingConfirmation{}, ErrNoPendingCode
-		}
-		return pendingConfirmation{}, fmt.Errorf("account: load confirmation by token: %w", err)
-	}
-	return pendingConfirmation{
-		id:        row.ConfirmationID,
-		accountID: row.AccountID,
-		email:     row.Email,
-		purpose:   row.Purpose,
-		expiresAt: row.ExpiresAt,
-	}, nil
-}
-
-// consumeConfirmation marks a confirmation consumed without writing an identity, used
-// for the idempotent already-linked deeplink path.
-func (s *Store) consumeConfirmation(ctx context.Context, id uuid.UUID, now time.Time) error {
-	upd := table.EmailConfirmations.UPDATE(table.EmailConfirmations.ConsumedAt).
-		SET(postgres.TimestampzT(now)).
-		WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(id)))
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: consume confirmation: %w", err)
-	}
-	return nil
-}
-
 // bumpConfirmationAttempts increments a code's wrong-attempt counter by one.
 func (s *Store) bumpConfirmationAttempts(ctx context.Context, id uuid.UUID) error {
 	stmt := table.EmailConfirmations.
@@ -572,69 +318,6 @@ func (s *Store) confirmEmailIdentity(ctx context.Context, confirmationID, accoun
 	return nil
 }
 
-// replaceEmailIdentity consumes the confirmation, deletes the account's existing email
-// identity (freeing the old address) and inserts newEmail as its confirmed email, inside
-// one transaction. It backs the change-email flow. A unique-constraint violation — the
-// new address was confirmed elsewhere in the meantime — surfaces as ErrEmailTaken. When
-// the account holds no email identity yet the delete is a no-op, so this doubles as an
-// attach.
-func (s *Store) replaceEmailIdentity(ctx context.Context, confirmationID, accountID uuid.UUID, newEmail string, now time.Time) error {
-	identityID, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new identity id: %w", err)
-	}
-	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		upd := table.EmailConfirmations.
-			UPDATE(table.EmailConfirmations.ConsumedAt).
-			SET(postgres.TimestampzT(now)).
-			WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(confirmationID)))
-		if _, err := upd.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("consume confirmation: %w", err)
-		}
-		// Journal the outgoing email before replacing it, so the legal dossier keeps the
-		// address the account used to hold (see retention.go).
-		var old model.Identities
-		sel := postgres.SELECT(
-			table.Identities.ExternalID, table.Identities.Confirmed, table.Identities.CreatedAt,
-		).FROM(table.Identities).WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		).LIMIT(1)
-		switch err := sel.QueryContext(ctx, tx, &old); {
-		case err == nil:
-			if err := retainIdentityTx(ctx, tx, accountID, KindEmail, old.ExternalID, old.Confirmed, old.CreatedAt, retainChange); err != nil {
-				return err
-			}
-		case errors.Is(err, qrm.ErrNoRows):
-			// No prior email (this doubles as an attach); nothing to retain.
-		default:
-			return fmt.Errorf("load outgoing email identity: %w", err)
-		}
-		del := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		)
-		if _, err := del.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("delete old email identity: %w", err)
-		}
-		ins := table.Identities.INSERT(
-			table.Identities.IdentityID, table.Identities.AccountID, table.Identities.Kind,
-			table.Identities.ExternalID, table.Identities.Confirmed,
-		).VALUES(identityID, accountID, KindEmail, newEmail, true)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return err
-		}
-		return nil
-	})
-	if err != nil {
-		if isUniqueViolation(err) {
-			return ErrEmailTaken
-		}
-		return fmt.Errorf("account: replace email identity: %w", err)
-	}
-	return nil
-}
-
 // confirmEmailLogin consumes the login code and marks the existing email
 // identity confirmed, inside one transaction. The identity already exists (a
 // login provisioned it), so this updates rather than inserts and is idempotent
@@ -682,18 +365,6 @@ func generateCode() (code, hash string, err error) {
 	return code, hashCode(code), nil
 }
 
-// generateLinkToken returns a fresh opaque one-tap confirm deeplink token (URL-safe
-// base64, 256-bit) and its hex SHA-256 hash. Only the hash is stored; the token
-// travels only in the emailed link, mirroring the session-token model.
-func generateLinkToken() (token, hash string, err error) {
-	buf := make([]byte, linkTokenBytes)
-	if _, err := crand.Read(buf); err != nil {
-		return "", "", fmt.Errorf("account: generate link token: %w", err)
-	}
-	token = base64.RawURLEncoding.EncodeToString(buf)
-	return token, hashCode(token), nil
-}
-
 // hashCode returns the hex-encoded SHA-256 of a confirm-code.
 func hashCode(code string) string {
 	sum := sha256.Sum256([]byte(code))

backend/internal/account/emailtemplate.go

@@ -1,239 +0,0 @@
-package account
-
-import (
-	"fmt"
-	"html/template"
-	"strings"
-	tmpltext "text/template"
-	"time"
-)
-
-// emailBrandColor is the single accent used in the confirmation email — a calm
-// tile green, matching the "no riot of colours" brief.
-const emailBrandColor = "#2f7d4f"
-
-// confirmEmailView is the fully-localised data the confirmation email templates
-// render. Every string is resolved before rendering, so the templates carry no
-// localisation logic.
-type confirmEmailView struct {
-	Brand        string
-	Heading      string
-	Intro        string
-	Code         string
-	Expiry       string
-	CTALabel     string
-	DeeplinkURL  string
-	FooterIgnore string
-	LandingURL   string
-	LandingLabel string
-	Preheader    string
-	Locale       string
-	Accent       string
-}
-
-// emailCopy is the purpose- and locale-specific wording of a confirmation email.
-type emailCopy struct {
-	Subject      string
-	Preheader    string
-	Heading      string
-	Intro        string
-	CTALabel     string
-	FooterIgnore string
-}
-
-// confirmEmailCopy holds the wording per (purpose, locale). Unknown purposes fall
-// back to the neutral link wording and unknown locales fall back to English.
-var confirmEmailCopy = map[string]map[string]emailCopy{
-	purposeLogin: {
-		"en": {
-			Subject:      "Your Erudit sign-in code",
-			Preheader:    "Your sign-in code",
-			Heading:      "Sign in to Erudit",
-			Intro:        "Enter this code to sign in:",
-			CTALabel:     "Sign in with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код для входа в Эрудит",
-			Preheader:    "Ваш код для входа",
-			Heading:      "Вход в Эрудит",
-			Intro:        "Введите этот код, чтобы войти в игру:",
-			CTALabel:     "Войти одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeLink: {
-		"en": {
-			Subject:      "Your Erudit confirmation code",
-			Preheader:    "Your confirmation code",
-			Heading:      "Confirm your e-mail",
-			Intro:        "Enter this code to confirm your address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код подтверждения Эрудит",
-			Preheader:    "Ваш код подтверждения",
-			Heading:      "Подтверждение e-mail",
-			Intro:        "Введите этот код, чтобы подтвердить адрес:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeChange: {
-		"en": {
-			Subject:      "Confirm your new Erudit e-mail",
-			Preheader:    "Confirm your new address",
-			Heading:      "Confirm your new e-mail",
-			Intro:        "Enter this code to switch your account to this address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this change, you can safely ignore it — your address stays the same.",
-		},
-		"ru": {
-			Subject:      "Подтвердите новый e-mail в Эрудит",
-			Preheader:    "Подтвердите новый адрес",
-			Heading:      "Смена e-mail",
-			Intro:        "Введите этот код, чтобы привязать аккаунт к новому адресу:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали смену, просто проигнорируйте письмо — адрес останется прежним.",
-		},
-	},
-	purposeDelete: {
-		"en": {
-			Subject:      "Confirm your Erudit account deletion",
-			Preheader:    "Confirm account deletion",
-			Heading:      "Delete your account",
-			Intro:        "Enter this code in the app to permanently delete your account:",
-			CTALabel:     "",
-			FooterIgnore: "If you didn't request this, ignore it — your account stays as it is.",
-		},
-		"ru": {
-			Subject:      "Подтвердите удаление аккаунта Эрудит",
-			Preheader:    "Подтверждение удаления аккаунта",
-			Heading:      "Удаление аккаунта",
-			Intro:        "Введите этот код в приложении, чтобы удалить аккаунт без восстановления:",
-			CTALabel:     "",
-			FooterIgnore: "Если вы не запрашивали удаление, проигнорируйте письмо — аккаунт останется.",
-		},
-	},
-}
-
-// emailBrand is the brand wordmark per locale.
-var emailBrand = map[string]string{"en": "Erudit", "ru": "Эрудит"}
-
-// emailExpiry formats the code-lifetime line per locale (abbreviated minutes to
-// avoid plural agreement).
-func emailExpiry(locale string, d time.Duration) string {
-	min := int(d / time.Minute)
-	if locale == "ru" {
-		return fmt.Sprintf("Код действует %d мин.", min)
-	}
-	return fmt.Sprintf("The code is valid for %d minutes.", min)
-}
-
-// normalizeLocale maps an account language to a supported email locale, defaulting
-// to English.
-func normalizeLocale(locale string) string {
-	if locale == "ru" {
-		return "ru"
-	}
-	return "en"
-}
-
-// renderConfirmationEmail builds the branded confirmation email for purpose in
-// locale: a large readable code plus a one-tap deeplink button, with an
-// ignore-notice footer and a landing link. Both a plain-text body and an HTML
-// alternative are produced. deeplinkURL is the absolute /confirm link and
-// landingURL the public landing origin.
-func renderConfirmationEmail(purpose, code, deeplinkURL, landingURL, locale string) (Message, error) {
-	loc := normalizeLocale(locale)
-	byLocale, ok := confirmEmailCopy[purpose]
-	if !ok {
-		byLocale = confirmEmailCopy[purposeLink]
-	}
-	cp := byLocale[loc]
-	view := confirmEmailView{
-		Brand:        emailBrand[loc],
-		Heading:      cp.Heading,
-		Intro:        cp.Intro,
-		Code:         code,
-		Expiry:       emailExpiry(loc, emailCodeTTL),
-		CTALabel:     cp.CTALabel,
-		DeeplinkURL:  deeplinkURL,
-		FooterIgnore: cp.FooterIgnore,
-		LandingURL:   landingURL,
-		LandingLabel: emailBrand[loc],
-		Preheader:    cp.Preheader,
-		Locale:       loc,
-		Accent:       emailBrandColor,
-	}
-	var html strings.Builder
-	if err := confirmEmailHTML.Execute(&html, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (html): %w", err)
-	}
-	var text strings.Builder
-	if err := confirmEmailText.Execute(&text, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (text): %w", err)
-	}
-	return Message{Subject: cp.Subject, Text: text.String(), HTML: html.String()}, nil
-}
-
-// confirmEmailHTML is a compact, image-free, mobile-friendly HTML email. Layout is
-// table-based for broad mail-client compatibility and all styling is inlined
-// because clients strip <style> blocks.
-var confirmEmailHTML = template.Must(template.New("confirmEmailHTML").Parse(`<!DOCTYPE html>
-<html lang="{{.Locale}}">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>{{.Brand}}</title>
-</head>
-<body style="margin:0;padding:0;background:#f4f5f7;">
-<span style="display:none;max-height:0;overflow:hidden;opacity:0;">{{.Preheader}}</span>
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f4f5f7;padding:24px 12px;">
-<tr><td align="center">
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:460px;background:#ffffff;border:1px solid #e5e7eb;border-radius:14px;overflow:hidden;font-family:-apple-system,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
-<tr><td style="padding:28px 32px 4px;">
-<div style="font-size:15px;font-weight:700;letter-spacing:.04em;color:{{.Accent}};">{{.Brand}}</div>
-</td></tr>
-<tr><td style="padding:8px 32px 0;">
-<h1 style="margin:0;font-size:20px;line-height:1.3;color:#111827;font-weight:600;">{{.Heading}}</h1>
-<p style="margin:12px 0 0;font-size:15px;line-height:1.5;color:#374151;">{{.Intro}}</p>
-</td></tr>
-<tr><td style="padding:18px 32px 0;">
-<div style="font-size:34px;font-weight:700;letter-spacing:8px;text-align:center;color:#111827;background:#f3f4f6;border-radius:10px;padding:18px 0;font-family:'SFMono-Regular',Consolas,Menlo,monospace;">{{.Code}}</div>
-<p style="margin:10px 0 0;font-size:13px;line-height:1.5;color:#6b7280;text-align:center;">{{.Expiry}}</p>
-</td></tr>
-{{if .DeeplinkURL}}<tr><td style="padding:22px 32px 0;" align="center">
-<a href="{{.DeeplinkURL}}" style="display:inline-block;background:{{.Accent}};color:#ffffff;text-decoration:none;font-size:15px;font-weight:600;padding:12px 26px;border-radius:9px;">{{.CTALabel}}</a>
-</td></tr>
-{{end}}<tr><td style="padding:26px 32px 28px;">
-<hr style="border:none;border-top:1px solid #eceef1;margin:0 0 16px;">
-<p style="margin:0;font-size:12px;line-height:1.6;color:#9ca3af;">{{.FooterIgnore}}</p>
-<p style="margin:10px 0 0;font-size:12px;color:#9ca3af;"><a href="{{.LandingURL}}" style="color:#6b7280;text-decoration:none;">{{.LandingLabel}}</a></p>
-</td></tr>
-</table>
-</td></tr>
-</table>
-</body>
-</html>
-`))
-
-// confirmEmailText is the plain-text alternative (and multipart fallback).
-var confirmEmailText = tmpltext.Must(tmpltext.New("confirmEmailText").Parse(`{{.Brand}}
-
-{{.Heading}}
-
-{{.Intro}}
-
-    {{.Code}}
-
-{{.Expiry}}
-
-{{if .DeeplinkURL}}{{.CTALabel}}:
-{{.DeeplinkURL}}
-
-{{end}}—
-{{.FooterIgnore}}
-{{.LandingLabel}} — {{.LandingURL}}
-`))

backend/internal/account/emailtemplate_test.go

@@ -1,54 +0,0 @@
-package account
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestRenderConfirmationEmail checks that each (purpose, locale) renders a localised
-// subject, embeds the code and the one-tap deeplink in both bodies, and produces HTML.
-func TestRenderConfirmationEmail(t *testing.T) {
-	const deeplink = "https://erudit-game.ru/app/#/confirm/tok123"
-	cases := []struct {
-		name, purpose, locale, subjectSub string
-	}{
-		{"login ru", purposeLogin, "ru", "вход"},
-		{"login en", purposeLogin, "en", "sign-in"},
-		{"link ru", purposeLink, "ru", "подтвержд"},
-		{"link en", purposeLink, "en", "confirmation"},
-		{"change ru", purposeChange, "ru", "новый"},
-		{"change en", purposeChange, "en", "new"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			msg, err := renderConfirmationEmail(c.purpose, "123456", deeplink, "https://erudit-game.ru", c.locale)
-			if err != nil {
-				t.Fatalf("render: %v", err)
-			}
-			if !strings.Contains(strings.ToLower(msg.Subject), c.subjectSub) {
-				t.Errorf("subject %q does not contain %q", msg.Subject, c.subjectSub)
-			}
-			if !strings.Contains(msg.Text, "123456") || !strings.Contains(msg.HTML, "123456") {
-				t.Error("code missing from a body")
-			}
-			if !strings.Contains(msg.Text, deeplink) || !strings.Contains(msg.HTML, "confirm/tok123") {
-				t.Error("deeplink missing from a body")
-			}
-			if !strings.Contains(msg.HTML, "<html") {
-				t.Error("HTML body is not HTML")
-			}
-		})
-	}
-}
-
-// TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish falls back to English for an
-// unsupported locale rather than erroring or emitting an empty subject.
-func TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish(t *testing.T) {
-	msg, err := renderConfirmationEmail(purposeLogin, "000000", "", "https://erudit-game.ru", "de")
-	if err != nil {
-		t.Fatalf("render: %v", err)
-	}
-	if !strings.Contains(strings.ToLower(msg.Subject), "sign-in") {
-		t.Errorf("unknown locale should default to English, got subject %q", msg.Subject)
-	}
-}

backend/internal/account/link.go

@@ -2,7 +2,6 @@ package account
 
 import (
 	"context"
-	"database/sql"
 	"errors"
 	"fmt"
 	"time"
@@ -17,68 +16,6 @@ import (
 // belongs to another account; the caller turns it into a merge.
 var ErrIdentityTaken = errors.New("account: identity already linked to another account")
 
-// ErrLastIdentity is returned when removing an identity would leave the account with
-// none, making it unreachable after logout. The admin email-erase refuses it.
-var ErrLastIdentity = errors.New("account: cannot remove the last identity")
-
-// RemoveIdentity deletes the account's identity of the given kind (and, for an email,
-// any pending confirmations for it), freeing it for reuse. It refuses when that is the
-// account's only identity (ErrLastIdentity) — which would leave the account
-// unreachable — and returns ErrNotFound when the account has no identity of that kind.
-// It backs the profile Unlink control and the admin "erase email" action.
-func (s *Store) RemoveIdentity(ctx context.Context, accountID uuid.UUID, kind string) error {
-	ids, err := s.Identities(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	var toRetain []Identity
-	others := 0
-	for _, id := range ids {
-		if id.Kind == kind {
-			toRetain = append(toRetain, id)
-		} else {
-			others++
-		}
-	}
-	if len(toRetain) == 0 {
-		return ErrNotFound
-	}
-	if others == 0 {
-		return ErrLastIdentity
-	}
-	return withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Journal the detached credential before removing it, so the legal dossier
-		// survives while the identity frees for reuse (see retention.go).
-		for _, id := range toRetain {
-			if err := retainIdentityTx(ctx, tx, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainUnlink); err != nil {
-				return err
-			}
-		}
-		delID := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(kind))),
-		)
-		if _, err := delID.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("account: delete %s identity %s: %w", kind, accountID, err)
-		}
-		if kind == KindEmail {
-			delConf := table.EmailConfirmations.DELETE().WHERE(
-				table.EmailConfirmations.AccountID.EQ(postgres.UUID(accountID)),
-			)
-			if _, err := delConf.ExecContext(ctx, tx); err != nil {
-				return fmt.Errorf("account: delete email confirmations %s: %w", accountID, err)
-			}
-		}
-		return nil
-	})
-}
-
-// RemoveEmailIdentity erases the account's email identity. It backs the admin console's
-// "erase email" action; the user-facing profile never unlinks email (it is changed).
-func (s *Store) RemoveEmailIdentity(ctx context.Context, accountID uuid.UUID) error {
-	return s.RemoveIdentity(ctx, accountID, KindEmail)
-}
-
 // RequestLinkCode issues and mails a confirm-code for email to accountID,
 // replacing any prior pending code. Unlike RequestCode it never refuses up front
 // (taken or already-confirmed): possession of the address is the authorization for
@@ -89,10 +26,16 @@ func (s *EmailService) RequestLinkCode(ctx context.Context, accountID uuid.UUID,
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
+	code, hash, err := generateCode()
+	if err != nil {
+		return err
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }
 
 // ConfirmLink verifies code for (accountID, email) and reports the address's
@@ -127,100 +70,6 @@ func (s *EmailService) ConfirmLink(ctx context.Context, accountID uuid.UUID, ema
 	return accountID, true, nil
 }
 
