Merge pull request 'Release v1.11.0: PWA install + code-only PWA login + email/metrics fixes' (#187) from development into master

The edge request-latency histogram records seconds but used the OTel SDK's
default millisecond-calibrated bucket boundaries (first boundary 5), so every
sub-5s request fell into one bucket and histogram_quantile(0.99) interpolated
to ~4.95s for every message type — regardless of the real (millisecond)
latency. That tripped the >1s "Gateway request latency p99 high" alert on
essentially every request, flapping fire/resolve on each app open (seen on the
test and prod contours).

Set explicit second-scale bucket boundaries (0.005 … 10s) straddling the 1s SLO
so the p99 reflects real latency and the alert fires only on genuine slowness.
Regression test asserts the histogram carries a sub-second boundary.

.gitea/workflows/ci.yaml

@@ -26,12 +26,12 @@ on:
   push:
     branches: [development]
 
-# The dictionary release the test suite validates against — the current
-# scrabble-dictionary release. Centralised here so a release bump is one edit; the
-# unit/integration jobs inherit it. The deploy job overrides it per contour with
-# vars.TEST_DICT_VERSION (the seed for a fresh volume), see deploy/README.md.
+# The dictionary release. One Gitea variable is the single source of truth: the
+# test suite validates against it here (inherited by the unit/integration jobs) and
+# both contours' deploy jobs seed a fresh volume with the same value. A release bump
+# is one edit (the variable). See deploy/README.md.
 env:
-  DICT_VERSION: v1.3.1
+  DICT_VERSION: ${{ vars.DICT_VERSION }}
 