-// RequestChangeCode issues and mails a confirm-code to newEmail for an authenticated
-// email change on accountID, replacing any prior pending code. Like RequestLinkCode it
-// never refuses up front on "taken" (anti-enumeration): possession of newEmail is the
-// authorization, and a conflict with another account is revealed only at confirm — as a
-// non-disclosing refusal, never a merge.
-func (s *EmailService) RequestChangeCode(ctx context.Context, accountID uuid.UUID, newEmail string) error {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return err
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID), false)
-}
-
-// ConfirmChange verifies code for (accountID, newEmail) and atomically replaces the
-// account's confirmed email with newEmail, freeing the old address. When newEmail is
-// already confirmed by another account it refuses with ErrEmailTaken (surfaced to the
-// user as a non-disclosing "check the address or contact support"), never merging; when
-// the account already owns newEmail it is an idempotent no-op. It returns the usual
-// confirm-code errors (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts,
-// ErrCodeMismatch) and the updated account on success.
-func (s *EmailService) ConfirmChange(ctx context.Context, accountID uuid.UUID, newEmail, code string) (Account, error) {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return Account{}, err
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return Account{}, err
-	}
-	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
-	if err != nil {
-		return Account{}, err
-	}
-	if ok && owner != accountID {
-		return Account{}, ErrEmailTaken
-	}
-	if ok && owner == accountID {
-		if err := s.store.consumeConfirmation(ctx, conf.id, s.now()); err != nil {
-			return Account{}, err
-		}
-		return s.store.GetByID(ctx, accountID)
-	}
-	if err := s.store.replaceEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
-		return Account{}, err
-	}
-	return s.store.GetByID(ctx, accountID)
-}
-
-// HasEmail reports whether accountID owns a confirmed email. The account-deletion step-up
-// mails a confirm-code when it does, and falls back to a typed phrase otherwise.
-func (s *EmailService) HasEmail(ctx context.Context, accountID uuid.UUID) (bool, error) {
-	_, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	return ok, err
-}
-
-// RequestDeleteCode mails an account-deletion confirm-code to the account's own confirmed
-// email (no deeplink — deletion is confirmed in the app). It returns ErrNoEmail when the
-// account holds no email, ErrTooManyRequests when throttled.
-func (s *EmailService) RequestDeleteCode(ctx context.Context, accountID uuid.UUID) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID), false)
-}
-
-// VerifyDeleteCode verifies the account-deletion code against the account's own email and
-// consumes it on success. It returns ErrNoEmail (no email), the usual confirm-code errors
-// (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts, ErrCodeMismatch), or nil when the
-// code is valid — the caller then performs the deletion.
-func (s *EmailService) VerifyDeleteCode(ctx context.Context, accountID uuid.UUID, code string) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return err
-	}
-	return s.store.consumeConfirmation(ctx, conf.id, s.now())
-}
-
 // verifyPendingCode loads and checks the pending confirm-code for (accountID,
 // addr), counting a wrong attempt. It returns the confirmation on success.
 func (s *EmailService) verifyPendingCode(ctx context.Context, accountID uuid.UUID, addr, code string) (emailConfirmation, error) {

backend/internal/account/mailer.go

@@ -3,99 +3,33 @@ package account
 import (
 	"context"
 	"fmt"
-	"strconv"
-	"strings"
-	"time"
+	"net"
+	"net/smtp"
 
-	"github.com/wneessen/go-mail"
 	"go.uber.org/zap"
 )
 
-// Message is a transactional email to send through a Mailer. Text is the
-// required plain-text body and doubles as the multipart/alternative fallback;
-// HTML, when non-empty, is the preferred body a capable client renders instead.
-type Message struct {
-	// To is the recipient address, or several comma-separated (all get the one message).
-	To string
-	// From, when non-empty, overrides the configured sender for this message — the admin
-	// alert path uses a distinct From from the user-facing confirm-code sender.
-	From    string
-	Subject string
-	Text    string
-	HTML    string
-}
-
 // Mailer delivers a transactional email. It is the seam behind which the email
 // confirm-code flow sends codes, so the relay is swappable and unit tests use a
-// fixture (see docs/TESTING.md: no real network in tests). The context bounds the
-// delivery and is honoured by the SMTP implementation.
+// fixture (see docs/TESTING.md: no real network in tests). The context is offered
+// for cancellation; the standard-library SMTP implementation sends synchronously
+// and ignores it.
 type Mailer interface {
-	Send(ctx context.Context, msg Message) error
-}
-
-// splitAddrs splits a comma-separated recipient list into trimmed, non-empty addresses.
-func splitAddrs(list string) []string {
-	parts := strings.Split(list, ",")
-	out := make([]string, 0, len(parts))
-	for _, p := range parts {
-		if a := strings.TrimSpace(p); a != "" {
-			out = append(out, a)
-		}
-	}
-	return out
+	Send(ctx context.Context, to, subject, body string) error
 }
 
 // SMTPConfig configures the SMTP relay. An empty Host selects the LogMailer
 // instead, so a deployment without a relay still runs (the code lands in the log).
-// TLS is always used and no client certificate is required — only the server
-// certificate is validated against the system roots.
 type SMTPConfig struct {
 	Host     string
 	Port     string
 	Username string
 	Password string
 	From     string
-	// TLS selects the transport security: "ssl" for implicit TLS from connect, or
-	// "starttls" to upgrade a plaintext connection. Empty derives the mode from the
-	// port (implicit TLS on 465, STARTTLS otherwise); set it explicitly for a relay on
-	// a non-standard port (e.g. Selectel's 1127 = SSL, 1126 = STARTTLS).
-	TLS string
-	// AdminFrom / AdminTo drive the operator alert emails (new feedback / word complaints),
-	// distinct from the user-facing confirm-code sender. AdminTo may be several
-	// comma-separated addresses. Both empty disables the alert worker.
-	AdminFrom string
-	AdminTo   string
 }
 
-const (
-	// SMTP transport-security modes for SMTPConfig.TLS.
-	smtpTLSImplicit = "ssl"
-	smtpTLSSTARTTLS = "starttls"
-	// smtpDialTimeout bounds a single relay connect-and-send. The confirm-code send
-	// is synchronous on the request path, so an unreachable relay must fail fast
-	// rather than hold the request open.
-	smtpDialTimeout = 15 * time.Second
-)
-
-// tlsMode resolves the transport-security mode for the relay: the explicitly
-// configured SMTPConfig.TLS, or — when unset — implicit TLS on the conventional SSL
-// port 465 and STARTTLS on any other port.
-func (cfg SMTPConfig) tlsMode(port int) string {
-	switch strings.ToLower(strings.TrimSpace(cfg.TLS)) {
-	case smtpTLSImplicit, "tls":
-		return smtpTLSImplicit
-	case smtpTLSSTARTTLS:
-		return smtpTLSSTARTTLS
-	}
-	if port == 465 {
-		return smtpTLSImplicit
-	}
-	return smtpTLSSTARTTLS
-}
-
-// SMTPMailer sends mail through an SMTP relay using go-mail. When a username is
-// set it authenticates, auto-discovering the strongest mechanism the relay
-// advertises; otherwise it relays unauthenticated.
+// SMTPMailer sends mail through an SMTP relay using the standard library. When a
+// username is set it authenticates with PLAIN; otherwise it relays unauthenticated.
 type SMTPMailer struct {
 	cfg SMTPConfig
 }
@@ -105,55 +39,29 @@ func NewSMTPMailer(cfg SMTPConfig) SMTPMailer {
 	return SMTPMailer{cfg: cfg}
 }
 
-// Send delivers a UTF-8 message to msg.To via the configured relay. When msg.HTML
-// is set the message is multipart/alternative (plain text plus HTML); otherwise
-// it is plain text only.
-func (m SMTPMailer) Send(ctx context.Context, msg Message) error {
-	port, err := strconv.Atoi(m.cfg.Port)
-	if err != nil {
-		return fmt.Errorf("account: invalid SMTP port %q: %w", m.cfg.Port, err)
-	}
-	opts := []mail.Option{mail.WithPort(port), mail.WithTimeout(smtpDialTimeout)}
-	if m.cfg.tlsMode(port) == smtpTLSImplicit {
-		opts = append(opts, mail.WithSSL())
-	} else {
-		opts = append(opts, mail.WithTLSPortPolicy(mail.TLSMandatory))
-	}
+// Send delivers a plain-text UTF-8 message to to via the configured relay.
+func (m SMTPMailer) Send(_ context.Context, to, subject, body string) error {
+	addr := net.JoinHostPort(m.cfg.Host, m.cfg.Port)
+	var auth smtp.Auth
 	if m.cfg.Username != "" {
-		opts = append(opts,
-			mail.WithSMTPAuth(mail.SMTPAuthAutoDiscover),
-			mail.WithUsername(m.cfg.Username),
-			mail.WithPassword(m.cfg.Password),
-		)
+		auth = smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
 	}
-	client, err := mail.NewClient(m.cfg.Host, opts...)
-	if err != nil {
-		return fmt.Errorf("account: build mail client: %w", err)
-	}
-	out := mail.NewMsg()
-	from := m.cfg.From
-	if msg.From != "" {
-		from = msg.From
-	}
-	if err := out.From(from); err != nil {
-		return fmt.Errorf("account: set From %q: %w", from, err)
-	}
-	// To may carry several comma-separated recipients; go-mail wants them as separate
-	// arguments (a single joined string parses as one malformed address).
-	if err := out.To(splitAddrs(msg.To)...); err != nil {
-		return fmt.Errorf("account: set To %q: %w", msg.To, err)
-	}
-	out.Subject(msg.Subject)
-	out.SetBodyString(mail.TypeTextPlain, msg.Text)
-	if msg.HTML != "" {
-		out.AddAlternativeString(mail.TypeTextHTML, msg.HTML)
-	}
-	if err := client.DialAndSendWithContext(ctx, out); err != nil {
-		return fmt.Errorf("account: send mail to %s: %w", msg.To, err)
+	if err := smtp.SendMail(addr, auth, m.cfg.From, []string{to}, message(m.cfg.From, to, subject, body)); err != nil {
+		return fmt.Errorf("account: send mail to %s: %w", to, err)
 	}
 	return nil
 }
 
+// message renders a minimal RFC 5322 plain-text email.
+func message(from, to, subject, body string) []byte {
+	return []byte("From: " + from + "\r\n" +
+		"To: " + to + "\r\n" +
+		"Subject: " + subject + "\r\n" +
+		"MIME-Version: 1.0\r\n" +
+		"Content-Type: text/plain; charset=UTF-8\r\n" +
+		"\r\n" + body + "\r\n")
+}
+
 // LogMailer logs the message instead of sending it. It is the default when no
 // SMTP relay is configured and is intended for development only: it logs the body,
 // which carries the confirm-code, so it must not be used in production.
@@ -166,12 +74,11 @@ func NewLogMailer(log *zap.Logger) LogMailer {
 	return LogMailer{log: log}
 }
 
-// Send logs the message at info level and reports success. It logs the plain-text
-// body only (which carries the confirm-code); the HTML alternative is omitted.
-func (m LogMailer) Send(_ context.Context, msg Message) error {
+// Send logs the message at info level and reports success.
+func (m LogMailer) Send(_ context.Context, to, subject, body string) error {
 	if m.log != nil {
 		m.log.Info("email not sent (log mailer)",
-			zap.String("to", msg.To), zap.String("subject", msg.Subject), zap.String("body", msg.Text))
+			zap.String("to", to), zap.String("subject", subject), zap.String("body", body))
 	}
 	return nil
 }

backend/internal/account/mailer_test.go

@@ -1,51 +0,0 @@
-package account
-
-import (
-	"slices"
-	"testing"
-)
-
-// TestSplitAddrs covers the comma-separated recipient parsing used for the admin alert
-// To (several operator mailboxes in one message), including trimming and empty entries.
-func TestSplitAddrs(t *testing.T) {
-	cases := []struct {
-		in   string
-		want []string
-	}{
-		{"a@x.ru", []string{"a@x.ru"}},
-		{"a@x.ru, b@y.ru", []string{"a@x.ru", "b@y.ru"}},
-		{" a@x.ru ,, b@y.ru ,", []string{"a@x.ru", "b@y.ru"}},
-		{"", nil},
-	}
-	for _, c := range cases {
-		if got := splitAddrs(c.in); !slices.Equal(got, c.want) {
-			t.Errorf("splitAddrs(%q) = %v, want %v", c.in, got, c.want)
-		}
-	}
-}
-
-// TestSMTPTLSMode covers the explicit TLS mode and the port-based fallback, including
-// the non-standard Selectel ports (1127 = SSL, 1126 = STARTTLS) that the 465 heuristic
-// alone cannot classify.
-func TestSMTPTLSMode(t *testing.T) {
-	cases := []struct {
-		name string
-		tls  string
-		port int
-		want string
-	}{
-		{"explicit ssl on a custom port (Selectel 1127)", "ssl", 1127, smtpTLSImplicit},
-		{"explicit starttls on a custom port (Selectel 1126)", "starttls", 1126, smtpTLSSTARTTLS},
-		{"tls is an alias for ssl", "TLS", 2525, smtpTLSImplicit},
-		{"empty derives implicit TLS on 465", "", 465, smtpTLSImplicit},
-		{"empty derives STARTTLS on 587", "", 587, smtpTLSSTARTTLS},
-		{"an unknown value falls back to the port heuristic", "bogus", 465, smtpTLSImplicit},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			if got := (SMTPConfig{TLS: c.tls}).tlsMode(c.port); got != c.want {
-				t.Errorf("tlsMode(TLS=%q, port=%d) = %q, want %q", c.tls, c.port, got, c.want)
-			}
-		})
-	}
-}

backend/internal/account/profile.go

@@ -101,66 +101,6 @@ func validateVariantPreferences(prefs []string) ([]string, error) {
 	return out, nil
 }
 
-// variantSeedPrefix marks a Telegram start-param payload that seeds a brand-new
-// account's variant preferences (e.g. "verudit_ru-scrabble_en"): the prefix, then the
-// canonical variant labels joined by "-". It is deliberately distinct from the routing
-// deep links (g/i/f; see platform/telegram .../deeplink) so the client's start-param
-// router falls through to the lobby for it.
-const variantSeedPrefix = "v"
-
-// SeedVariantsFromStartParam decodes a promo deep-link start-param into the variant
-// preference set to seed onto a brand-new account: the variantSeedPrefix followed by
-// the canonical variant labels joined by "-" (e.g. "verudit_ru-scrabble_en"). It
-// returns nil for any payload that is not a variant-seed link or that fails validation
-// against the known variants, so a malformed, empty or unrelated start-param simply
-// leaves the account on its default preferences rather than failing the login.
-func SeedVariantsFromStartParam(startParam string) []string {
-	if !strings.HasPrefix(startParam, variantSeedPrefix) {
-		return nil
-	}
-	body := strings.TrimPrefix(startParam, variantSeedPrefix)
-	if body == "" {
-		return nil
-	}
-	prefs, err := validateVariantPreferences(strings.Split(body, "-"))
-	if err != nil {
-		return nil
-	}
-	return prefs
-}
-
-// SetVariantPreferences overwrites only the variant-preference set of the account,
-// cleaning it to a deduplicated, canonically ordered subset of the known variants
-// (rejecting an empty or unknown set with ErrInvalidProfile) and bumping updated_at; it
-// reports ErrNotFound when no account matches id. It is the narrow counterpart to
-// UpdateProfile used to seed a promo-onboarded account's variants at first contact
-// without disturbing its other profile fields.
-func (s *Store) SetVariantPreferences(ctx context.Context, id uuid.UUID, prefs []string) (Account, error) {
-	clean, err := validateVariantPreferences(prefs)
-	if err != nil {
-		return Account{}, err
-	}
-	stmt := table.Accounts.UPDATE(
-		table.Accounts.VariantPreferences, table.Accounts.UpdatedAt,
-	).SET(
-		// clean is validated against the closed knownVariants set; bind as a text[]
-		// parameter (lib/pq encodes the array, the cast pins the column type), mirroring
-		// UpdateProfile.
-		postgres.Raw("#variant_prefs::text[]", map[string]interface{}{"#variant_prefs": pq.StringArray(clean)}),
-		postgres.TimestampzT(time.Now().UTC()),
-	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(id))).
-		RETURNING(table.Accounts.AllColumns)
-
-	var row model.Accounts
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return Account{}, ErrNotFound
-		}
-		return Account{}, fmt.Errorf("account: set variant preferences %s: %w", id, err)
-	}
-	return modelToAccount(row), nil
-}
-
 // UpdateProfile validates and overwrites the editable fields of the account, then
 // returns the stored row. It reports ErrInvalidProfile for a bad language,
 // timezone or display name and ErrNotFound when no account matches id.

backend/internal/account/provision_test.go

@@ -9,9 +9,8 @@ import (
 
 // TestTelegramSeed covers the pure mapping from Telegram launch fields to the
 // create-time account seed: supported-language detection (bare and region-tagged),
-// the real-name → @username (verbatim) → placeholder display-name precedence, and
-// the sanitization of the real name (emoji, digits, punctuation stripped to the
-// editable format). The username, when used, is kept verbatim.
+// the first-name / username display-name precedence, and the sanitization that
+// strips disallowed characters (emoji, digits, punctuation) to the editable format.
 func TestTelegramSeed(t *testing.T) {
 	cases := map[string]struct {
 		languageCode, username, firstName string
@@ -29,7 +28,6 @@ func TestTelegramSeed(t *testing.T) {
 		"punct to space":      {"en", "user", "John❤Doe", "en", "John Doe"},
 		"digits dropped":      {"ru", "user", "Маша123", "ru", "Маша"},
 		"garbage to username": {"en", "good", "123!@#", "en", "good"},
-		"username verbatim":   {"en", "co_ol99", "🎮🎮", "en", "co_ol99"},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -51,10 +49,10 @@ func TestTelegramSeedPlaceholder(t *testing.T) {
 		languageCode, username, firstName string
 		wantRe                            string
 	}{
-		"en empty":                  {"en", "", "", `^Player-\d{5}$`},
-		"ru empty":                  {"ru", "", "", `^Игрок-\d{5}$`},
-		"default en":                {"fr", "", "", `^Player-\d{5}$`},
-		"name garbage, no username": {"ru", "", "!!!", `^Игрок-\d{5}$`},
+		"en empty":     {"en", "", "", `^Player-\d{5}$`},
+		"ru empty":     {"ru", "", "", `^Игрок-\d{5}$`},
+		"default en":   {"fr", "", "", `^Player-\d{5}$`},
+		"both garbage": {"ru", "123", "!!!", `^Игрок-\d{5}$`},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -75,55 +73,3 @@ func TestTelegramSeedTruncatesLongName(t *testing.T) {
 		t.Errorf("display name rune count = %d, want %d", n, maxDisplayName)
 	}
 }
-
-// TestVKSeed covers the pure mapping from VK launch fields to the create-time account
-// seed: supported-language detection from vk_language (bare and region-tagged) and the
-// display name sanitized from the client-supplied name. Unlike Telegram there is no
-// @username fallback — VK provides only the name.
-func TestVKSeed(t *testing.T) {
-	cases := map[string]struct {
-		languageCode, displayName string
-		wantLang, wantName        string
-	}{
-		"ru bare":          {"ru", "Иван", "ru", "Иван"},
-		"en region-tagged": {"en-US", "John", "en", "John"},
-		"full name kept":   {"ru", "Иван Петров", "ru", "Иван Петров"},
-		"unknown language": {"uk", "Тарас", "", "Тарас"},
-		"empty language":   {"", "Neo", "", "Neo"},
-		"trimmed":          {" RU ", "  Anna  ", "ru", "Anna"},
-		"emoji stripped":   {"en", "🎮Kaya🎮", "en", "Kaya"},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			got := vkSeed(tc.languageCode, tc.displayName)
-			if got.preferredLanguage != tc.wantLang {
-				t.Errorf("preferredLanguage = %q, want %q", got.preferredLanguage, tc.wantLang)
-			}
-			if got.displayName != tc.wantName {
-				t.Errorf("displayName = %q, want %q", got.displayName, tc.wantName)
-			}
-		})
-	}
-}
-
-// TestVKSeedPlaceholder checks a VK name with no usable letters falls back to a
-// generated placeholder in the seeded language ("Player-NNNNN" / "Игрок-NNNNN").
-func TestVKSeedPlaceholder(t *testing.T) {
-	cases := map[string]struct {
-		languageCode, displayName string
-		wantRe                    string
-	}{
-		"en empty":     {"en", "", `^Player-\d{5}$`},
-		"ru empty":     {"ru", "", `^Игрок-\d{5}$`},
-		"default en":   {"uk", "", `^Player-\d{5}$`},
-		"name garbage": {"ru", "123!@#", `^Игрок-\d{5}$`},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			got := vkSeed(tc.languageCode, tc.displayName).displayName
-			if !regexp.MustCompile(tc.wantRe).MatchString(got) {
-				t.Errorf("displayName = %q, want match %s", got, tc.wantRe)
-			}
-		})
-	}
-}

backend/internal/account/ratelimit.go

@@ -1,66 +0,0 @@
-package account
-
-import (
-	"sync"
-	"time"
-)
-
-// SendLimiter throttles confirm-code sends per recipient address: it enforces a
-// minimum cooldown between two sends and a cap over a rolling hour. It guards against
-// email bombing and protects the relay's own quota. State is in-memory (per process,
-// reset on restart) and keyed by the normalised recipient address, which is adequate
-// for the single-instance backend. Safe for concurrent use.
-type SendLimiter struct {
-	mu       sync.Mutex
-	cooldown time.Duration
-	perHour  int
-	now      func() time.Time
-	sends    map[string][]time.Time
-}
-
-// NewSendLimiter returns a SendLimiter allowing at most one send per cooldown and at
-// most perHour sends over any rolling hour, to the same recipient.
-func NewSendLimiter(cooldown time.Duration, perHour int) *SendLimiter {
-	return &SendLimiter{
-		cooldown: cooldown,
-		perHour:  perHour,
-		now:      func() time.Time { return time.Now() },
-		sends:    make(map[string][]time.Time),
-	}
-}
-
-// Allow reports whether a send to key is permitted now, recording the send when it is.
-// It is denied when the last send was within the cooldown or the rolling-hour cap is
-// already reached.
-func (l *SendLimiter) Allow(key string) bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	now := l.now()
-	cutoff := now.Add(-time.Hour)
-	kept := l.sends[key][:0]
-	for _, t := range l.sends[key] {
-		if t.After(cutoff) {
-			kept = append(kept, t)
-		}
-	}
-	if n := len(kept); n > 0 && now.Sub(kept[n-1]) < l.cooldown {
-		l.set(key, kept)
-		return false
-	}
-	if len(kept) >= l.perHour {
-		l.set(key, kept)
-		return false
-	}
-	l.set(key, append(kept, now))
-	return true
-}
-
-// set stores the retained send times for key, dropping the entry entirely once empty
-// so the map stays bounded to recipients active within the last hour.
-func (l *SendLimiter) set(key string, times []time.Time) {
-	if len(times) == 0 {
-		delete(l.sends, key)
-		return
-	}
-	l.sends[key] = times
-}

backend/internal/account/ratelimit_test.go

@@ -1,43 +0,0 @@
-package account
-
-import (
-	"testing"
-	"time"
-)
-
-// TestSendLimiter checks the per-recipient cooldown and the rolling-hour cap, and
-// that recipients are throttled independently.
-func TestSendLimiter(t *testing.T) {
-	base := time.Now()
-	now := base
-	l := NewSendLimiter(time.Minute, 3)
-	l.now = func() time.Time { return now }
-
-	if !l.Allow("a") {
-		t.Fatal("send 1 should be allowed")
-	}
-	if l.Allow("a") {
-		t.Fatal("immediate resend must be blocked by the cooldown")
-	}
-	if !l.Allow("b") {
-		t.Fatal("a different recipient is independent")
-	}
-
-	now = base.Add(time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 2 after the cooldown should be allowed")
-	}
-	now = base.Add(2 * time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 3 should be allowed")
-	}
-	now = base.Add(3 * time.Minute)
-	if l.Allow("a") {
-		t.Fatal("send 4 within the hour must be blocked by the cap")
-	}
-
-	now = base.Add(time.Hour + time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("after the rolling hour the cap resets")
-	}
-}

backend/internal/account/retention.go

@@ -1,224 +0,0 @@
-package account
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// RetentionTTL bounds how long the account-deletion legal dossier is kept before the
-// reaper purges it: two years from the detach/deletion event (owner policy, 2026-07-03).
-const RetentionTTL = 2 * 365 * 24 * time.Hour
-
-// Reasons recorded on a retained_identities row: what detached the credential from its
-// account (unlink / email change / account deletion here; an account merge that drops a
-// same-kind colliding identity writes reason "merge" from the accountmerge package). The
-// row is written just before the live identities row is removed, preserving the legal
-// dossier (which email/vk/tg was linked, and when) even as the identity frees for reuse.
-// See docs/ARCHITECTURE.md §9.1.
-const (
-	retainUnlink = "unlink"
-	retainChange = "change"
-	retainDelete = "delete"
-)
-
-// retainIdentityTx appends a retention-journal row for one identity being detached, inside
-// tx. linkedAt is the identity's original creation time; detached_at defaults to now(). It
-// must run in the same transaction as the identity removal, so the dossier and the live
-// state can never diverge.
-func retainIdentityTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind, externalID string, confirmed bool, linkedAt time.Time, reason string) error {
-	id, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new retained id: %w", err)
-	}
-	ins := table.RetainedIdentities.INSERT(
-		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-		table.RetainedIdentities.Reason,
-	).VALUES(id, accountID, kind, externalID, confirmed, linkedAt, reason)
-	if _, err := ins.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("account: retain identity (%s, %s): %w", kind, externalID, err)
-	}
-	return nil
-}
-
-// StampLastLogin records the account's last cold-load time and client IP, but only when
-// the stored value is missing or older than an hour — so it costs at most one write per
-// account per hour (its caller, the profile fetch, runs once per cold app-load). It is a
-// best-effort audit signal that feeds the account-deletion dossier.
-func (s *Store) StampLastLogin(ctx context.Context, accountID uuid.UUID, ip string) error {
-	now := time.Now().UTC()
-	upd := table.Accounts.UPDATE(table.Accounts.LastLoginAt, table.Accounts.LastLoginIP).
-		SET(postgres.TimestampzT(now), postgres.String(ip)).
-		WHERE(
-			table.Accounts.AccountID.EQ(postgres.UUID(accountID)).
-				AND(
-					table.Accounts.LastLoginAt.IS_NULL().
-						OR(table.Accounts.LastLoginAt.LT(postgres.TimestampzT(now.Add(-time.Hour)))),
-				),
-		)
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: stamp last login %s: %w", accountID, err)
-	}
-	return nil
-}
-
-// ReapExpiredRetention purges retention data whose event is older than cutoff: every
-// retained_identities row by its detached_at (covering unlink/change on live accounts as
-// well as deleted ones), plus — for accounts tombstoned before cutoff — the retained
-// feedback thread and the dossier PII (deleted_display_name, last_login_ip). Chat is kept
-// (a shared game artifact), and the tombstone account row itself stays (its no-cascade
-// foreign keys). It returns how many journal rows and feedback messages were removed.
-func (s *Store) ReapExpiredRetention(ctx context.Context, cutoff time.Time) (identities, feedback int64, err error) {
-	cut := postgres.TimestampzT(cutoff)
-	delJournal := table.RetainedIdentities.DELETE().
-		WHERE(table.RetainedIdentities.DetachedAt.LT(cut))
-	res, err := delJournal.ExecContext(ctx, s.db)
-	if err != nil {
-		return 0, 0, fmt.Errorf("account: reap retained identities: %w", err)
-	}
-	identities, _ = res.RowsAffected()
-
-	expired := postgres.SELECT(table.Accounts.AccountID).
-		FROM(table.Accounts).
-		WHERE(table.Accounts.DeletedAt.IS_NOT_NULL().AND(table.Accounts.DeletedAt.LT(cut)))
-	delFeedback := table.FeedbackMessages.DELETE().
-		WHERE(table.FeedbackMessages.AccountID.IN(expired))
-	fbRes, err := delFeedback.ExecContext(ctx, s.db)
-	if err != nil {
-		return identities, 0, fmt.Errorf("account: reap deleted feedback: %w", err)
-	}
-	feedback, _ = fbRes.RowsAffected()
-
-	clearPII := table.Accounts.UPDATE(table.Accounts.DeletedDisplayName, table.Accounts.LastLoginIP).
-		SET(postgres.NULL, postgres.NULL).
-		WHERE(
-			table.Accounts.DeletedAt.IS_NOT_NULL().
-				AND(table.Accounts.DeletedAt.LT(cut)).
-				AND(table.Accounts.DeletedDisplayName.IS_NOT_NULL().
-					OR(table.Accounts.LastLoginIP.IS_NOT_NULL())),
-		)
-	if _, err := clearPII.ExecContext(ctx, s.db); err != nil {
-		return identities, feedback, fmt.Errorf("account: clear expired dossier PII: %w", err)
-	}
-	return identities, feedback, nil
-}
-
-// RetainedIdentity is one row of the retention journal, for the admin dossier.
-type RetainedIdentity struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   time.Time
-	DetachedAt time.Time
-}
-
-// RetainedIdentities returns the account's retention-journal rows (the legal dossier of
-// detached credentials), newest detach first, for the admin console.
-func (s *Store) RetainedIdentities(ctx context.Context, accountID uuid.UUID) ([]RetainedIdentity, error) {
-	var rows []model.RetainedIdentities
-	err := postgres.SELECT(table.RetainedIdentities.AllColumns).
-		FROM(table.RetainedIdentities).
-		WHERE(table.RetainedIdentities.AccountID.EQ(postgres.UUID(accountID))).
-		ORDER_BY(table.RetainedIdentities.DetachedAt.DESC()).
-		QueryContext(ctx, s.db, &rows)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return nil, fmt.Errorf("account: retained identities %s: %w", accountID, err)
-	}
-	out := make([]RetainedIdentity, 0, len(rows))
-	for _, r := range rows {
-		out = append(out, RetainedIdentity{
-			Kind: r.Kind, ExternalID: r.ExternalID, Reason: r.Reason,
-			Confirmed: r.Confirmed, LinkedAt: r.LinkedAt, DetachedAt: r.DetachedAt,
-		})
-	}
-	return out, nil
-}
-
-// DeletionInfo is a tombstoned account's dossier header, for the admin console.
-type DeletionInfo struct {
-	DeletedAt          *time.Time
-	DeletedDisplayName string
-	LastLoginAt        *time.Time
-	LastLoginIP        string
-}
-
-// DeletionInfo reads the account's deletion tombstone + last-login dossier fields.
-func (s *Store) DeletionInfo(ctx context.Context, accountID uuid.UUID) (DeletionInfo, error) {
-	var row model.Accounts
-	err := postgres.SELECT(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.LastLoginAt, table.Accounts.LastLoginIP,
-	).FROM(table.Accounts).
-		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, s.db, &row)
-	if err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return DeletionInfo{}, ErrNotFound
-		}
-		return DeletionInfo{}, fmt.Errorf("account: deletion info %s: %w", accountID, err)
-	}
-	info := DeletionInfo{DeletedAt: row.DeletedAt, LastLoginAt: row.LastLoginAt}
-	if row.DeletedDisplayName != nil {
-		info.DeletedDisplayName = *row.DeletedDisplayName
-	}
-	if row.LastLoginIP != nil {
-		info.LastLoginIP = *row.LastLoginIP
-	}
-	return info, nil
-}
-
-// RetentionReaper periodically purges expired account-deletion retention data via
-// Store.ReapExpiredRetention, mirroring GuestReaper: one background goroutine started once
-// from main.
-type RetentionReaper struct {
-	store *Store
-	ttl   time.Duration
-	clock func() time.Time
-	log   *zap.Logger
-}
-
-// NewRetentionReaper constructs a reaper purging retention data older than ttl. log may be
-// nil.
-func NewRetentionReaper(store *Store, ttl time.Duration, log *zap.Logger) *RetentionReaper {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &RetentionReaper{
-		store: store,
-		ttl:   ttl,
-		clock: func() time.Time { return time.Now().UTC() },
-		log:   log,
-	}
-}
-
-// Run purges expired retention data on each tick until ctx is cancelled.
-func (r *RetentionReaper) Run(ctx context.Context, interval time.Duration) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			idn, fb, err := r.store.ReapExpiredRetention(ctx, r.clock().Add(-r.ttl))
-			if err != nil {
-				r.log.Warn("retention reap failed", zap.Error(err))
-			} else if idn > 0 || fb > 0 {
-				r.log.Info("reaped expired retention", zap.Int64("identities", idn), zap.Int64("feedback", fb))
-			}
-		}
-	}
-}

backend/internal/account/userlist.go

@@ -19,9 +19,6 @@ type UserListItem struct {
 	PreferredLanguage string
 	IsGuest           bool
 	IsRobot           bool
-	// IsDeleted marks a tombstoned account (deleted_at set), shown as a badge — a search
-	// spans both lists, so a result can be either live or deleted.
-	IsDeleted bool
 	// FlaggedHighRateAt is the soft high-rate marker (zero when unflagged), shown
 	// as a badge in the console list.
 	FlaggedHighRateAt time.Time
@@ -29,17 +26,13 @@ type UserListItem struct {
 }
 
 // UserFilter narrows the admin user list: Robots selects robot accounts (otherwise the
-// non-robot "people"); Deleted selects tombstoned accounts (every other scope hides them);
-// NameMask and ExternalIDMask are glob masks ('*' = any run, '?' = one char) matched
-// case-insensitively against the display name / any identity's external id; EmailExact is a
-// strict (exact) match against an account's email identity. An empty value means no filter
-// on that field.
+// non-robot "people"); NameMask and ExternalIDMask are glob masks ('*' = any run, '?' =
+// one char) matched case-insensitively against the display name / any identity's external
+// id. An empty mask means no filter on that field.
 type UserFilter struct {
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 }
 
 // robotExists is the correlated subquery testing whether account a is a robot.
@@ -58,42 +51,17 @@ func (s *Store) IsRobot(ctx context.Context, accountID uuid.UUID) (bool, error)
 	return ok, nil
 }
 
-// userListWhere builds the shared WHERE clause and its positional args (from $1). On the
-// Robots tab it lists/searches robots only. Otherwise a search (any of the name /
-// external-id / email filters) spans live and deleted people alike — never robots — so the
-// operator finds a match from one query regardless of the People / Deleted tab; the search
-// also looks in the retention journal, so a deleted account is still found by the email /
-// external id it held (those rows moved from identities to retained_identities on deletion)
-// and by its retained real name. With no search, the People / Deleted tab scope applies.
+// userListWhere builds the shared WHERE clause and its positional args (from $1).
 func userListWhere(f UserFilter) (string, []any) {
-	name := LikePattern(f.NameMask)
-	ext := LikePattern(f.ExternalIDMask)
-	email := strings.ToLower(strings.TrimSpace(f.EmailExact))
-	searching := name != "" || ext != "" || email != ""
-
-	var args []any
-	var where string
-	switch {
-	case f.Robots:
-		where = robotExists + ` = true`
-	case searching:
-		where = robotExists + ` = false`
-	case f.Deleted:
-		where = robotExists + ` = false AND a.deleted_at IS NOT NULL`
-	default:
-		where = robotExists + ` = false AND a.deleted_at IS NULL`
-	}
-	if name != "" {
+	args := []any{f.Robots}
+	where := robotExists + ` = $1`
+	if name := LikePattern(f.NameMask); name != "" {
 		args = append(args, name)
-		where += fmt.Sprintf(` AND (a.display_name ILIKE $%d ESCAPE '\' OR a.deleted_display_name ILIKE $%d ESCAPE '\')`, len(args), len(args))
+		where += fmt.Sprintf(` AND a.display_name ILIKE $%d ESCAPE '\'`, len(args))
 	}
-	if ext != "" {
+	if ext := LikePattern(f.ExternalIDMask); ext != "" {
 		args = append(args, ext)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\') OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.external_id ILIKE $%d ESCAPE '\'))`, len(args), len(args))
-	}
-	if email != "" {
-		args = append(args, email)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.kind = 'email' AND i.external_id = $%d) OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.kind = 'email' AND r.external_id = $%d))`, len(args), len(args))
+		where += fmt.Sprintf(` AND EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\')`, len(args))
 	}
 	return where, args
 }
@@ -101,7 +69,7 @@ func userListWhere(f UserFilter) (string, []any) {
 // ListUsers returns the filtered admin user list, newest first, paginated.
 func (s *Store) ListUsers(ctx context.Context, f UserFilter, limit, offset int) ([]UserListItem, error) {
 	where, args := userListWhere(f)
-	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot, (a.deleted_at IS NOT NULL) AS is_deleted
+	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot
 FROM backend.accounts a WHERE ` + where +
 		fmt.Sprintf(` ORDER BY a.created_at DESC LIMIT $%d OFFSET $%d`, len(args)+1, len(args)+2)
 	args = append(args, limit, offset)
@@ -114,7 +82,7 @@ FROM backend.accounts a WHERE ` + where +
 	for rows.Next() {
 		var it UserListItem
 		var flagged sql.NullTime
-		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot, &it.IsDeleted); err != nil {
+		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot); err != nil {
 			return nil, fmt.Errorf("account: scan user: %w", err)
 		}
 		if flagged.Valid {

backend/internal/account/variant_seed_test.go

@@ -1,37 +0,0 @@
-package account
-
-import (
-	"slices"
-	"testing"
-)
-
-// TestSeedVariantsFromStartParam covers decoding a promo deep-link start-param into the
-// variant-preference set to seed: a valid "v"-prefixed, "-"-joined label list is cleaned
-// to the canonical order and deduplicated, while anything that is not a variant-seed link
-// or that names an unknown variant yields nil (leaving the account on its defaults).
-func TestSeedVariantsFromStartParam(t *testing.T) {
-	tests := []struct {
-		name  string
-		param string
-		want  []string
-	}{
-		{"english promo", "verudit_ru-scrabble_en", []string{"erudit_ru", "scrabble_en"}},
-		{"single variant", "vscrabble_en", []string{"scrabble_en"}},
-		{"canonical order regardless of payload order", "vscrabble_en-erudit_ru", []string{"erudit_ru", "scrabble_en"}},
-		{"deduplicated", "verudit_ru-erudit_ru", []string{"erudit_ru"}},
-		{"empty", "", nil},
-		{"prefix only", "v", nil},
-		{"routing game link is not a seed", "g0190abcd", nil},
-		{"friend code link is not a seed", "f123456", nil},
-		{"unknown variant rejected", "vscrabble_de", nil},
-		{"one unknown label rejects the whole set", "verudit_ru-scrabble_de", nil},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := SeedVariantsFromStartParam(tc.param)
-			if !slices.Equal(got, tc.want) {
-				t.Errorf("SeedVariantsFromStartParam(%q) = %v, want %v", tc.param, got, tc.want)
-			}
-		})
-	}
-}