 jobs:
   # changes detects which areas a PR/push touched, so the test jobs can skip when
@@ -329,16 +329,25 @@ jobs:
           TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_PROMO_BOT_TOKEN }}
           # VK Mini App protected key (offline HMAC for the launch-param signature); empty
           # leaves the VK auth path (auth.vk) disabled until the operator sets the secret.
-          GATEWAY_VK_APP_SECRET: ${{ secrets.TEST_GATEWAY_VK_APP_SECRET }}
+          # One VK Mini App serves every contour -> unprefixed secret.
+          GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
+          # VK ID web login (browser VK-identity linking): the VK ID "Web" app's protected key
+          # for the server-side confidential code exchange — a SEPARATE VK app from the Mini
+          # App above. One VK ID "Web" app serves every contour -> unprefixed secret.
+          GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
+          # Planted honeytoken bearer: presenting it flags the caller (logs + a ban metric on
+          # test where the IP ban is off; a 24h IP ban on prod). Per-contour secret; empty = trap off.
+          GATEWAY_HONEYTOKEN: ${{ secrets.TEST_GATEWAY_HONEYTOKEN }}
           # Signs the finished-game export download URLs (backend + compose interpolation).
           EXPORT_SIGN_KEY: ${{ secrets.TEST_EXPORT_SIGN_KEY }}
-          # Transactional email via the shared Selectel relay. Empty host leaves the
-          # backend on the log mailer (email disabled) but the contour still boots.
-          SMTP_RELAY_USER: ${{ secrets.TEST_SMTP_RELAY_USER }}
-          SMTP_RELAY_PASS: ${{ secrets.TEST_SMTP_RELAY_PASS }}
-          SMTP_RELAY_HOST: ${{ vars.TEST_SMTP_RELAY_HOST }}
-          SMTP_RELAY_PORT: ${{ vars.TEST_SMTP_RELAY_PORT }}
-          SMTP_RELAY_TLS: ${{ vars.TEST_SMTP_RELAY_TLS }}
+          # Transactional email via the shared Selectel relay: one account for every
+          # contour -> unprefixed host/port/tls/user/pass. Empty host leaves the backend
+          # on the log mailer (email disabled) but the contour still boots.
+          SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
+          SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
+          SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
+          SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
+          SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
           SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
           # Operator alerts: backend admin emails (new feedback / complaints) + Grafana
           # infra alerts. Distinct senders + recipients; Grafana uses the relay's STARTTLS
@@ -347,15 +356,15 @@ jobs:
           ADMIN_EMAIL: ${{ vars.TEST_ADMIN_EMAIL }}
           SMTP_RELAY_SERVICE_FROM: ${{ vars.TEST_SMTP_RELAY_SERVICE_FROM }}
           SERVICE_EMAIL: ${{ vars.TEST_SERVICE_EMAIL }}
-          GRAFANA_SMTP_HOST: ${{ vars.TEST_GRAFANA_SMTP_HOST }}
+          GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
           GF_SMTP_ENABLED: ${{ vars.TEST_GF_SMTP_ENABLED }}
           # Canonical public origin for links in the email (this contour's URL);
           # required by the backend whenever SMTP_RELAY_HOST is set.
           PUBLIC_BASE_URL: ${{ vars.TEST_PUBLIC_BASE_URL }}
           GM_BASICAUTH_USER: ${{ vars.TEST_GM_BASICAUTH_USER }}
-          GRAFANA_ROOT_URL: ${{ vars.TEST_GRAFANA_ROOT_URL }}
           CADDY_SITE_ADDRESS: ${{ vars.TEST_CADDY_SITE_ADDRESS }}
-          TELEGRAM_MINIAPP_URL: ${{ vars.TEST_TELEGRAM_MINIAPP_URL }}
+          # TELEGRAM_MINIAPP_URL, GRAFANA_ROOT_URL and VITE_VK_ID_REDIRECT_URL are derived
+          # from PUBLIC_BASE_URL in the run step below, not stored as their own variables.
           TELEGRAM_GAME_CHANNEL_ID: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID }}
           TELEGRAM_CHAT_ID: ${{ vars.TEST_TELEGRAM_CHAT_ID }}
           TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.TEST_TELEGRAM_SUPPORT_CHAT_ID }}
@@ -368,12 +377,16 @@ jobs:
           VITE_TELEGRAM_BOT_ID: ${{ vars.TEST_VITE_TELEGRAM_BOT_ID }}
           VITE_TELEGRAM_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
           VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-          VITE_VK_APP_LINK: ${{ vars.TEST_VITE_VK_APP_LINK }}
-          VITE_GATEWAY_URL: ${{ vars.TEST_VITE_GATEWAY_URL }}
-          # Unset vars render empty -> the compose ":-" defaults apply.
+          # VK Mini App landing link + VK ID "Web" app id: one value each serves every
+          # contour -> unprefixed. VITE_VK_APP_ID also feeds the gateway (GATEWAY_VK_ID_APP_ID);
+          # the VK ID redirect URL is derived from PUBLIC_BASE_URL in the run step below.
+          VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
+          VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
+          # VITE_GATEWAY_URL omitted: the SPA is served same-origin, so it stays the
+          # compose ":-" empty default. Other unset vars likewise fall to their defaults.
           POSTGRES_DB: ${{ vars.TEST_POSTGRES_DB }}
           POSTGRES_USER: ${{ vars.TEST_POSTGRES_USER }}
-          DICT_VERSION: ${{ vars.TEST_DICT_VERSION }}
+          DICT_VERSION: ${{ vars.DICT_VERSION }}
           LOG_LEVEL: ${{ vars.TEST_LOG_LEVEL }}
         run: |
           # Seed the config files to a stable host path. The runner checks out into
@@ -384,8 +397,34 @@ jobs:
           conf="$HOME/.scrabble-deploy"
           rm -rf "$conf"
           mkdir -p "$conf"
-          cp -r caddy otelcol prometheus tempo grafana "$conf"/
+          cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
           export SCRABBLE_CONFIG_DIR="$conf"
+          # Maintenance page for the redeploy window, mirroring prod-deploy.sh so the SPA
+          # overlay is exercised on the test contour too (not only prod). Raised just before
+          # the recreate and lowered once caddy is back (below); the trap clears it if the
+          # step fails so the contour never sticks in maintenance (and the reseed above wipes a
+          # stale flag anyway). The caddy-routed probes run in the NEXT step, after it is lowered.
+          maint_flag="$conf/caddy/on"
+          trap 'rm -f "$maint_flag"' EXIT
+          # Derive the public URLs from the one canonical origin instead of storing each as
+          # its own variable (paths are structural SPA routes / the Caddy /_gm sub-path).
+          # Exported before build so the VK ID redirect is baked into the SPA.
+          base="${PUBLIC_BASE_URL%/}"
+          export TELEGRAM_MINIAPP_URL="$base/telegram/"
+          export GRAFANA_ROOT_URL="$base/_gm/grafana/"
+          export VITE_VK_ID_REDIRECT_URL="$base/app/"
+          # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
+          # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
+          # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare
+          # address + name for Grafana; the backend keeps the full form.
+          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+          case "$svc_from" in
+            *"<"*">"*)
+              export GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+              export GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+            *)
+              export GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+          esac
           # Bot-link mTLS material for the test contour: a private CA + gateway/bot
           # leaves (CN=gateway, the service name the bot dials). Prod supplies these
           # from PROD_ secrets instead. Regenerated each deploy; both ends redeploy
@@ -398,12 +437,23 @@ jobs:
           # bot on its own host instead (deploy/docker-compose.bot.yml), and the prod
           # main host omits both. Without the profile they would not start here.
           docker compose --ansi never --profile telegram-local build --progress plain
+          # Raise the maintenance page, THEN bring caddy onto the reseeded config mount so it
+          # actually carries the flag: the running caddy sits on the stale pre-reseed mount (the
+          # dir was rm'd + recreated — see the force-recreate note below), so a flag written to
+          # the new dir is invisible until caddy is recreated. With the fresh caddy up, an open
+          # SPA sees the 503 marker + overlay for the whole recreate window, not a bare reconnect.
+          : > "$maint_flag"
+          docker compose --ansi never up -d --force-recreate --no-deps caddy
           docker compose --ansi never --profile telegram-local up -d --remove-orphans
           # The config-only services bind-mount the reseeded config dir. A plain `up -d`
           # leaves them on the previous bind mount (the dir was rm'd + recreated), so a
-          # changed Caddyfile or Grafana dashboard is ignored — force-recreate them to
-          # pick up the fresh config.
-          docker compose --ansi never up -d --force-recreate --no-deps caddy otelcol prometheus tempo grafana
+          # changed Grafana dashboard is ignored — force-recreate them to pick up the fresh
+          # config. (Caddy was already recreated above so it would carry the maintenance flag.)
+          docker compose --ansi never up -d --force-recreate --no-deps otelcol prometheus tempo grafana
+          # Lower the maintenance page: services are back. An open SPA's poll now gets through
+          # (once the gateway finishes booting) and reloads into the fresh client; the caddy
+          # probes in the next step see 200. The EXIT trap is a backstop if we failed earlier.
+          rm -f "$maint_flag"
 