backend/internal/accountdelete/delete.go

@@ -1,223 +0,0 @@
-// Package accountdelete deactivates an account as legal retention, not erasure: it keeps
-// the account row as a tombstone (its chat/complaint foreign keys have no cascade, so a
-// hard delete is impossible) while journalling and freeing the account's credentials,
-// anonymising the live surfaces, and dropping the account's own social/ephemeral rows.
-// The retained_identities journal plus the tombstone (deleted_at, deleted_display_name,
-// last_login_at/ip) form the admin/legal dossier; messages are deliberately kept. Session
-// revocation and active-game forfeit are orchestrated one layer up (they need the session
-// cache and the game service). See docs/ARCHITECTURE.md §9.1 and the retention TTL reaper.
-package accountdelete
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// AnonymizedName is the label a deleted account shows to opponents. Display names are
-// stored strings resolved identically for every viewer (no per-viewer localisation in this
-// codebase), so a single canonical label is used. The brackets are deliberate: the
-// editable-name rule (account.displayNameRe) forbids them, so a live player can never set a
-// name that impersonates a deleted account.
-const AnonymizedName = "[Deleted]"
-
-// retainDelete is the retained_identities reason written when a credential is journalled
-// because its account is being deleted.
-const retainDelete = "delete"
-
-// Deleter performs the SQL-atomic part of account deletion over a Postgres handle.
-type Deleter struct {
-	db  *sql.DB
-	now func() time.Time
-}
-
-// NewDeleter constructs a Deleter over db.
-func NewDeleter(db *sql.DB) *Deleter {
-	return &Deleter{db: db, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// AnonymizeAndTombstone retires accountID atomically: it journals every live identity into
-// retained_identities (reason=delete) then removes them so the credentials free for reuse,
-// snapshots the real display name into deleted_display_name and scrubs the live one to
-// AnonymizedName, sets deleted_at, anonymises the account's game-seat snapshots, and drops
-// its friendships, blocks, invitations, friend codes, drafts and pending codes. Chat,
-// feedback and complaints are kept (the surviving tombstone keeps their no-cascade foreign
-// keys valid). It is idempotent-safe on an already-tombstoned account (re-journalling
-// nothing, since the identities are already gone).
-func (d *Deleter) AnonymizeAndTombstone(ctx context.Context, accountID uuid.UUID) error {
-	now := d.now()
-	return withTx(ctx, d.db, func(tx *sql.Tx) error {
-		if err := journalAndDropIdentities(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if err := tombstone(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if _, err := table.GamePlayers.UPDATE(table.GamePlayers.DisplayName).
-			SET(postgres.String(AnonymizedName)).
-			WHERE(table.GamePlayers.AccountID.EQ(postgres.UUID(accountID))).
-			ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: anonymise seats: %w", err)
-		}
-		return dropSocialAndEphemerals(ctx, tx, accountID)
-	})
-}
-
-// dropAllRobotGamesSQL deletes every game in which the account plays and no other seat is a
-// human — a robot seat is one whose account holds a 'robot' identity, so this covers both
-// honest vs-AI games and disguised auto-match substitutes. The game rows are deleted; their
-// moves/chat/players/complaints fall away through ON DELETE CASCADE.
-const dropAllRobotGamesSQL = `
-DELETE FROM games g
-WHERE EXISTS (
-    SELECT 1 FROM game_players p WHERE p.game_id = g.game_id AND p.account_id = $1
-) AND NOT EXISTS (
-    SELECT 1 FROM game_players o
-    WHERE o.game_id = g.game_id AND o.account_id <> $1
-      AND NOT EXISTS (
-          SELECT 1 FROM identities i WHERE i.account_id = o.account_id AND i.kind = 'robot'
-      )
-)`
-
-// DropAllRobotGames deletes the account's games that have no human opponent (solo vs-AI or
-// auto-match-robot games), returning how many were removed. Games with any human seat are
-// kept — their seat is anonymised by AnonymizeAndTombstone instead. Run it after the
-// account's active games are resigned, so no live game is removed under the robot driver.
-func (d *Deleter) DropAllRobotGames(ctx context.Context, accountID uuid.UUID) (int64, error) {
-	res, err := d.db.ExecContext(ctx, dropAllRobotGamesSQL, accountID)
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: drop all-robot games: %w", err)
-	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: dropped games count: %w", err)
-	}
-	return n, nil
-}
-
-// journalAndDropIdentities copies the account's live identities into the retention journal
-// (reason=delete) and then removes them, freeing each (kind, external_id) for reuse.
-func journalAndDropIdentities(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	var ids []model.Identities
-	err := postgres.SELECT(table.Identities.AllColumns).
-		FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, tx, &ids)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountdelete: load identities: %w", err)
-	}
-	for _, id := range ids {
-		rid, err := uuid.NewV7()
-		if err != nil {
-			return fmt.Errorf("accountdelete: new retained id: %w", err)
-		}
-		ins := table.RetainedIdentities.INSERT(
-			table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-			table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-			table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-			table.RetainedIdentities.DetachedAt, table.RetainedIdentities.Reason,
-		).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, now, retainDelete)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: retain identity %s: %w", id.Kind, err)
-		}
-	}
-	if _, err := table.Identities.DELETE().
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete identities: %w", err)
-	}
-	return nil
-}
-
-// tombstone marks the account deleted, snapshotting the real display name into
-// deleted_display_name (evaluated from the old row) before scrubbing the live one.
-func tombstone(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	upd := table.Accounts.UPDATE(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.DisplayName, table.Accounts.UpdatedAt,
-	).SET(
-		postgres.TimestampzT(now), table.Accounts.DisplayName,
-		postgres.String(AnonymizedName), postgres.TimestampzT(now),
-	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID)))
-	if _, err := upd.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: tombstone account: %w", err)
-	}
-	return nil
-}
-
-// dropSocialAndEphemerals removes the account's own friendships, blocks, invitations
-// (as inviter and as invitee), friend codes, drafts and pending confirm-codes. These are
-// the deleting user's private data with no dossier value; chat and feedback are kept.
-func dropSocialAndEphemerals(ctx context.Context, tx *sql.Tx, accountID uuid.UUID) error {
-	id := postgres.UUID(accountID)
-	// Friendships and blocks are two-account edges keyed on either endpoint.
-	if _, err := table.Friendships.DELETE().
-		WHERE(table.Friendships.RequesterID.EQ(id).OR(table.Friendships.AddresseeID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friendships: %w", err)
-	}
-	if _, err := table.Blocks.DELETE().
-		WHERE(table.Blocks.BlockerID.EQ(id).OR(table.Blocks.BlockedID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete blocks: %w", err)
-	}
-	// Invitations: drop the account's invitee rows, then its own invitations' invitees and
-	// the invitations themselves (children first, to respect the foreign key).
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.AccountID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitee rows: %w", err)
-	}
-	ownInvitations := postgres.SELECT(table.GameInvitations.InvitationID).
-		FROM(table.GameInvitations).
-		WHERE(table.GameInvitations.InviterID.EQ(id))
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.InvitationID.IN(ownInvitations)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete own invitation invitees: %w", err)
-	}
-	if _, err := table.GameInvitations.DELETE().
-		WHERE(table.GameInvitations.InviterID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitations: %w", err)
-	}
-	// Ephemerals: friend codes, move drafts, pending confirm-codes.
-	if _, err := table.FriendCodes.DELETE().
-		WHERE(table.FriendCodes.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friend codes: %w", err)
-	}
-	if _, err := table.GameDrafts.DELETE().
-		WHERE(table.GameDrafts.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete drafts: %w", err)
-	}
-	if _, err := table.EmailConfirmations.DELETE().
-		WHERE(table.EmailConfirmations.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete confirmations: %w", err)
-	}
-	return nil
-}
-
-// withTx runs fn inside a transaction, committing on success and rolling back on error.
-func withTx(ctx context.Context, db *sql.DB, fn func(tx *sql.Tx) error) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("accountdelete: begin tx: %w", err)
-	}
-	if err := fn(tx); err != nil {
-		_ = tx.Rollback()
-		return err
-	}
-	if err := tx.Commit(); err != nil {
-		return fmt.Errorf("accountdelete: commit tx: %w", err)
-	}
-	return nil
-}

backend/internal/accountmerge/merge.go

@@ -27,11 +27,6 @@ import (
 // without taking a dependency on the game package.
 const statusActive = "active"
 
-// retainReasonMerge is the retained_identities.reason for a credential dropped by a merge
-// collision (both accounts held the same kind). It mirrors the account package's retain
-// reasons, kept local to avoid importing that package's unexported constants.
-const retainReasonMerge = "merge"
-
 // Friendship statuses, highest precedence first, mirroring internal/social.
 const (
 	friendAccepted = "accepted"
@@ -51,24 +46,8 @@ var ErrSameAccount = errors.New("accountmerge: primary and secondary are the sam
 type Merger struct {
 	db  *sql.DB
 	now func() time.Time
-	// payments, when set, merges the two accounts' chip segments and benefits by origin inside
-	// the merge transaction (SetPayments). Nil leaves payments untouched (tests that do not
-	// exercise the wallet).
-	payments PaymentsMerger
 }
 
-// PaymentsMerger is the payments surface the account merge enlists: fold the secondary's
-// segments and benefits into the primary within the merge transaction, then invalidate the
-// affected read caches after the commit. *payments.Service satisfies it.
-type PaymentsMerger interface {
-	MergeTx(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID) error
-	Invalidate(ids ...uuid.UUID)
-}
-
-// SetPayments installs the payments merge hook. It must be called during startup wiring; the
-// default (nil) merges no wallet state.
-func (m *Merger) SetPayments(p PaymentsMerger) { m.payments = p }
-
 // NewMerger constructs a Merger over db.
 func NewMerger(db *sql.DB) *Merger {
 	return &Merger{db: db, now: func() time.Time { return time.Now().UTC() }}
@@ -83,7 +62,7 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		return ErrSameAccount
 	}
 	now := m.now()
-	if err := withTx(ctx, m.db, func(tx *sql.Tx) error {
+	return withTx(ctx, m.db, func(tx *sql.Tx) error {
 		if err := guardActiveSharedGame(ctx, tx, primary, secondary); err != nil {
 			return err
 		}
@@ -96,9 +75,6 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		if err := mergeAccountFields(ctx, tx, primary, secondary, now); err != nil {
 			return err
 		}
-		if err := dedupeIdentities(ctx, tx, primary, secondary); err != nil {
-			return err
-		}
 		if err := reassignColumn(ctx, tx, table.Identities, table.Identities.AccountID, primary, secondary); err != nil {
 			return fmt.Errorf("accountmerge: identities: %w", err)
 		}
@@ -123,21 +99,8 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		if err := deleteEphemerals(ctx, tx, secondary); err != nil {
 			return err
 		}
-		if m.payments != nil {
-			if err := m.payments.MergeTx(ctx, tx, primary, secondary); err != nil {
-				return fmt.Errorf("accountmerge: payments: %w", err)
-			}
-		}
 		return tombstone(ctx, tx, primary, secondary, now)
-	}); err != nil {
-		return err
-	}
-	// The payments read cache is invalidated only after the merge commits, so a read racing the
-	// transaction cannot re-cache pre-merge state (both accounts' rows are moved or dropped).
-	if m.payments != nil {
-		m.payments.Invalidate(primary, secondary)
-	}
-	return nil
+	})
 }
 
 // guardActiveSharedGame returns ErrActiveGameConflict when primary and secondary
@@ -277,16 +240,25 @@ func mergeBestMoves(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUI
 	return nil
 }
 
-// mergeAccountFields bumps the primary account's updated_at to reflect the merge. The former
-// hint-wallet and paid-flag merge moved to the payments domain, where segments and benefits
-// merge by origin (see the payments MergeTx step and docs/PAYMENTS.md §6); the legacy
-// accounts.hint_balance / paid_account columns are deprecated and no longer read or written.
-func mergeAccountFields(ctx context.Context, tx *sql.Tx, primary, _ uuid.UUID, now time.Time) error {
-	upd := table.Accounts.UPDATE(table.Accounts.UpdatedAt).
-		SET(postgres.TimestampzT(now)).
-		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(primary)))
+// mergeAccountFields adds secondary's hint wallet to primary and ORs the paid flag;
+// all other profile fields stay the primary's.
+func mergeAccountFields(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, now time.Time) error {
+	var sec model.Accounts
+	if err := postgres.SELECT(table.Accounts.AllColumns).
+		FROM(table.Accounts).
+		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(secondary))).
+		QueryContext(ctx, tx, &sec); err != nil {
+		return fmt.Errorf("accountmerge: load secondary account: %w", err)
+	}
+	upd := table.Accounts.UPDATE(
+		table.Accounts.HintBalance, table.Accounts.PaidAccount, table.Accounts.UpdatedAt,
+	).SET(
+		table.Accounts.HintBalance.ADD(postgres.Int(int64(sec.HintBalance))),
+		table.Accounts.PaidAccount.OR(postgres.Bool(sec.PaidAccount)),
+		postgres.TimestampzT(now),
+	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(primary)))
 	if _, err := upd.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountmerge: touch primary account: %w", err)
+		return fmt.Errorf("accountmerge: update primary account: %w", err)
 	}
 	return nil
 }
@@ -328,77 +300,6 @@ func reassignColumn(ctx context.Context, tx *sql.Tx, tbl postgres.Table, col pos
 	return err
 }
 
-// dedupeIdentities resolves a same-kind identity collision before the blanket identity
-// reassign: when both accounts already hold an identity of the same kind (e.g. each has a
-// confirmed email — reachable when two email-bearing accounts merge), the primary keeps
-// its own and the secondary's is journaled to retained_identities (reason=merge) and
-// removed. Without this the blanket reassign would leave the survivor with two identities
-// of one kind (there is no per-account-kind unique on identities), which the profile and
-// the retention dossier both treat as singular. Non-colliding identities are untouched and
-// move with the blanket reassign.
-func dedupeIdentities(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID) error {
-	var prows []model.Identities
-	if err := postgres.SELECT(table.Identities.Kind).
-		FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(primary))).
-		QueryContext(ctx, tx, &prows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountmerge: primary identity kinds: %w", err)
-	}
-	occupied := make(map[string]struct{}, len(prows))
-	for _, r := range prows {
-		occupied[r.Kind] = struct{}{}
-	}
-	if len(occupied) == 0 {
-		return nil
-	}
-	var srows []model.Identities
-	if err := postgres.SELECT(
-		table.Identities.Kind, table.Identities.ExternalID,
-		table.Identities.Confirmed, table.Identities.CreatedAt,
-	).FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(secondary))).
-		QueryContext(ctx, tx, &srows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountmerge: secondary identities: %w", err)
-	}
-	for _, s := range srows {
-		if _, dup := occupied[s.Kind]; !dup {
-			continue
-		}
-		if err := retainMergedIdentity(ctx, tx, secondary, s); err != nil {
-			return err
-		}
-		del := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(secondary)).
-				AND(table.Identities.Kind.EQ(postgres.String(s.Kind))).
-				AND(table.Identities.ExternalID.EQ(postgres.String(s.ExternalID))),
-		)
-		if _, err := del.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountmerge: drop colliding %s identity: %w", s.Kind, err)
-		}
-	}
-	return nil
-}
-
-// retainMergedIdentity appends a retained_identities row for a secondary identity dropped
-// by a merge collision (reason=merge), preserving it in the legal dossier. It mirrors
-// account.retainIdentityTx, which is unexported; detached_at falls to the column default.
-func retainMergedIdentity(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, id model.Identities) error {
-	rid, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("accountmerge: new retained id: %w", err)
-	}
-	ins := table.RetainedIdentities.INSERT(
-		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-		table.RetainedIdentities.Reason,
-	).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainReasonMerge)
-	if _, err := ins.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountmerge: retain merged %s identity: %w", id.Kind, err)
-	}
-	return nil
-}
-
 // friendRank ranks a friendship status for dedupe precedence (higher wins).
 func friendRank(status string) int {
 	switch status {

backend/internal/adminalert/notify.go

@@ -1,115 +0,0 @@
-// Package adminalert emails the operator when new player feedback or word complaints
-// arrive, coalescing a burst into a single digest per interval so a flood is one email,
-// not N. It is inert unless an admin sender and recipient are configured. The sender is
-// distinct from the user-facing confirm-code From, and the recipient may be several
-// comma-separated addresses (the mailer splits them).
-package adminalert
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/account"
-)
-
-// FeedbackCounter counts feedback created since a time (satisfied by feedback.Service).
-type FeedbackCounter interface {
-	CountSince(ctx context.Context, since time.Time) (int, error)
-}
-
-// ComplaintCounter counts word complaints filed since a time (satisfied by game.Service).
-type ComplaintCounter interface {
-	CountComplaintsSince(ctx context.Context, since time.Time) (int, error)
-}
-
-// Notifier polls for new feedback and complaints and emails the operator a digest.
-type Notifier struct {
-	mailer     account.Mailer
-	feedback   FeedbackCounter
-	complaints ComplaintCounter
-	from       string
-	to         string
-	clock      func() time.Time
-	log        *zap.Logger
-	last       time.Time
-}
-
-// New constructs a Notifier. from and to are the alert sender and recipient(s); log may be
-// nil. The watermark starts at "now", so only items arriving after start-up are reported. The
-// digest deliberately carries no admin-console link — an admin URL must never travel in an
-// email, where a mail provider could cache or index it.
-func New(mailer account.Mailer, fb FeedbackCounter, cp ComplaintCounter, from, to string, log *zap.Logger) *Notifier {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &Notifier{
-		mailer: mailer, feedback: fb, complaints: cp, from: from, to: to,
-		clock: func() time.Time { return time.Now().UTC() }, log: log, last: time.Now().UTC(),
-	}
-}
-
-// Run polls on each tick until ctx is cancelled.
-func (n *Notifier) Run(ctx context.Context, interval time.Duration) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			n.tick(ctx)
-		}
-	}
-}
-
-// tick counts what arrived since the last watermark and, if anything did, emails one
-// digest. The watermark only advances after a successful send (or a quiet tick), so a
-// transient send failure is retried on the next tick — the counts simply grow.
-func (n *Notifier) tick(ctx context.Context) {
-	now := n.clock()
-	fb, err := n.feedback.CountSince(ctx, n.last)
-	if err != nil {
-		n.log.Warn("admin alert: count feedback failed", zap.Error(err))
-		return
-	}
-	cp, err := n.complaints.CountComplaintsSince(ctx, n.last)
-	if err != nil {
-		n.log.Warn("admin alert: count complaints failed", zap.Error(err))
-		return
-	}
-	if fb == 0 && cp == 0 {
-		n.last = now
-		return
-	}
-	if err := n.mailer.Send(ctx, n.digest(fb, cp)); err != nil {
-		n.log.Warn("admin alert: send failed", zap.Error(err))
-		return
-	}
-	n.log.Info("admin alert sent", zap.Int("feedback", fb), zap.Int("complaints", cp))
-	n.last = now
-}
-
-// digest builds the operator alert email for fb new feedback and cp new complaints.
-func (n *Notifier) digest(fb, cp int) account.Message {
-	var parts []string
-	if fb > 0 {
-		parts = append(parts, fmt.Sprintf("%d new feedback message(s)", fb))
-	}
-	if cp > 0 {
-		parts = append(parts, fmt.Sprintf("%d new word complaint(s)", cp))
-	}
-	summary := strings.Join(parts, ", ")
-	// No admin-console link in the body: an admin URL must never travel in an email (a mail
-	// provider could cache or index it). The operator opens the console directly.
-	text := summary + "."
-	return account.Message{
-		From:    n.from,
-		To:      n.to,
-		Subject: "Erudit — " + summary,
-		Text:    text,
-	}
-}

backend/internal/adminalert/notify_test.go

@@ -1,57 +0,0 @@
-package adminalert
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"scrabble/backend/internal/account"
-)
-
-// The fakes ignore the watermark and return a fixed count, which is all the digest logic
-// needs.
-type fbCounter struct{ n int }
-
-func (f fbCounter) CountSince(context.Context, time.Time) (int, error) { return f.n, nil }
-
-type cpCounter struct{ n int }
-
-func (c cpCounter) CountComplaintsSince(context.Context, time.Time) (int, error) { return c.n, nil }
-
-type recordingMailer struct{ sent []account.Message }
-
-func (m *recordingMailer) Send(_ context.Context, msg account.Message) error {
-	m.sent = append(m.sent, msg)
-	return nil
-}
-
-func TestNotifierSkipsWhenNothingNew(t *testing.T) {
-	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{0}, cpCounter{0}, "alerts@erudit-game.ru", "op@x.ru", nil)
-	n.tick(context.Background())
-	if len(mailer.sent) != 0 {
-		t.Fatalf("sent %d emails, want 0 when nothing is new", len(mailer.sent))
-	}
-}
-
-func TestNotifierDigestsNewItems(t *testing.T) {
-	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{2}, cpCounter{1}, "alerts@erudit-game.ru", "op@x.ru, two@x.ru", nil)
-	n.tick(context.Background())
-	if len(mailer.sent) != 1 {
-		t.Fatalf("sent %d emails, want 1 digest", len(mailer.sent))
-	}
-	msg := mailer.sent[0]
-	if msg.From != "alerts@erudit-game.ru" || msg.To != "op@x.ru, two@x.ru" {
-		t.Errorf("digest addressing = From %q To %q", msg.From, msg.To)
-	}
-	if !strings.Contains(msg.Subject, "2 new feedback") || !strings.Contains(msg.Subject, "1 new word complaint") {
-		t.Errorf("digest subject = %q, want the feedback + complaint counts", msg.Subject)
-	}
-	// The digest must never carry an admin-console link — an admin URL in an email is a leak
-	// (mail providers cache/index it).
-	if strings.Contains(msg.Text, "/_gm") || strings.Contains(strings.ToLower(msg.Text), "admin console") {
-		t.Errorf("digest body = %q, must not carry an admin-console link", msg.Text)
-	}
-}

backend/internal/adminconsole/assets/console.css

@@ -193,24 +193,3 @@ code { background: var(--bg); padding: 0.05rem 0.3rem; border-radius: 4px; }
 .replay-log { margin: 0.4rem 0 0; padding-left: 1.4rem; max-height: 14rem; overflow: auto; font-size: 0.85rem; }
 .replay-log li { color: var(--ink-dim); padding: 0.1rem 0; }
 .replay-log li.cur { color: var(--ink); font-weight: 600; }
-
-/* Banner colour override editor + live preview (banner_detail). The override
-   fieldsets group the enable toggle with the native colour swatches; the preview
-   renders a sample strip on both themes from those inputs (see the inline script). */
-.ovr { border: 1px solid var(--line); border-radius: 6px; padding: 0.3rem 0.8rem 0.7rem; margin: 0.2rem 0; }
-.ovr legend { padding: 0 0.3rem; font-size: 0.85rem; color: var(--ink); }
-.ovr legend label { flex-direction: row; align-items: center; gap: 0.4rem; color: var(--ink); }
-.ovr .note { margin: 0.2rem 0 0.4rem; }
-.ovr .swatches { display: flex; flex-wrap: wrap; gap: 1rem; }
-.ovr .swatches label { flex-direction: column; gap: 0.25rem; align-items: flex-start; }
-.ovr input[type=color] { width: 3rem; height: 1.8rem; padding: 0; border: 1px solid var(--line); border-radius: 4px; background: var(--bg); cursor: pointer; }
-.ovr input[type=color]:disabled { opacity: 0.4; cursor: default; }
-.ovr .hex { font-size: 0.72rem; color: var(--ink-dim); font-variant-numeric: tabular-nums; }
-.banner-preview { display: flex; flex-wrap: wrap; gap: 0.8rem; margin: 0.7rem 0 0.2rem; }
-.banner-preview .bp { flex: 1 1 18rem; }
-.banner-preview .bp-label { display: block; font-size: 0.75rem; color: var(--ink-dim); margin-bottom: 0.25rem; }
-.ad-frame { padding: 0.7rem; border-radius: 6px; border: 1px solid var(--line); }
-.ad-frame.light { background: #f4f6f9; }
-.ad-frame.dark { background: #0f1420; }
-.ad-sample { padding: 0.35rem 0.7rem; font-size: 0.85rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-.ad-sample .ad-link { text-decoration: underline; }

backend/internal/adminconsole/render_test.go

@@ -24,7 +24,6 @@ func TestRendererRendersEveryPage(t *testing.T) {
 		{"dashboard", DashboardView{Accounts: 3, Variants: []VariantVersions{{Variant: "scrabble_en", Latest: "v1", Versions: []string{"v1"}}}}, "Dashboard"},
 		{"users", UsersView{Items: []UserRow{{ID: "a1", DisplayName: "Kaya", FlaggedHighRate: true}}, Pager: NewPager(1, 50, 1)}, "high-rate"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", HasStats: true, Stats: StatsRow{Wins: 2}, TelegramID: "123", ConnectorEnabled: true}, "Send Telegram message"},
-		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", VKID: "494075"}, "vk.com/id494075"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", FlaggedHighRateAt: "2026-06-10 12:00"}, "Clear high-rate flag"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", Roles: []string{"feedback_banned"}, KnownRoles: []string{"feedback_banned"}}, "feedback_banned"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya",

backend/internal/adminconsole/templates/layout.gohtml

@@ -15,14 +15,12 @@
     <a href="/_gm/"{{if eq .ActiveNav "dashboard"}} class="active"{{end}}>Dashboard</a>
     <a href="/_gm/users"{{if eq .ActiveNav "users"}} class="active"{{end}}>Users</a>
     <a href="/_gm/games"{{if eq .ActiveNav "games"}} class="active"{{end}}>Games</a>
-    <a href="/_gm/limits"{{if eq .ActiveNav "limits"}} class="active"{{end}}>Limits</a>
     <a href="/_gm/complaints"{{if eq .ActiveNav "complaints"}} class="active"{{end}}>Complaints</a>
     <a href="/_gm/feedback"{{if eq .ActiveNav "feedback"}} class="active"{{end}}>Feedback</a>
     <a href="/_gm/messages"{{if eq .ActiveNav "messages"}} class="active"{{end}}>Messages</a>
     <a href="/_gm/throttled"{{if eq .ActiveNav "throttled"}} class="active"{{end}}>Throttled</a>
     <a href="/_gm/reasons"{{if eq .ActiveNav "reasons"}} class="active"{{end}}>Reasons</a>
     <a href="/_gm/banners"{{if eq .ActiveNav "banners"}} class="active"{{end}}>Banners</a>
-    <a href="/_gm/catalog"{{if eq .ActiveNav "catalog"}} class="active"{{end}}>Catalog</a>
     <a href="/_gm/dictionary"{{if eq .ActiveNav "dictionary"}} class="active"{{end}}>Dictionary</a>
     <a href="/_gm/broadcast"{{if eq .ActiveNav "broadcast"}} class="active"{{end}}>Broadcast</a>
     <a href="/_gm/grafana/">Grafana ↗</a>

backend/internal/adminconsole/templates/pages/banner_detail.gohtml

@@ -11,72 +11,10 @@
 <label>Starts (UTC) <input type="datetime-local" name="starts_at" value="{{.StartsAt}}"></label>
 <label>Ends (UTC) <input type="datetime-local" name="ends_at" value="{{.EndsAt}}"></label>
 <label><input type="checkbox" name="enabled"{{if .Enabled}} checked{{end}}> Enabled</label>
-<fieldset class="ovr">
-<legend><label><input type="checkbox" name="urgent"{{if .Urgent}} checked{{end}}> Urgent</label></legend>
-<p class="note">Shows to <em>everyone</em>, always — bypassing paid accounts, hint wallets and the no-banner role. While any urgent campaign is live it is the only thing the strip shows (other campaigns and the default are suppressed). For system alerts.</p>
-</fieldset>
-<fieldset class="ovr" data-ovr-group>
-<legend><label><input type="checkbox" name="override_all_on" data-ovr="all"{{if .OverrideAllOn}} checked{{end}}> Colour override — all themes</label></legend>
-<div class="swatches">
-<label>Background <input type="color" name="override_bg" value="{{.AllBg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Text <input type="color" name="override_fg" value="{{.AllFg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Link <input type="color" name="override_link" value="{{.AllLink}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
-</div>
-</fieldset>
-<fieldset class="ovr" data-ovr-group>
-<legend><label><input type="checkbox" name="override_dark_on" data-ovr="dark"{{if .OverrideDarkOn}} checked{{end}}> Colour override — dark theme only</label></legend>
-<div class="swatches">
-<label>Background <input type="color" name="override_bg_dark" value="{{.DarkBg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Text <input type="color" name="override_fg_dark" value="{{.DarkFg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Link <input type="color" name="override_link_dark" value="{{.DarkLink}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
-</div>
-</fieldset>
 {{end}}
 <div><button type="submit">Save</button></div>
 </form>
 {{if not .IsDefault}}
-<div class="banner-preview">
-<div class="bp"><span class="bp-label">Light theme</span><div class="ad-frame light"><div class="ad-sample" id="prev-light"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
-<div class="bp"><span class="bp-label">Dark theme</span><div class="ad-frame dark"><div class="ad-sample" id="prev-dark"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
-</div>
-<p class="note">Live preview of the strip on both themes. An empty override falls back to the neutral theme colours; the top/bottom border is derived from the background.</p>
-<script>
-(function(){
-  // Neutral fallbacks — mirror ui/src/app.css (--ad-bg / --text-muted / --accent).
-  var TOK={light:{bg:'#e3e7ee',fg:'#6b7280',link:'#2f6df6'},dark:{bg:'#272f3c',fg:'#9aa3b2',link:'#5b8cff'}};
-  function byName(n){return document.querySelector('[name="'+n+'"]');}
-  var allOn=byName('override_all_on'), darkOn=byName('override_dark_on');
-  if(!allOn||!darkOn){return;}
-  var f={ab:byName('override_bg'),af:byName('override_fg'),al:byName('override_link'),db:byName('override_bg_dark'),df:byName('override_fg_dark'),dl:byName('override_link_dark')};
-  var lightEl=document.getElementById('prev-light'), darkEl=document.getElementById('prev-dark');
-  function hexToRgb(h){h=h.replace('#','');return [parseInt(h.slice(0,2),16),parseInt(h.slice(2,4),16),parseInt(h.slice(4,6),16)];}
-  function pad(x){x=Math.max(0,Math.min(255,Math.round(x))).toString(16);return x.length<2?'0'+x:x;}
-  function rgbToHex(r){return '#'+pad(r[0])+pad(r[1])+pad(r[2]);}
-  function mix(a,b,t){return [a[0]+(b[0]-a[0])*t,a[1]+(b[1]-a[1])*t,a[2]+(b[2]-a[2])*t];}
-  function lum(r){return (0.2126*r[0]+0.7152*r[1]+0.0722*r[2])/255;}
-  // Derived border: nudge the background 14% toward black on a light bg, toward white on a dark bg.
-  function border(bg){var r=hexToRgb(bg);return rgbToHex(mix(r, lum(r)>0.5?[0,0,0]:[255,255,255], 0.14));}
-  function paint(el,c){
-    el.style.background=c.bg; el.style.color=c.fg;
-    el.style.borderTop='1px solid '+border(c.bg); el.style.borderBottom='1px solid '+border(c.bg);
-    var a=el.querySelector('.ad-link'); if(a){a.style.color=c.link;}
-  }
-  function resolve(){
-    var light=allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.light;
-    var dark=darkOn.checked?{bg:f.db.value,fg:f.df.value,link:f.dl.value}
-            :(allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.dark);
-    paint(lightEl,light); paint(darkEl,dark);
-    document.querySelectorAll('.ovr .swatches label').forEach(function(lab){
-      var inp=lab.querySelector('input[type=color]'), hx=lab.querySelector('.hex');
-      if(inp&&hx){hx.textContent=inp.value;}
-    });
-  }
-  function toggleGroup(chk){chk.closest('fieldset').querySelectorAll('[data-ovr-color]').forEach(function(inp){inp.disabled=!chk.checked;});}
-  [allOn,darkOn].forEach(function(chk){chk.addEventListener('change',function(){toggleGroup(chk);resolve();});});
-  Object.keys(f).forEach(function(k){f[k].addEventListener('input',resolve);});
-  resolve();
-})();
-</script>
 <form class="form" method="post" action="/_gm/banners/{{.ID}}/delete" onsubmit="return confirm('Delete this campaign and its messages?')">
 <button type="submit" class="danger">Delete campaign</button>
 </form>

backend/internal/adminconsole/templates/pages/catalog.gohtml

@@ -1,66 +0,0 @@
-{{define "content" -}}
-<h1>Product catalog</h1>
-{{with .Data}}
-<p class="note">A <strong>pack</strong> funds chips (a money price per rail — RUB via direct, VOTE via vk, XTR via telegram); a <strong>value</strong> buys benefits with chips (a CHIP price). Archived products are hidden from players but still credit an in-flight payment and can be granted. A product with transactions can only be archived, not deleted. Amounts are in minor units (RUB kopecks; VOTE/XTR/CHIP whole). The <code>tournament</code> atom is not sellable yet — keep such a product archived.</p>
-<section class="panel"><h2>Add product</h2>
-<form class="form col" method="post" action="/_gm/catalog">
-<label>Title <input type="text" name="title" maxlength="120" required></label>
-<fieldset><legend>Atoms (quantity; blank = none)</legend>
-<label>Chips <input type="number" name="chips" min="0"></label>
-<label>Hints <input type="number" name="hints" min="0"></label>
-<label>No-ads days <input type="number" name="noads" min="0"></label>
-<label>Tournament <input type="number" name="tournament" min="0"></label>
-</fieldset>
-<fieldset><legend>Prices (minor units; blank = none)</legend>
-<label>RUB — direct (kopecks) <input type="number" name="price_rub" min="0"></label>
-<label>VOTE — vk <input type="number" name="price_vote" min="0"></label>
-<label>XTR — telegram <input type="number" name="price_star" min="0"></label>
-<label>CHIP — value <input type="number" name="price_chip" min="0"></label>
-</fieldset>
-<label><input type="checkbox" name="active" value="true"> Active (on sale)</label>
-<div><button type="submit">Add</button></div>
-</form>
-</section>
-<section class="panel"><h2>Rewarded ads (watch for chips)</h2>
-<p class="note">The chips a player earns per rewarded-video view (VK only), plus the per-day and per-hour caps that bound free chips — <strong>0 payout turns rewarded off</strong>. This is the shared reward config, not a product.</p>
-<form class="form col" method="post" action="/_gm/catalog/reward">
-<label>Chips per view <input type="number" name="reward_payout" min="0" value="{{.RewardPayout}}"></label>
-<label>Daily cap <input type="number" name="reward_daily" min="0" value="{{.RewardDailyCap}}"></label>
-<label>Hourly cap <input type="number" name="reward_hourly" min="0" value="{{.RewardHourlyCap}}"></label>
-<div><button type="submit">Save</button></div>
-</form>
-</section>
-<section class="panel"><h2>Payment availability (kill switch)</h2>
-<p class="note">Turn purchases off on a rail/channel and show the user a localized reason on their next attempt. Unchecked = off; an empty message shows a built-in &ldquo;temporarily unavailable&rdquo;. Fail-open: a rail you never touch stays on. A per-user &ldquo;allow&rdquo; override (on a user card) bypasses this switch.</p>
-{{range .Rails}}
-<form class="form col" method="post" action="/_gm/catalog/rail-status">
-<input type="hidden" name="rail" value="{{.Rail}}">
-<label><input type="checkbox" name="enabled" {{if .Enabled}}checked{{end}}> <code>{{.Rail}}</code> &mdash; purchases enabled</label>
-<label>Message RU <input type="text" name="message_ru" maxlength="200" value="{{.MessageRU}}"></label>
-<label>Message EN <input type="text" name="message_en" maxlength="200" value="{{.MessageEN}}"></label>
-<div><button type="submit">Save</button></div>
-</form>
-{{end}}
-</section>
-<section class="panel"><h2>Products</h2>
-<p class="note">Showing {{if .ShowAll}}<strong>all</strong> products (active + archived) — <a href="/_gm/catalog">active only</a>{{else}}<strong>active</strong> products — <a href="/_gm/catalog?all=1">show all (incl. archived)</a>{{end}}.</p>
-<table class="list">
-<thead><tr><th>Title</th><th>Status</th><th>Atoms</th><th>Prices</th><th></th></tr></thead>
-<tbody>
-{{range .Products}}
-<tr>
-<td><a href="/_gm/catalog/{{.ID}}">{{.Title}}</a></td>
-<td>{{if .Active}}<span class="ok">active</span>{{else}}<span class="warn">archived</span>{{end}}{{if .Transacted}} <span class="pill">transacted</span>{{end}}</td>
-<td>{{range .Atoms}}<code>{{.Atom}}×{{.Quantity}}</code> {{end}}</td>
-<td>{{range .Prices}}<code>{{.Currency}}{{if .Method}}/{{.Method}}{{end}} {{.Amount}}</code> {{end}}</td>
-<td class="row-actions">
-<form class="form" method="post" action="/_gm/catalog/{{.ID}}/archive"><input type="hidden" name="active" value="{{if .Active}}false{{else}}true{{end}}"><button type="submit">{{if .Active}}Archive{{else}}Unarchive{{end}}</button></form>
-{{if not .Transacted}}<form class="form" method="post" action="/_gm/catalog/{{.ID}}/delete" onsubmit="return confirm('Delete this product? It has never been transacted, so this is safe and permanent.')"><button type="submit">Delete</button></form>{{end}}
-</td>
-</tr>
-{{else}}<tr><td colspan="5"><span class="note">no products</span></td></tr>{{end}}
-</tbody>
-</table>
-</section>
-{{end}}
-{{- end}}

backend/internal/adminconsole/templates/pages/feedback_detail.gohtml

@@ -7,9 +7,8 @@
 <li><b>From</b> <a href="/_gm/users/{{.AccountID}}">{{.SenderName}}</a> ({{.Source}})</li>
 <li><b>Channel</b> {{.Channel}}</li>
 <li><b>Interface language</b> {{.InterfaceLanguage}}</li>
-<li><b>App version</b> {{if .Version}}<code>{{.Version}}</code>{{else}}<span class="note">unknown</span>{{end}}</li>
 <li><b>IP</b> {{if .IP}}<code>{{.IP}}</code>{{else}}<span class="note">none</span>{{end}}</li>
-<li><b>Filed</b> {{.CreatedAt}} UTC &middot; browser {{if .CreatedAtBrowser}}{{.CreatedAtBrowser}} ({{.BrowserTZ}}){{else}}<span class="note">N/A</span>{{end}} &middot; user {{if .CreatedAtUser}}{{.CreatedAtUser}} ({{.UserTZ}}){{else}}<span class="note">N/A</span>{{end}}</li>
+<li><b>Filed</b> {{.CreatedAt}}</li>
 <li><b>State</b> {{if .Archived}}archived{{else if .Read}}read{{else}}<span class="warn">unread</span>{{end}}</li>
 {{if .Banned}}<li><b>Feedback</b> <span class="warn">sender is banned from feedback</span></li>{{end}}
 </ul>

backend/internal/adminconsole/templates/pages/game_detail.gohtml

@@ -8,7 +8,6 @@
 <li><b>Dictionary</b> {{.DictVersion}}</li>
 <li><b>Status</b> {{.Status}}{{if .EndReason}} ({{.EndReason}}){{end}}</li>
 <li><b>AI game</b> {{if .VsAI}}🤖 yes{{else}}no{{end}}</li>
-<li><b>Word rule</b> {{if .MultipleWordsPerTurn}}multiple words per turn{{else}}single word per turn{{end}}</li>
 <li><b>Players</b> {{.Players}}</li>
 <li><b>To move</b> seat {{.ToMove}}</li>
 <li><b>Moves</b> {{.MoveCount}}</li>

backend/internal/adminconsole/templates/pages/games.gohtml

@@ -8,11 +8,11 @@
 <a href="/_gm/games?status=finished"{{if eq .Status "finished"}} class="active"{{end}}>finished</a>
 </nav>
 <table class="list">
-<thead><tr><th>Game</th><th>Variant</th><th>Kind</th><th>Status</th><th>🤖</th><th class="num">Players</th><th>Updated</th></tr></thead>
+<thead><tr><th>Game</th><th>Variant</th><th>Status</th><th>🤖</th><th class="num">Players</th><th>Updated</th></tr></thead>
 <tbody>
 {{range .Items}}
-<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Kind}}</td><td>{{.Status}}</td><td>{{if .VsAI}}🤖{{end}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
-{{else}}<tr><td colspan="7"><span class="note">no games</span></td></tr>{{end}}
+<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Status}}</td><td>{{if .VsAI}}🤖{{end}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
+{{else}}<tr><td colspan="6"><span class="note">no games</span></td></tr>{{end}}
 </tbody>
 </table>
 <nav class="pager">

backend/internal/adminconsole/templates/pages/limits.gohtml

@@ -1,19 +0,0 @@
-{{define "content" -}}
-<h1>Active-game limits</h1>
-{{with .Data}}
-<p class="note">Per-tier, per-kind caps on a player's simultaneous unfinished games. <strong>-1</strong> = unlimited, <strong>0</strong> = the kind is blocked, a positive number caps concurrent games of that kind. Guests are additionally blocked from friend games outright. Changes apply immediately (no redeploy); games already in progress are never affected.</p>
-<section class="panel">
-<form class="form col" method="post" action="/_gm/limits">
-<h2>Guest</h2>
-<label>vs AI <input type="number" name="guest_vs_ai" min="-1" value="{{.GuestVsAI}}" required></label>
-<label>Random <input type="number" name="guest_random" min="-1" value="{{.GuestRandom}}" required></label>
-<label>Friends <input type="number" name="guest_friends" min="-1" value="{{.GuestFriends}}" required></label>
-<h2>Durable account</h2>
-<label>vs AI <input type="number" name="durable_vs_ai" min="-1" value="{{.DurableVsAI}}" required></label>
-<label>Random <input type="number" name="durable_random" min="-1" value="{{.DurableRandom}}" required></label>
-<label>Friends <input type="number" name="durable_friends" min="-1" value="{{.DurableFriends}}" required></label>
-<div><button type="submit">Save</button></div>
-</form>
-</section>
-{{end}}
-{{- end}}

backend/internal/adminconsole/templates/pages/product_detail.gohtml

@@ -1,25 +0,0 @@
-{{define "content" -}}
-{{with .Data}}
-<p class="note"><a href="/_gm/catalog">← all products</a></p>
-<h1>{{.Title}} {{if .Active}}<span class="ok">active</span>{{else}}<span class="warn">archived</span>{{end}}{{if .Transacted}} <span class="pill">transacted</span>{{end}}</h1>
-<section class="panel"><h2>Edit</h2>
-<p class="note">A zero quantity / blank price removes that atom / price. Amounts are in minor units. Saving revalidates the sellable shape when the product is active. Archive / unarchive from the <a href="/_gm/catalog">catalog list</a>.</p>
-<form class="form col" method="post" action="/_gm/catalog/{{.ID}}">
-<label>Title <input type="text" name="title" value="{{.Title}}" maxlength="120" required></label>
-<fieldset><legend>Atoms (quantity; 0 = none)</legend>
-<label>Chips <input type="number" name="chips" min="0" value="{{.Chips}}"></label>
-<label>Hints <input type="number" name="hints" min="0" value="{{.Hints}}"></label>
-<label>No-ads days <input type="number" name="noads" min="0" value="{{.NoAds}}"></label>
-<label>Tournament <input type="number" name="tournament" min="0" value="{{.Tournament}}"></label>
-</fieldset>
-<fieldset><legend>Prices (minor units; 0 = none)</legend>
-<label>RUB — direct (kopecks) <input type="number" name="price_rub" min="0" value="{{.PriceRUB}}"></label>
-<label>VOTE — vk <input type="number" name="price_vote" min="0" value="{{.PriceVote}}"></label>
-<label>XTR — telegram <input type="number" name="price_star" min="0" value="{{.PriceStar}}"></label>
-<label>CHIP — value <input type="number" name="price_chip" min="0" value="{{.PriceChip}}"></label>
-</fieldset>
-<div><button type="submit">Save</button></div>
-</form>
-</section>
-{{end}}
-{{- end}}

backend/internal/adminconsole/templates/pages/user_detail.gohtml

@@ -10,6 +10,8 @@
 <li><b>Timezone</b> {{.TimeZone}}</li>
 <li><b>Guest</b> {{if .Guest}}yes{{else}}no{{end}}</li>
 <li><b>Push</b> {{if .NotificationsInAppOnly}}in-app only{{else}}out-of-app{{end}}</li>
+<li><b>Paid</b> {{if .PaidAccount}}yes{{else}}no{{end}}</li>
+<li><b>Hint wallet</b> {{.HintBalance}}</li>
 {{if .MergedInto}}<li><b>Merged into</b> {{.MergedInto}}</li>{{end}}
 {{if .FlaggedHighRateAt}}<li><b>High-rate flag</b> <span class="warn">{{.FlaggedHighRateAt}}</span></li>{{end}}
 <li><b>Created</b> {{.CreatedAt}}</li>
@@ -19,6 +21,10 @@
 <button type="submit">Clear high-rate flag</button>
 </form>
 {{end}}
+<form class="form" method="post" action="/_gm/users/{{.ID}}/grant-hints">
+<label>Add hints <input type="number" name="amount" min="1" max="{{.HintGrantMax}}" value="1"></label>
+<button type="submit">Grant</button>
+</form>
 </section>
 <section class="panel"><h2>Statistics</h2>
 {{if .HasStats}}
@@ -63,61 +69,6 @@
 <div><button type="submit">{{if .Suspension.Blocked}}Re-block{{else}}Block{{end}}</button></div>
 </form>
 </section>
-<section class="panel"><h2>Finance</h2>
-{{if .Finance.Present}}
-{{if or .Finance.Segments .Finance.Benefits .Finance.Abuse .Finance.Loss}}
-<ul class="kv">
-{{range .Finance.Segments}}<li><b>Chips ({{.Source}})</b> {{.Chips}}</li>{{end}}
-{{range .Finance.Benefits}}<li><b>Benefits ({{.Origin}})</b> {{.Hints}} hints{{if .Forever}} · no-ads forever{{else if .AdsUntil}} · no-ads until {{.AdsUntil}} (UTC){{end}}</li>{{end}}
-{{if or .Finance.Abuse .Finance.Loss}}<li><b>Refund risk</b> <span class="warn">{{if .Finance.Abuse}}abuse-flagged{{end}}{{if .Finance.Loss}} · loss {{.Finance.Loss}} chips{{end}}</span></li>{{end}}
-</ul>
-{{else}}<p class="note">no balances or benefits</p>{{end}}
-<h3>Payment override</h3>
-<form class="form" method="post" action="/_gm/users/{{.ID}}/purchase-override">
-<label>Purchases for this account
-<select name="override">
-<option value="default" {{if eq .PurchaseOverride "default"}}selected{{end}}>Default (follow the rail switch)</option>
-<option value="allow" {{if eq .PurchaseOverride "allow"}}selected{{end}}>Always allow (bypasses the rail switch only, not security)</option>
-<option value="deny" {{if eq .PurchaseOverride "deny"}}selected{{end}}>Always deny</option>
-</select></label>
-<div><button type="submit">Save</button></div>
-</form>
-<h3>Ledger</h3>
-{{$uid := .ID}}
-{{if .Finance.Ledger}}
-<table class="list">
-<thead><tr><th>Time</th><th>Kind</th><th>Source</th><th>Origin</th><th>Chips</th><th>Order</th><th>Provider</th><th>Shop</th><th>Detail</th><th></th></tr></thead>
-<tbody>
-{{range .Finance.Ledger}}
-<tr><td>{{.At}}</td><td>{{.Kind}}</td><td>{{.Source}}</td><td>{{.Origin}}</td><td>{{.ChipsDelta}}</td><td>{{if .Order}}<code>{{.Order}}</code>{{end}}</td><td>{{.Provider}}</td><td>{{.Shop}}</td><td>{{if .Snapshot}}<code>{{.Snapshot}}</code>{{end}}</td>
-<td>{{if and (eq .Kind "fund") .Order}}<form class="form" method="post" action="/_gm/users/{{$uid}}/refund" onsubmit="return confirm('Refund this order in full? Record the money refund on the rail first; this revokes the chips (floored at 0).')"><input type="hidden" name="order_id" value="{{.Order}}"><button type="submit">Refund</button></form>{{end}}</td></tr>
-{{end}}
-</tbody>
-</table>
-<p class="note"><a href="/_gm/ledger.csv">Export the full ledger (CSV)</a> — all accounts, for tax + reconciliation.</p>
-{{else}}<p class="note">no ledger entries</p>{{end}}
-{{else}}<p class="note">payments not enabled</p>{{end}}
-</section>
-<section class="panel"><h2>Grant benefits</h2>
-{{if .Grant.Present}}
-<p class="note">A zero-price admin sale of a value — <strong>never chips</strong>. The origin is your compliance choice. The by-product grant applies a defined bundle, including an archived reward product.</p>
-<form class="form col" method="post" action="/_gm/users/{{.ID}}/grant">
-<label>Origin <select name="origin">{{range .Grant.Origins}}<option value="{{.}}">{{.}}</option>{{end}}</select></label>
-<label>Hints <input type="number" name="hints" min="0" value="0"></label>
-<label>No-ads days <input type="number" name="noads" min="0" value="0"></label>
-<label><input type="checkbox" name="forever" value="true"> No-ads forever</label>
-<div><button type="submit">Grant</button></div>
-</form>
-{{if .Grant.Products}}
-<h3>Grant a product</h3>
-<form class="form col" method="post" action="/_gm/users/{{.ID}}/grant-product">
-<label>Origin <select name="origin">{{range .Grant.Origins}}<option value="{{.}}">{{.}}</option>{{end}}</select></label>
-<label>Product <select name="product_id">{{range .Grant.Products}}<option value="{{.ID}}">{{.Title}} ({{.Summary}}){{if .Archived}} — archived{{end}}</option>{{end}}</select></label>
-<div><button type="submit">Grant product</button></div>
-</form>
-{{else}}<p class="note">no grantable products — create a value product in the <a href="/_gm/catalog">catalog</a></p>{{end}}
-{{else}}<p class="note">payments not enabled</p>{{end}}
-</section>
 <section class="panel"><h2>Roles</h2>
 {{$id := .ID}}
 {{if .Roles}}
@@ -150,29 +101,6 @@
 {{else}}<tr><td colspan="4"><span class="note">no identities (guest)</span></td></tr>{{end}}
 </tbody>
 </table>
-{{if .HasEmail}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/remove-email" onsubmit="return confirm('Erase the email identity from this account? The address will be freed.')">
-<button type="submit">Erase email</button>
-</form>
-{{end}}
-</section>
-<section class="panel"><h2>Deletion &amp; retention</h2>
-{{if .LastLoginAt}}<p class="note">Last login: {{.LastLoginAt}}{{if .LastLoginIP}} — <code>{{.LastLoginIP}}</code>{{end}}</p>{{end}}
-{{if .Deleted}}<p><span class="warn">Deleted</span> at {{.DeletedAt}}{{if .DeletedName}} — was <code>{{.DeletedName}}</code>{{end}}</p>{{end}}
-{{if .Retained}}
-<h3>Retention journal (legal dossier of detached credentials)</h3>
-<table class="list">
-<thead><tr><th>Kind</th><th>Credential</th><th>Reason</th><th>Detached</th></tr></thead>
-<tbody>
-{{range .Retained}}<tr><td>{{.Kind}}</td><td><code>{{.ExternalID}}</code></td><td>{{.Reason}}</td><td>{{.DetachedAt}}</td></tr>{{end}}
-</tbody>
-</table>
-{{end}}
-{{if not .Deleted}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/delete" onsubmit="return confirm('Delete this account? Its credentials are journalled and freed, its data anonymised, and its sessions revoked. This cannot be undone.')">
-<button type="submit">Delete user</button>
-</form>
-{{end}}
 </section>
 <section class="panel"><h2>Friends</h2>
 <table class="list">
@@ -214,18 +142,13 @@
 {{else}}<p class="note">connector not configured (set BACKEND_CONNECTOR_ADDR)</p>{{end}}
 </section>
 {{end}}
-{{if .VKID}}
-<section class="panel"><h2>VK</h2>
-<p>VK ID: <code>{{.VKID}}</code> · <a href="https://vk.com/id{{.VKID}}" target="_blank" rel="noopener">open profile</a></p>
-</section>
-{{end}}
 <section class="panel"><h2>Games</h2>
 <table class="list">
-<thead><tr><th>Game</th><th>Variant</th><th>Kind</th><th>Status</th><th class="num">Players</th><th>Updated</th></tr></thead>
+<thead><tr><th>Game</th><th>Variant</th><th>Status</th><th class="num">Players</th><th>Updated</th></tr></thead>
 <tbody>
 {{range .Games}}
-<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Kind}}</td><td>{{.Status}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
-{{else}}<tr><td colspan="6"><span class="note">no games</span></td></tr>{{end}}
+<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Status}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
+{{else}}<tr><td colspan="5"><span class="note">no games</span></td></tr>{{end}}
 </tbody>
 </table>
 </section>

backend/internal/adminconsole/templates/pages/users.gohtml

@@ -2,15 +2,13 @@
 <h1>Users</h1>
 {{with .Data}}
 <nav class="subnav">
-<a href="/_gm/users"{{if and (not .Robots) (not .Deleted)}} class="active"{{end}}>People</a> ·
-<a href="/_gm/users?kind=deleted"{{if .Deleted}} class="active"{{end}}>Deleted</a> ·
+<a href="/_gm/users"{{if not .Robots}} class="active"{{end}}>People</a> ·
 <a href="/_gm/users?kind=robots"{{if .Robots}} class="active"{{end}}>Robots</a>
 </nav>
 <form class="form" method="get" action="/_gm/users">
-{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}{{if .Deleted}}<input type="hidden" name="kind" value="deleted">{{end}}
+{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}
 <input name="name" value="{{.NameMask}}" placeholder="display name mask (* ?)">
 <input name="ext" value="{{.ExternalIDMask}}" placeholder="external id mask (* ?)">
-<input name="email" value="{{.EmailExact}}" placeholder="email (exact)" type="search">
 <button type="submit">Filter</button>
 </form>
 <table class="list">
@@ -19,7 +17,7 @@
 {{range .Items}}
 <tr>
 <td><a href="/_gm/users/{{.ID}}">{{.ID}}</a></td>
-<td>{{.DisplayName}}{{if .Deleted}} <span class="pill">deleted</span>{{end}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
+<td>{{.DisplayName}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
 <td>{{.Kind}}</td>
 <td>{{.Language}}</td>
 <td>{{.CreatedAt}}</td>

backend/internal/adminconsole/views.go

@@ -60,10 +60,8 @@ type UsersView struct {
 	// be emitted verbatim — interpolated as a plain string it would have its "=" and "&"
 	// percent-encoded again by the contextual escaper.
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 	FilterQuery    template.URL
 }
 
@@ -76,7 +74,6 @@ type UserRow struct {
 	Kind            string
 	Language        string
 	Guest           bool
-	Deleted         bool
 	FlaggedHighRate bool
 	CreatedAt       string
 	HasMoveStats    bool
@@ -149,33 +146,23 @@ type UserDetailView struct {
 	TimeZone               string
 	Guest                  bool
 	NotificationsInAppOnly bool
+	PaidAccount            bool
 	// MergedInto is the primary account id when this account has been retired by a
 	// merge, or empty for a live account.
 	MergedInto string
-	// The account-deletion dossier. Deleted marks a tombstoned account; DeletedAt and
-	// DeletedName are its deletion time and retained real name; LastLoginAt/IP are the
-	// last cold-load stamp (shown for any account); Retained is the credential journal.
-	Deleted     bool
-	DeletedAt   string
-	DeletedName string
-	LastLoginAt string
-	LastLoginIP string
-	Retained    []RetainedRow
 	// FlaggedHighRateAt is the pre-formatted soft high-rate marker timestamp,
 	// empty for an unflagged account; the card shows it with the Clear action.
 	FlaggedHighRateAt string
-	CreatedAt         string
-	HasStats          bool
-	Stats             StatsRow
-	Identities        []IdentityRow
-	// HasEmail gates the "Erase email" action; set when the account carries an email identity.
-	HasEmail bool
-	Games    []GameRow
-	// TelegramID and VKID are the account's platform external ids (empty when absent).
-	// TelegramID gates the "Send Telegram message" operator action; VKID surfaces the VK
-	// user id with a link to the VK profile (there is no VK messaging to drive).
+	HintBalance       int
+	// HintGrantMax is the per-grant cap the operator's "add hints" form enforces (it mirrors the
+	// server's maxHintGrant), passed through so the policy value lives in one place.
+	HintGrantMax     int
+	CreatedAt        string
+	HasStats         bool
+	Stats            StatsRow
+	Identities       []IdentityRow
+	Games            []GameRow
 	TelegramID       string
-	VKID             string
 	ConnectorEnabled bool
 	// MoveChart is the pre-rendered inline SVG of the account's per-move-number think
 	// time (min/mean/max), empty when the account has no timed move.
@@ -195,59 +182,6 @@ type UserDetailView struct {
 	Blocks    []RelationRow
 	BlockedBy []RelationRow
 	Friends   []RelationRow
-	// Finance is the account's payments picture (balances, benefits, refund risk, ledger). Present
-	// is false when the payments domain is unwired.
-	Finance FinanceView
-	// PurchaseOverride is the account's per-account purchase override ("default"/"allow"/"deny"),
-	// shown in and edited from the user card's payment-override control.
-	PurchaseOverride string
-	// Grant is the admin-grant panel (origin picker + grantable products). Present is false when the
-	// payments domain is unwired.
-	Grant GrantFormView
-}
-
-// FinanceView is the account's payments picture on the user card: chip balances per funding
-// segment, benefits per origin, the recorded refund risk, and the append-only ledger history
-// (newest first). Present is false when the payments domain is unwired.
-type FinanceView struct {
-	Present  bool
-	Segments []SegmentRow
-	Benefits []BenefitRow
-	// Abuse is the refund abuse flag; Loss is the unrecoverable chip loss from floor-0 refunds.
-	Abuse  bool
-	Loss   int
-	Ledger []LedgerRow
-}
-
-// SegmentRow is one funding segment's chip balance.
-type SegmentRow struct {
-	Source string
-	Chips  int
-}
-
-// BenefitRow is one origin's benefit: the hint wallet, the ad-free expiry (pre-formatted, empty
-// when none) and the lifetime ad-free flag.
-type BenefitRow struct {
-	Origin   string
-	Hints    int
-	AdsUntil string
-	Forever  bool
-}
-
-// LedgerRow is one append-only ledger entry: its kind, funding source / benefit origin, signed chip
-// delta, the product / order / provider / direct-rail shop it references (empty when none), the raw
-// snapshot JSON and the pre-formatted time.
-type LedgerRow struct {
-	Kind       string
-	Source     string
-	Origin     string
-	ChipsDelta int
-	Product    string
-	Order      string
-	Provider   string
-	Shop       string
-	Snapshot   string
-	At         string
 }
 
 // RelationRow is one cross-linked account in the user card's blocks / blocked-by / friends
@@ -296,17 +230,6 @@ type IdentityRow struct {
 	CreatedAt  string
 }
 
-// RetainedRow is one credential in the account-deletion retention journal (the legal
-// dossier of detached credentials): what was detached, when, and why.
-type RetainedRow struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   string
-	DetachedAt string
-}
-
 // GameRow is one game row in a list.
 type GameRow struct {
 	ID        string
@@ -316,8 +239,6 @@ type GameRow struct {
 	UpdatedAt string
 	// VsAI marks an honest-AI game (rendered as 🤖 in the list's AI column).
 	VsAI bool
-	// Kind is the game's origin tag label: vs_ai / random / friends / unknown.
-	Kind string
 }
 
 // GamesView is the paginated games list, optionally filtered by status.
@@ -327,17 +248,6 @@ type GamesView struct {
 	Pager  Pager
 }
 
-// GameLimitsView is the per-tier, per-kind active-game limit form: each field is a cap where -1
-// is unlimited, 0 blocks the kind, and a positive value caps concurrent games of that kind.
-type GameLimitsView struct {
-	GuestVsAI      int
-	GuestRandom    int
-	GuestFriends   int
-	DurableVsAI    int
-	DurableRandom  int
-	DurableFriends int
-}
-
 // GameDetailView is one game with its seats.
 type GameDetailView struct {
 	ID          string
@@ -352,12 +262,8 @@ type GameDetailView struct {
 	UpdatedAt   string
 	FinishedAt  string
 	// VsAI marks an honest-AI game (shown as a 🤖 flag in the summary).
-	VsAI bool
-	// MultipleWordsPerTurn is the game's cross-word rule: true = standard Scrabble (every cross-word
-	// is validated and scored), false = the single-word rule (only the main word along the play
-	// direction counts). Shown in the summary so an operator can tell the rule at a glance.
-	MultipleWordsPerTurn bool
-	Seats                []SeatRow
+	VsAI  bool
+	Seats []SeatRow
 	// HasRobot is true when any seat is a robot, gating the robot-target caption;
 	// RobotTargetPct is the configured global play-to-win rate, in percent.
 	HasRobot       bool
@@ -563,30 +469,15 @@ type BannerCampaignRow struct {
 
 // BannerDetailView is the campaign detail/edit page. StartsAt/EndsAt are the
 // "YYYY-MM-DDTHH:MM" (UTC) values for the datetime-local inputs, empty when open.
-//
-// The colour-override and urgent fields drive the non-default campaign's editor:
-// OverrideAllOn/OverrideDarkOn report whether each colour set is active, and the
-// six *Bg/*Fg/*Link values seed the native colour inputs — the stored override
-// when a set is on, otherwise the neutral theme token so the picker starts from a
-// sensible colour and the live preview shows the real fallback.
 type BannerDetailView struct {
-	ID             string
-	Name           string
-	Weight         int
-	IsDefault      bool
-	Enabled        bool
-	StartsAt       string
-	EndsAt         string
-	Urgent         bool
-	OverrideAllOn  bool
-	AllBg          string
-	AllFg          string
-	AllLink        string
-	OverrideDarkOn bool
-	DarkBg         string
-	DarkFg         string
-	DarkLink       string
-	Messages       []BannerMessageRow
+	ID        string
+	Name      string
+	Weight    int
+	IsDefault bool
+	Enabled   bool
+	StartsAt  string
+	EndsAt    string
+	Messages  []BannerMessageRow
 }
 
 // BannerMessageRow is one bilingual message of a campaign. First/Last drive the
@@ -663,104 +554,5 @@ type FeedbackDetailView struct {
 	ReplyBody         string
 	RepliedAt         string
 	CreatedAt         string
-	// Version is the client app build the report was sent from (empty for rows that predate it).
-	Version string
-	// The Filed time is shown in three zones so the operator can tell what is certainly known from
-	// what is merely defaulted. CreatedAt is the authoritative UTC time. CreatedAtBrowser is that
-	// instant in the client's UTC offset detected at submit (BrowserTZ its "±HH:MM" label), empty
-	// when the client reported none (an older build). CreatedAtUser is that instant in the sender's
-	// saved profile zone (UserTZ its label), empty when the account has no zone beyond the UTC
-	// default — the template then shows "N/A" so the missing datum is explicit.
-	CreatedAtBrowser string
-	BrowserTZ        string
-	CreatedAtUser    string
-	UserTZ           string
-	Banned           bool
-}
-
-// CatalogView is the product-catalog list page.
-type CatalogView struct {
-	Products []ProductRow
-	// ShowAll reports whether archived products are listed alongside active ones (the active/all
-	// toggle); it drives the toggle link and the list heading.
-	ShowAll bool
-	// RewardPayout / RewardDailyCap / RewardHourlyCap are the rewarded-video config (chips earned per
-	// view and the per-day / per-hour anti-abuse caps), shown in and edited from the page's
-	// rewarded-ads form. A 0 payout means rewarded is inert.
-	RewardPayout    int
-	RewardDailyCap  int
-	RewardHourlyCap int
-	// Rails is the per-rail operational kill-switch state (enabled + per-language off-message), shown
-	// in and edited from the page's payment-availability form.
-	Rails []RailStatusRow
-}
-
-// RailStatusRow is one payment rail's operational availability in the kill-switch editor: the rail
-// key, whether purchases are enabled, and the operator's per-language off-message shown to the user.
-type RailStatusRow struct {
-	Rail      string
-	Enabled   bool
-	MessageRU string
-	MessageEN string
-}
-
-// ProductRow is one product in the catalog list: its composition, prices, the archived flag
-// (Active) and the transacted flag (which forbids a hard delete).
-type ProductRow struct {
-	ID         string
-	Title      string
-	Active     bool
-	Atoms      []AtomRow
-	Prices     []PriceRow
-	Transacted bool
-}
-
-// AtomRow is one atom line of a product row.
-type AtomRow struct {
-	Atom     string
-	Quantity int
-}
-
-// PriceRow is one price of a product: the method ("" for a value's CHIP price), the currency, and
-// the amount in that currency's minor units.
-type PriceRow struct {
-	Method   string
-	Currency string
-	Amount   int64
-}
-
-// ProductFormView is the product edit form, pre-filled from the current composition. Atom quantities
-// and prices are flattened to the fixed fields the form offers (0 = absent); Transacted disables the
-// delete action.
-type ProductFormView struct {
-	ID         string
-	Title      string
-	Active     bool
-	Chips      int
-	Hints      int
-	NoAds      int
-	Tournament int
-	PriceRUB   int64
-	PriceVote  int64
-	PriceStar  int64
-	PriceChip  int64
-	Transacted bool
-}
-
-// GrantFormView is the admin-grant panel on the user card: the origin picker and the grantable
-// products (value bundles — hints / no-ads days — including archived ones; chips and tournament
-// products are excluded). Present is false when the payments domain is unwired.
-type GrantFormView struct {
-	Present  bool
-	Origins  []string
-	Products []GrantProductOption
-}
-
-// GrantProductOption is one grantable product in the by-product picker: its id, title, an atom
-// summary, and whether it is archived (the common case for a non-public reward bundle).
-type GrantProductOption struct {
-	ID       string
-	Title    string
-	Summary  string
-	Archived bool
+	Banned            bool
 }

backend/internal/ads/ads.go

@@ -30,15 +30,6 @@ var ErrDefaultImmutable = errors.New("ads: the default campaign cannot be modifi
 // window or message body).
 var ErrValidation = errors.New("ads: validation")
 
-// ColorSet is an optional per-campaign colour override for the banner strip:
-// background, foreground (text) and link, each a "#rrggbb" hex string. The three
-// are set together or the whole set is absent (a nil *ColorSet).
-type ColorSet struct {
-	Bg   string
-	Fg   string
-	Link string
-}
-
 // Campaign is one advertising placement order with its messages.
 type Campaign struct {
 	ID        uuid.UUID // uuid.Nil on create
@@ -49,16 +40,6 @@ type Campaign struct {
 	StartsAt  *time.Time // nil = open-ended start; always nil for the default
 	EndsAt    *time.Time // nil = open-ended end; always nil for the default
 	Messages  []Message
-	// OverrideAll paints the strip on every theme; OverrideDark, when set, further
-	// overrides the dark theme (the client resolves dark ← dark ?? all ?? token,
-	// light ← all ?? token). Both are nil for the default campaign and for a
-	// campaign that keeps the neutral theme tokens. Non-default only.
-	OverrideAll  *ColorSet
-	OverrideDark *ColorSet
-	// Urgent forces the banner on every viewer (bypassing eligibility) and, while
-	// any urgent campaign is active, suppresses every non-urgent campaign and the
-	// default remainder. Non-default only; always false for the default campaign.
-	Urgent    bool
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
@@ -89,32 +70,29 @@ type Timings struct {
 
 // ActiveCampaign is one campaign in the resolved rotation feed sent to a client:
 // its GCD-reduced show weight and its messages, already resolved to the viewer's
-// language and in display (round-robin) order, plus the optional colour overrides
-// the client applies to the strip (nil = the neutral theme tokens). Urgency is not
-// carried here: it is resolved server-side into the set's membership and the
-// eligibility bypass, so the client only ever renders what it is sent.
+// language and in display (round-robin) order.
 type ActiveCampaign struct {
-	Weight       int
-	Messages     []string
-	OverrideAll  *ColorSet
-	OverrideDark *ColorSet
+	Weight   int
+	Messages []string
+}
+
+// Eligible reports whether an account should be shown the advertising banner: a
+// free account (not paid) with an empty hint wallet and without the no_banner
+// role. The no_banner role suppresses the banner unconditionally; buying a paid
+// account or any hints also removes it.
+func Eligible(paidAccount bool, hintBalance int, hasNoBanner bool) bool {
+	return !paidAccount && hintBalance <= 0 && !hasNoBanner
 }
 
 // computeActiveSet builds the resolved rotation feed from the enabled campaigns
-// at time now, in language lang, and reports whether the feed is an urgent one.
-// Campaigns outside their validity window, and campaigns with no messages, are
-// dropped.
-//
-// While any active campaign is urgent, the feed is the urgent campaigns alone —
-// every non-urgent timed campaign and the default remainder are suppressed for
-// the duration (and the caller shows the feed to every viewer, bypassing
-// eligibility). Otherwise the default campaign's effective weight is the
-// remainder up to 100% — max(0, 100 - sum of active timed weights) — so it fills
-// unsold inventory and is dropped entirely when timed campaigns already reach
-// 100%. Weights are then reduced by their GCD so the fair rotation cycle stays
-// short. The input is expected to be the enabled campaigns (ActiveCampaigns);
-// disabled ones must already be excluded.
-func computeActiveSet(campaigns []Campaign, now time.Time, lang string) ([]ActiveCampaign, bool) {
+// at time now, in language lang. Campaigns outside their validity window, and
+// campaigns with no messages, are dropped. The default campaign's effective
+// weight is the remainder up to 100% — max(0, 100 - sum of active timed
+// weights) — so it fills unsold inventory and is dropped entirely when timed
+// campaigns already reach 100%. Weights are then reduced by their GCD so the
+// fair rotation cycle stays short. The input is expected to be the enabled
+// campaigns (ActiveCampaigns); disabled ones must already be excluded.
+func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []ActiveCampaign {
 	var timed []Campaign
 	var def *Campaign
 	for i := range campaigns {
@@ -130,54 +108,20 @@ func computeActiveSet(campaigns []Campaign, now time.Time, lang string) ([]Activ
 			timed = append(timed, c)
 		}
 	}
-	if urgent := filterUrgent(timed); len(urgent) > 0 {
-		out := make([]ActiveCampaign, 0, len(urgent))
-		for _, c := range urgent {
-			out = append(out, activeFrom(c, lang))
-		}
-		reduceByGCD(out)
-		return out, true
-	}
 	sumTimed := 0
 	for _, c := range timed {
 		sumTimed += c.Weight
 	}
 	out := make([]ActiveCampaign, 0, len(timed)+1)
 	for _, c := range timed {
-		out = append(out, activeFrom(c, lang))
+		out = append(out, ActiveCampaign{Weight: c.Weight, Messages: resolveBodies(c.Messages, lang)})
 	}
 	if def != nil {
 		if dw := 100 - sumTimed; dw > 0 {
-			a := activeFrom(*def, lang)
-			a.Weight = dw // the default's stored weight is nominal; it fills the remainder
-			out = append(out, a)
+			out = append(out, ActiveCampaign{Weight: dw, Messages: resolveBodies(def.Messages, lang)})
 		}
 	}
 	reduceByGCD(out)
-	return out, false
-}
-
-// activeFrom projects a campaign to its rotation-feed entry: its show weight, its
-// language-resolved messages and its colour overrides (carried through by
-// reference, they are read-only).
-func activeFrom(c Campaign, lang string) ActiveCampaign {
-	return ActiveCampaign{
-		Weight:       c.Weight,
-		Messages:     resolveBodies(c.Messages, lang),
-		OverrideAll:  c.OverrideAll,
-		OverrideDark: c.OverrideDark,
-	}
-}
-
-// filterUrgent returns the urgent campaigns among cs, preserving order. It is the
-// preempt selector: a non-empty result makes the whole feed urgent.
-func filterUrgent(cs []Campaign) []Campaign {
-	var out []Campaign
-	for _, c := range cs {
-		if c.Urgent {
-			out = append(out, c)
-		}
-	}
 	return out
 }
 

backend/internal/ads/ads_test.go

@@ -6,6 +6,30 @@ import (
 	"time"
 )
 
+func TestEligible(t *testing.T) {
+	tests := []struct {
+		name        string
+		paidAccount bool
+		hintBalance int
+		hasNoBanner bool
+		want        bool
+	}{
+		{name: "free, empty wallet, no role", want: true},
+		{name: "paid", paidAccount: true, want: false},
+		{name: "has hints", hintBalance: 3, want: false},
+		{name: "no_banner role", hasNoBanner: true, want: false},
+		{name: "paid and has hints", paidAccount: true, hintBalance: 5, want: false},
+		{name: "no_banner overrides everything", hasNoBanner: true, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := Eligible(tt.paidAccount, tt.hintBalance, tt.hasNoBanner); got != tt.want {
+				t.Errorf("Eligible(%v,%d,%v) = %v, want %v", tt.paidAccount, tt.hintBalance, tt.hasNoBanner, got, tt.want)
+			}
+		})
+	}
+}
+
 func TestComputeActiveSet(t *testing.T) {
 	now := time.Date(2026, 6, 15, 12, 0, 0, 0, time.UTC)
 	past := now.Add(-24 * time.Hour)
@@ -22,19 +46,12 @@ func TestComputeActiveSet(t *testing.T) {
 	timed := func(name string, weight int, starts, ends *time.Time, msgs []Message) Campaign {
 		return Campaign{Name: name, Weight: weight, Enabled: true, StartsAt: starts, EndsAt: ends, Messages: msgs}
 	}
-	urgent := func(name string, weight int, msgs []Message) Campaign {
-		c := timed(name, weight, nil, nil, msgs)
-		c.Urgent = true
-		return c
-	}
-	red := &ColorSet{Bg: "#aa0000", Fg: "#ffffff", Link: "#ffdd00"}
 
 	tests := []struct {
-		name       string
-		campaigns  []Campaign
-		lang       string
-		want       []ActiveCampaign
-		wantUrgent bool
+		name      string
+		campaigns []Campaign
+		lang      string
+		want      []ActiveCampaign
 	}{
 		{
 			name:      "default only reduces to weight 1",
@@ -135,71 +152,22 @@ func TestComputeActiveSet(t *testing.T) {
 			lang: "en",
 			want: []ActiveCampaign{{Weight: 1, Messages: []string{"one-en", "two-en"}}},
 		},
-		{
-			name: "urgent preempts default and normal timed",
-			campaigns: []Campaign{
-				def(msg("house")),
-				timed("promo", 40, nil, nil, msg("promo")),
-				urgent("alert", 50, msg("alert")),
-			},
-			lang: "en",
-			// only the urgent campaign survives; a lone weight reduces to 1.
-			want:       []ActiveCampaign{{Weight: 1, Messages: []string{"alert-en"}}},
-			wantUrgent: true,
-		},
-		{
-			name: "multiple urgent share the feed by gcd",
-			campaigns: []Campaign{
-				def(msg("house")),
-				urgent("a", 60, msg("a")),
-				urgent("b", 40, msg("b")),
-			},
-			lang: "en",
-			// default and any non-urgent dropped; gcd(60,40)=20 -> 3 and 2.
-			want: []ActiveCampaign{
-				{Weight: 3, Messages: []string{"a-en"}},
-				{Weight: 2, Messages: []string{"b-en"}},
-			},
-			wantUrgent: true,
-		},
-		{
-			name: "out-of-window urgent does not preempt",
-			campaigns: []Campaign{
-				def(msg("house")),
-				func() Campaign { c := urgent("future", 50, msg("future")); c.StartsAt = &future; return c }(),
-			},
-			lang: "en",
-			// the urgent campaign is not yet live, so the normal default feed stands.
-			want: []ActiveCampaign{{Weight: 1, Messages: []string{"house-en"}}},
-		},
-		{
-			name: "colour overrides ride the active campaign",
-			campaigns: []Campaign{
-				def(msg("house")),
-				func() Campaign { c := timed("promo", 100, nil, nil, msg("promo")); c.OverrideAll = red; return c }(),
-			},
-			lang: "en",
-			want: []ActiveCampaign{{Weight: 1, Messages: []string{"promo-en"}, OverrideAll: red}},
-		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, gotUrgent := computeActiveSet(tt.campaigns, now, tt.lang)
+			got := computeActiveSet(tt.campaigns, now, tt.lang)
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("computeActiveSet() =\n  %#v\nwant\n  %#v", got, tt.want)
 			}
-			if gotUrgent != tt.wantUrgent {
-				t.Errorf("computeActiveSet() urgent = %v, want %v", gotUrgent, tt.wantUrgent)
-			}
 		})
 	}
 }
 
 func TestComputeActiveSetEmpty(t *testing.T) {
 	// No campaigns at all yields an empty (non-nil-or-nil) feed without panicking.
-	if got, urgent := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 || urgent {
-		t.Errorf("computeActiveSet(nil) = %#v urgent=%v, want empty non-urgent", got, urgent)
+	if got := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 {
+		t.Errorf("computeActiveSet(nil) = %#v, want empty", got)
 	}
 }
 

backend/internal/ads/service.go

@@ -3,7 +3,6 @@ package ads
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
@@ -41,20 +40,17 @@ func NewService(store *Store) *Service { return &Service{store: store} }
 // ActiveSet returns the resolved rotation feed for a viewer in language lang
 // (en/ru) together with the global display timings: the currently-active
 // campaigns, each with its GCD-reduced show weight and its messages resolved to
-// lang, ready for the client's weighted round-robin. The bool result reports
-// whether the feed is urgent — an urgent feed is shown to every viewer
-// regardless of eligibility (the caller skips the eligibility gate for it).
-func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, bool, error) {
+// lang, ready for the client's weighted round-robin.
+func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, error) {
 	campaigns, err := s.store.ActiveCampaigns(ctx)
 	if err != nil {
-		return nil, Timings{}, false, err
+		return nil, Timings{}, err
 	}
 	timings, err := s.store.Settings(ctx)
 	if err != nil {
-		return nil, Timings{}, false, err
+		return nil, Timings{}, err
 	}
-	set, urgent := computeActiveSet(campaigns, time.Now().UTC(), lang)
-	return set, timings, urgent, nil
+	return computeActiveSet(campaigns, time.Now().UTC(), lang), timings, nil
 }
 
 // ListCampaigns returns every campaign with its messages, for the admin console.
@@ -80,13 +76,8 @@ func (s *Service) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, er
 	if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 		return uuid.Nil, err
 	}
-	all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
-	if err != nil {
-		return uuid.Nil, err
-	}
 	return s.store.CreateCampaign(ctx, Campaign{
 		Name: name, Weight: c.Weight, Enabled: c.Enabled, StartsAt: c.StartsAt, EndsAt: c.EndsAt,
-		OverrideAll: all, OverrideDark: dark, Urgent: c.Urgent,
 	})
 }
 
@@ -108,7 +99,6 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		upd.Enabled = true
 		upd.StartsAt = nil
 		upd.EndsAt = nil
-		// The default (house) campaign stays plain: no colour overrides, never urgent.
 	} else {
 		if err := validWeight(c.Weight); err != nil {
 			return err
@@ -116,17 +106,10 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 			return err
 		}
-		all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
-		if err != nil {
-			return err
-		}
 		upd.Weight = c.Weight
 		upd.Enabled = c.Enabled
 		upd.StartsAt = c.StartsAt
 		upd.EndsAt = c.EndsAt
-		upd.OverrideAll = all
-		upd.OverrideDark = dark
-		upd.Urgent = c.Urgent
 	}
 	return s.store.UpdateCampaign(ctx, upd)
 }
@@ -271,46 +254,6 @@ func validWindow(starts, ends *time.Time) error {
 	return nil
 }
 
-// hexColor matches a "#rrggbb" colour — the format the console's native colour
-// input emits and the wire carries.
-var hexColor = regexp.MustCompile(`^#[0-9a-fA-F]{6}$`)
-
-// validOverrides validates the two optional colour sets together and returns
-// their normalised copies (nil when a set is absent), so a caller can store them
-// directly.
-func validOverrides(all, dark *ColorSet) (*ColorSet, *ColorSet, error) {
-	va, err := validColorSet(all)
-	if err != nil {
-		return nil, nil, err
-	}
-	vd, err := validColorSet(dark)
-	if err != nil {
-		return nil, nil, err
-	}
-	return va, vd, nil
-}
-
-// validColorSet validates one optional colour override: a nil set passes (no
-// override); otherwise all three colours must be present and "#rrggbb". It
-// returns a trimmed, lower-cased copy.
-func validColorSet(cs *ColorSet) (*ColorSet, error) {
-	if cs == nil {
-		return nil, nil
-	}
-	bg := strings.TrimSpace(cs.Bg)
-	fg := strings.TrimSpace(cs.Fg)
-	link := strings.TrimSpace(cs.Link)
-	if bg == "" || fg == "" || link == "" {
-		return nil, fmt.Errorf("%w: a colour override needs all of background, text and link", ErrValidation)
-	}
-	for _, h := range []string{bg, fg, link} {
-		if !hexColor.MatchString(h) {
-			return nil, fmt.Errorf("%w: colours must be #rrggbb hex", ErrValidation)
-		}
-	}
-	return &ColorSet{Bg: strings.ToLower(bg), Fg: strings.ToLower(fg), Link: strings.ToLower(link)}, nil
-}
-
 // validBodies trims and bounds both mandatory language bodies of a message.
 func validBodies(bodyEn, bodyRu string) (string, string, error) {
 	en := strings.TrimSpace(bodyEn)

backend/internal/ads/store.go

@@ -90,23 +90,15 @@ func (s *Store) Campaign(ctx context.Context, id uuid.UUID) (Campaign, error) {
 func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, error) {
 	id := uuid.New()
 	now := time.Now().UTC()
-	abg, afg, alink := colorCols(c.OverrideAll)
-	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.INSERT(
 		table.AdCampaigns.CampaignID, table.AdCampaigns.Name, table.AdCampaigns.Weight,
 		table.AdCampaigns.IsDefault, table.AdCampaigns.Enabled,
 		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
-		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
-		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
-		table.AdCampaigns.Urgent,
 		table.AdCampaigns.CreatedAt, table.AdCampaigns.UpdatedAt,
 	).VALUES(
 		postgres.UUID(id), postgres.String(c.Name), postgres.Int(int64(c.Weight)),
 		postgres.Bool(false), postgres.Bool(c.Enabled),
 		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
-		abg, afg, alink,
-		dbg, dfg, dlink,
-		postgres.Bool(c.Urgent),
 		postgres.TimestampzT(now), postgres.TimestampzT(now),
 	)
 	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
@@ -119,20 +111,12 @@ func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, erro
 // window. The default flag is never touched here. Returns ErrNotFound when no
 // campaign matches.
 func (s *Store) UpdateCampaign(ctx context.Context, c Campaign) error {
-	abg, afg, alink := colorCols(c.OverrideAll)
-	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.UPDATE(
 		table.AdCampaigns.Name, table.AdCampaigns.Weight, table.AdCampaigns.Enabled,
-		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
-		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
-		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
-		table.AdCampaigns.Urgent, table.AdCampaigns.UpdatedAt,
+		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt, table.AdCampaigns.UpdatedAt,
 	).SET(
 		postgres.String(c.Name), postgres.Int(int64(c.Weight)), postgres.Bool(c.Enabled),
-		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
-		abg, afg, alink,
-		dbg, dfg, dlink,
-		postgres.Bool(c.Urgent), postgres.TimestampzT(time.Now().UTC()),
+		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt), postgres.TimestampzT(time.Now().UTC()),
 	).WHERE(table.AdCampaigns.CampaignID.EQ(postgres.UUID(c.ID)))
 	return execOne(ctx, s.db, stmt, "update campaign")
 }
@@ -273,40 +257,18 @@ func execOne(ctx context.Context, db qrm.Executable, stmt postgres.Statement, wh
 
 func modelToCampaign(r model.AdCampaigns) Campaign {
 	return Campaign{
-		ID:           r.CampaignID,
-		Name:         r.Name,
-		Weight:       int(r.Weight),
-		IsDefault:    r.IsDefault,
-		Enabled:      r.Enabled,
-		StartsAt:     r.StartsAt,
-		EndsAt:       r.EndsAt,
-		OverrideAll:  colorSetFrom(r.OverrideBg, r.OverrideFg, r.OverrideLink),
-		OverrideDark: colorSetFrom(r.OverrideBgDark, r.OverrideFgDark, r.OverrideLinkDark),
-		Urgent:       r.Urgent,
-		CreatedAt:    r.CreatedAt,
-		UpdatedAt:    r.UpdatedAt,
+		ID:        r.CampaignID,
+		Name:      r.Name,
+		Weight:    int(r.Weight),
+		IsDefault: r.IsDefault,
+		Enabled:   r.Enabled,
+		StartsAt:  r.StartsAt,
+		EndsAt:    r.EndsAt,
+		CreatedAt: r.CreatedAt,
+		UpdatedAt: r.UpdatedAt,
 	}
 }
 
-// colorSetFrom rebuilds an optional ColorSet from three nullable colour columns.
-// The all-or-nothing CHECK keeps the trio consistent, so a nil in any one means
-// the set is absent.
-func colorSetFrom(bg, fg, link *string) *ColorSet {
-	if bg == nil || fg == nil || link == nil {
-		return nil
-	}
-	return &ColorSet{Bg: *bg, Fg: *fg, Link: *link}
-}
-
-// colorCols renders a *ColorSet as its three column value-expressions in
-// bg, fg, link order — NULL for each when the set is absent.
-func colorCols(cs *ColorSet) (bg, fg, link postgres.Expression) {
-	if cs == nil {
-		return postgres.NULL, postgres.NULL, postgres.NULL
-	}
-	return postgres.String(cs.Bg), postgres.String(cs.Fg), postgres.String(cs.Link)
-}
-
 func modelToMessage(r model.AdMessages) Message {
 	return Message{
 		ID:         r.MessageID,

backend/internal/config/config.go

@@ -4,7 +4,6 @@ package config
 
 import (
 	"fmt"
-	"net/url"
 	"os"
 	"strconv"
 	"time"
@@ -14,7 +13,6 @@ import (
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/ratewatch"
-	"scrabble/backend/internal/robokassa"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/telemetry"
 )
@@ -44,12 +42,6 @@ type Config struct {
 	// SMTP configures the email relay used for confirm-codes. An empty Host
 	// selects the development log mailer (the code is logged, not sent).
 	SMTP account.SMTPConfig
-	// PublicBaseURL is the canonical public origin (scheme + host, e.g.
-	// https://erudit-game.ru) used to build absolute links in outgoing email — the
-	// confirm deeplink and the footer landing link. It is deliberately not derived
-	// from a request Host header, which would let an attacker inject a phishing link
-	// into the email. Required whenever an SMTP relay is configured.
-	PublicBaseURL string
 	// ConnectorAddr is the gRPC address of the Telegram platform connector
 	// side-service, used by the admin console to send operator broadcasts. Empty
 	// disables broadcasts (the admin broadcast actions report "not configured").
@@ -59,15 +51,6 @@ type Config struct {
 	// GuestRetention is the account age past which an unused guest (no game seat)
 	// is eligible for deletion by the reaper.
 	GuestRetention time.Duration
-	// ExportSignKey signs the finished-game export download URLs. Empty leaves
-	// the export-URL endpoints disabled (503 on mint, 404 on download).
-	ExportSignKey string
-	// RendererURL is the base URL of the internal image-render sidecar (e.g.
-	// http://renderer:8090). Empty disables the PNG export artifact.
-	RendererURL string
-	// Robokassa configures the direct-rail (RUB) payment provider — one merchant shop per channel
-	// (D42). An empty set leaves the direct order and Result-callback endpoints unregistered.
-	Robokassa robokassa.Shops
 }
 
 // Defaults applied when the corresponding environment variable is unset.
@@ -106,7 +89,6 @@ func Load() (Config, error) {
 	gm := game.DefaultConfig()
 	gm.DictDir = envOr("BACKEND_DICT_DIR", gm.DictDir)
 	gm.DictVersion = envOr("BACKEND_DICT_VERSION", gm.DictVersion)
-	gm.DictSeedDir = envOr("BACKEND_DICT_SEED_DIR", gm.DictSeedDir)
 	if gm.TimeoutSweepInterval, err = envDuration("BACKEND_GAME_TIMEOUT_SWEEP_INTERVAL", gm.TimeoutSweepInterval); err != nil {
 		return Config{}, err
 	}
@@ -148,29 +130,11 @@ func Load() (Config, error) {
 	}
 
 	smtp := account.SMTPConfig{
-		Host:      os.Getenv("BACKEND_SMTP_HOST"),
-		Port:      envOr("BACKEND_SMTP_PORT", "587"),
-		Username:  os.Getenv("BACKEND_SMTP_USERNAME"),
-		Password:  os.Getenv("BACKEND_SMTP_PASSWORD"),
-		From:      envOr("BACKEND_SMTP_FROM", "no-reply@localhost"),
-		TLS:       os.Getenv("BACKEND_SMTP_TLS"),
-		AdminFrom: os.Getenv("BACKEND_SMTP_ADMIN_FROM"),
-		AdminTo:   os.Getenv("BACKEND_ADMIN_EMAIL"),
-	}
-
-	// Robokassa direct rail: one merchant shop per channel (D42). The legacy single-shop vars seed
-	// the web channel so existing deploys keep working; the per-channel vars add the rest. A shop
-	// with no MerchantLogin is dropped (the rail stays dormant when none is configured).
-	shops := robokassa.Shops{}
-	web := robokassaShop("BACKEND_ROBOKASSA_WEB")
-	if web.MerchantLogin == "" {
-		web = robokassaShop("BACKEND_ROBOKASSA") // legacy single-shop credentials seed the web channel
-	}
-	if web.MerchantLogin != "" {
-		shops[robokassa.ChannelWeb] = web
-	}
-	if android := robokassaShop("BACKEND_ROBOKASSA_ANDROID"); android.MerchantLogin != "" {
-		shops[robokassa.ChannelAndroid] = android
+		Host:     os.Getenv("BACKEND_SMTP_HOST"),
+		Port:     envOr("BACKEND_SMTP_PORT", "587"),
+		Username: os.Getenv("BACKEND_SMTP_USERNAME"),
+		Password: os.Getenv("BACKEND_SMTP_PASSWORD"),
+		From:     envOr("BACKEND_SMTP_FROM", "no-reply@localhost"),
 	}
 
 	c := Config{
@@ -184,13 +148,9 @@ func Load() (Config, error) {
 		Robot:             rb,
 		RateWatch:         rw,
 		SMTP:              smtp,
-		PublicBaseURL:     os.Getenv("BACKEND_PUBLIC_BASE_URL"),
 		ConnectorAddr:     os.Getenv("BACKEND_CONNECTOR_ADDR"),
 		GuestReapInterval: guestReapInterval,
 		GuestRetention:    guestRetention,
-		ExportSignKey:     os.Getenv("BACKEND_EXPORT_SIGN_KEY"),
-		RendererURL:       os.Getenv("BACKEND_RENDERER_URL"),
-		Robokassa:         shops,
 	}
 	if err := c.validate(); err != nil {
 		return Config{}, err
@@ -235,19 +195,6 @@ func (c Config) validate() error {
 	if c.GuestRetention <= 0 {
 		return fmt.Errorf("config: BACKEND_GUEST_RETENTION must be positive")
 	}
-	if c.SMTP.Host != "" {
-		if c.PublicBaseURL == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL must be set when BACKEND_SMTP_HOST is configured")
-		}
-		if u, err := url.Parse(c.PublicBaseURL); err != nil || u.Scheme == "" || u.Host == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL %q must be an absolute URL (scheme://host)", c.PublicBaseURL)
-		}
-	}
-	for channel, shop := range c.Robokassa {
-		if shop.Password1 == "" || shop.Password2 == "" {
-			return fmt.Errorf("config: robokassa shop %q: password1 and password2 must be set when its merchant login is", channel)
-		}
-	}
 	return nil
 }
 
@@ -287,15 +234,3 @@ func envDuration(key string, fallback time.Duration) (time.Duration, error) {
 	}
 	return d, nil
 }
-
-// robokassaShop reads a Robokassa shop's four credentials from the environment under prefix (e.g.
-// "BACKEND_ROBOKASSA_WEB" → _MERCHANT_LOGIN / _PASSWORD1 / _PASSWORD2 / _TEST). A missing
-// MerchantLogin yields a zero Config the caller drops.
-func robokassaShop(prefix string) robokassa.Config {
-	return robokassa.Config{
-		MerchantLogin: os.Getenv(prefix + "_MERCHANT_LOGIN"),
-		Password1:     os.Getenv(prefix + "_PASSWORD1"),
-		Password2:     os.Getenv(prefix + "_PASSWORD2"),
-		IsTest:        os.Getenv(prefix+"_TEST") == "1",
-	}
-}

backend/internal/engine/decode.go

@@ -21,7 +21,7 @@ const (
 	// ActionResign abandons the game.
 	ActionResign
 	// ActionTimeout is the auto-resignation a missed turn becomes; recorded by
-	// the game domain, never produced by the engine itself.
+	// the game domain in a later stage, never produced by the engine itself.
 	ActionTimeout
 )
 

backend/internal/engine/deliver.go

@@ -1,92 +0,0 @@
-package engine
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-)
-
-// DeliverVersion makes the build's dictionary version resident on the persistent
-// dictionary volume without disturbing the versions in-flight games already pin.
-//
-// The volume is seeded from the image once and never re-seeded, and the image's
-// /opt/dawg is shadowed by that volume mount, so a redeploy that bumped
-// BACKEND_DICT_VERSION cannot otherwise make the new DAWGs reachable at runtime.
-// The image therefore keeps an unshadowed read-only copy at seedDir, and this
-// copies it into dictDir/<version>/ when the version is not already present —
-// neither the flat seed's own recorded label nor an existing version
-// subdirectory. It is add-only and idempotent: the flat seed and any prior admin
-// uploads are never touched, so old games keep the version they pin while the new
-// one becomes resident and activatable (see game.Service.InitActiveVersion). A
-// blank seedDir disables delivery (the pre-existing seed-only behaviour).
-func DeliverVersion(dictDir, seedDir, version string) error {
-	if seedDir == "" || version == "" {
-		return nil
-	}
-	target := filepath.Join(dictDir, version)
-	if _, err := os.Stat(target); err == nil {
-		return nil // already delivered on a prior boot
-	} else if !errors.Is(err, os.ErrNotExist) {
-		return fmt.Errorf("engine: stat delivered dictionary %s: %w", target, err)
-	}
-	// A fresh volume is populated from the image and recorded as this version by the
-	// marker: it is the flat dir, so there is nothing to deliver. resolveSeedVersion
-	// records the label on first use, matching OpenWithVersions.
-	seed, err := resolveSeedVersion(dictDir, version)
-	if err != nil {
-		return err
-	}
-	if seed == version {
-		return nil
-	}
-	// Stage into a dot-prefixed directory (skipped by OpenWithVersions' version scan)
-	// then rename, so a crash mid-copy never leaves a half-populated version subdir.
-	staging := filepath.Join(dictDir, ".staging-deliver-"+version)
-	if err := os.RemoveAll(staging); err != nil {
-		return fmt.Errorf("engine: clear deliver staging %s: %w", staging, err)
-	}
-	if err := os.MkdirAll(staging, 0o755); err != nil {
-		return fmt.Errorf("engine: create deliver staging %s: %w", staging, err)
-	}
-	for _, file := range dictFiles {
-		src := filepath.Join(seedDir, file)
-		if _, err := os.Stat(src); errors.Is(err, os.ErrNotExist) {
-			continue // a variant absent from the seed is simply absent under this version
-		} else if err != nil {
-			_ = os.RemoveAll(staging)
-			return fmt.Errorf("engine: stat seed dawg %s: %w", src, err)
-		}
-		if err := copyFile(src, filepath.Join(staging, file)); err != nil {
-			_ = os.RemoveAll(staging)
-			return err
-		}
-	}
-	if err := os.Rename(staging, target); err != nil {
-		_ = os.RemoveAll(staging)
-		return fmt.Errorf("engine: publish delivered dictionary %s: %w", target, err)
-	}
-	return nil
-}
-
-// copyFile copies a single file, truncating the destination.
-func copyFile(src, dst string) error {
-	in, err := os.Open(src)
-	if err != nil {
-		return fmt.Errorf("engine: open %s: %w", src, err)
-	}
-	defer func() { _ = in.Close() }()
-	out, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o644)
-	if err != nil {
-		return fmt.Errorf("engine: create %s: %w", dst, err)
-	}
-	if _, err := io.Copy(out, in); err != nil {
-		_ = out.Close()
-		return fmt.Errorf("engine: copy %s -> %s: %w", src, dst, err)
-	}
-	if err := out.Close(); err != nil {
-		return fmt.Errorf("engine: finalise %s: %w", dst, err)
-	}
-	return nil
-}

backend/internal/engine/deliver_test.go

@@ -1,68 +0,0 @@
-package engine
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestDeliverVersion(t *testing.T) {
-	// A blank seed directory disables delivery (the pre-existing seed-only behaviour).
-	if err := DeliverVersion(t.TempDir(), "", "v1.3.1"); err != nil {
-		t.Fatalf("blank seedDir: %v", err)
-	}
-
-	// An existing volume flat-seeded as v1.3.0 gets v1.3.1 delivered as a subdirectory,
-	// add-only: the flat seed's marker is left intact and the new version's DAWGs land.
-	dict := t.TempDir()
-	seed := t.TempDir()
-	if err := os.WriteFile(filepath.Join(dict, seedMarkerFile), []byte("v1.3.0\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range dictFiles {
-		if err := os.WriteFile(filepath.Join(seed, f), []byte("dawg:"+f), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := DeliverVersion(dict, seed, "v1.3.1"); err != nil {
-		t.Fatalf("deliver v1.3.1: %v", err)
-	}
-	for _, f := range dictFiles {
-		got, err := os.ReadFile(filepath.Join(dict, "v1.3.1", f))
-		if err != nil {
-			t.Fatalf("delivered %s: %v", f, err)
-		}
-		if string(got) != "dawg:"+f {
-			t.Errorf("delivered %s = %q, want the seed bytes", f, got)
-		}
-	}
-	if m, _ := os.ReadFile(filepath.Join(dict, seedMarkerFile)); string(m) != "v1.3.0\n" {
-		t.Errorf("flat seed marker relabelled to %q (delivery must be add-only)", m)
-	}
-	// Idempotent: a second call is a no-op and leaves no staging directory behind.
-	if err := DeliverVersion(dict, seed, "v1.3.1"); err != nil {
-		t.Fatalf("re-deliver v1.3.1: %v", err)
-	}
-	if entries, _ := os.ReadDir(dict); hasStaging(entries) {
-		t.Errorf("a staging directory survived delivery")
-	}
-
-	// On a fresh directory the build version becomes the flat seed, so nothing is delivered
-	// as a redundant subdirectory.
-	fresh := t.TempDir()
-	if err := DeliverVersion(fresh, seed, "v1.3.1"); err != nil {
-		t.Fatalf("fresh deliver: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(fresh, "v1.3.1")); !os.IsNotExist(err) {
-		t.Errorf("fresh volume got a redundant v1.3.1 subdir; it should be the flat seed")
-	}
-}
-
-func hasStaging(entries []os.DirEntry) bool {
-	for _, e := range entries {
-		if len(e.Name()) >= len(".staging") && e.Name()[:len(".staging")] == ".staging" {
-			return true
-		}
-	}
-	return false
-}

backend/internal/engine/endfixture_test.go

@@ -1,123 +0,0 @@
-package engine
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
-)
-
-// The offline engine (ui/src/lib/localgame) reproduces the end-of-game rack settlement and the
-// winner rule so a local game finishes with the same scores as the server. These golden fixtures
-// pin the ported pure functions (applyEndAdjustment / winner / rackValue) to the real Go engine.
-// Being in-package, this emitter constructs Game values directly and drives the unexported
-// end-game math on chosen positions.
-
-type endCaseIn struct {
-	Name     string  `json:"name"`
-	Variant  string  `json:"variant"`
-	Reason   string  `json:"reason"`
-	Hands    [][]int `json:"hands"`
-	Scores   []int   `json:"scores"`
-	Resigned []bool  `json:"resigned"`
-	ToMove   int     `json:"toMove"`
-}
-
-type endCaseOut struct {
-	endCaseIn
-	ScoresAfter []int `json:"scoresAfter"`
-	Winner      int   `json:"winner"`
-}
-
-func rulesetFor(variant string) *rules.Ruleset {
-	switch variant {
-	case "scrabble_ru":
-		return rules.RussianScrabble()
-	case "erudit_ru":
-		return rules.Erudit()
-	default:
-		return rules.English()
-	}
-}
-
-func reasonFor(s string) EndReason {
-	switch s {
-	case "out_of_tiles":
-		return EndOutOfTiles
-	case "scoreless":
-		return EndScoreless
-	case "resign":
-		return EndResign
-	case "aborted":
-		return EndAborted
-	}
-	return EndNotOver
-}
-
-func handsBytes(hands [][]int) [][]byte {
-	out := make([][]byte, len(hands))
-	for i, h := range hands {
-		b := make([]byte, len(h))
-		for j, x := range h {
-			b[j] = byte(x)
-		}
-		out[i] = b
-	}
-	return out
-}
-
-// TestEmitEndgameFixtures regenerates ui/src/lib/localgame/testdata/endgame.json. Gated by
-// EMIT_ENGINE_FIXTURES. Regenerate with:
-//
-//	EMIT_ENGINE_FIXTURES=1 go test ./backend/internal/engine -run TestEmitEndgameFixtures
-func TestEmitEndgameFixtures(t *testing.T) {
-	if os.Getenv("EMIT_ENGINE_FIXTURES") == "" {
-		t.Skip("set EMIT_ENGINE_FIXTURES=1 to regenerate ui/src/lib/localgame/testdata/endgame.json")
-	}
-
-	cases := []endCaseIn{
-		{"out-basic", "scrabble_en", "out_of_tiles", [][]int{{}, {0, 1, 2}}, []int{50, 40}, []bool{false, false}, 0},
-		{"out-blank", "scrabble_en", "out_of_tiles", [][]int{{}, {255, 0}}, []int{30, 30}, []bool{false, false}, 0},
-		{"out-erudit-yo", "erudit_ru", "out_of_tiles", [][]int{{}, {6, 32}}, []int{10, 10}, []bool{false, false}, 0},
-		{"out-tie", "scrabble_en", "out_of_tiles", [][]int{{}, {}}, []int{30, 30}, []bool{false, false}, 0},
-		{"out-3p", "scrabble_ru", "out_of_tiles", [][]int{{}, {0, 1}, {2}}, []int{10, 10, 10}, []bool{false, false, false}, 0},
-		{"scoreless", "scrabble_en", "scoreless", [][]int{{0, 1}, {2, 3}}, []int{20, 20}, []bool{false, false}, 0},
-		{"resign-2p", "scrabble_en", "resign", [][]int{{}, {0}}, []int{100, 10}, []bool{true, false}, 1},
-		{"resign-3p", "scrabble_en", "resign", [][]int{{}, {}, {}}, []int{50, 60, 40}, []bool{false, true, false}, 0},
-		{"aborted", "scrabble_en", "aborted", [][]int{{0}, {1}}, []int{40, 30}, []bool{false, false}, 0},
-	}
-
-	out := make([]endCaseOut, 0, len(cases))
-	for _, c := range cases {
-		rs := rulesetFor(c.Variant)
-		scores := append([]int(nil), c.Scores...)
-		g := &Game{
-			rules:    rs,
-			hands:    handsBytes(c.Hands),
-			scores:   scores,
-			resigned: c.Resigned,
-			toMove:   c.ToMove,
-		}
-		reason := reasonFor(c.Reason)
-		g.over = true
-		g.reason = reason
-		g.applyEndAdjustment(reason)
-		out = append(out, endCaseOut{endCaseIn: c, ScoresAfter: g.scores, Winner: g.winner()})
-	}
-
-	dir := filepath.Join("..", "..", "..", "ui", "src", "lib", "localgame", "testdata")
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatalf("mkdir %s: %v", dir, err)
-	}
-	data, err := json.MarshalIndent(map[string]any{"cases": out}, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal: %v", err)
-	}
-	path := filepath.Join(dir, "endgame.json")
-	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
-		t.Fatalf("write %s: %v", path, err)
-	}
-	t.Logf("wrote %s (%d cases)", path, len(out))
-}