       - name: Probe the landing, gateway and backend
         run: |

.gitea/workflows/prod-deploy.yaml

@@ -40,12 +40,22 @@ jobs:
       VITE_TELEGRAM_BOT_ID: ${{ vars.PROD_VITE_TELEGRAM_BOT_ID }}
       VITE_TELEGRAM_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
       VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.PROD_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-      VITE_VK_APP_LINK: ${{ vars.PROD_VITE_VK_APP_LINK }}
-      VITE_GATEWAY_URL: ${{ vars.PROD_VITE_GATEWAY_URL }}
+      # VK Mini App link + VK ID "Web" app id: one value each serves every contour.
+      VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
+      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
+      # VITE_GATEWAY_URL omitted: the SPA is served same-origin (compose ":-" default).
       POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
-      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
-      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
+      # `docker compose build` interpolates the WHOLE compose file, so every :?-guarded
+      # runtime var must be present at build even though it is not a build-arg — incl. the
+      # backend's EXPORT_SIGN_KEY (added with the finished-game export after v1.7.0, which is
+      # why the first v1.8.0 build tripped on it). POSTGRES_PASSWORD/GM_BASICAUTH_HASH above
+      # are here for the same reason; DICT_VERSION + the derived Mini App URL cover the rest.
+      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
+      # PUBLIC_BASE_URL drives the derived VK ID redirect (baked into the SPA) and the
+      # Mini App URL; both are computed in the build step, not stored variables.
+      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+      DICT_VERSION: ${{ vars.DICT_VERSION }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -59,6 +69,11 @@ jobs:
         working-directory: deploy
         run: |
           export TAG="${{ steps.ver.outputs.tag }}" APP_VERSION="${{ steps.ver.outputs.tag }}" SCRABBLE_CONFIG_DIR=.
+          # Derive the public URLs from the one canonical origin: the VK ID redirect is a
+          # build-arg baked into the SPA, and the Mini App URL satisfies the (profiled-out)
+          # bot service's compose ":?" guard during parse. See deploy/write-prod-env.sh.
+          base="${PUBLIC_BASE_URL%/}"
+          export VITE_VK_ID_REDIRECT_URL="$base/app/" TELEGRAM_MINIAPP_URL="$base/telegram/"
           # The main-stack images via compose (reuses the build args, incl. VERSION);
           # the bot separately, since it is profiled out of the prod compose.
           docker compose -f docker-compose.yml -f docker-compose.prod.yml build
@@ -83,15 +98,24 @@ jobs:
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
       GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
       TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      GATEWAY_VK_APP_SECRET: ${{ secrets.PROD_GATEWAY_VK_APP_SECRET }}
+      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
+      # VK ID web login: the "Web" app id (the gateway reuses it as GATEWAY_VK_ID_APP_ID at
+      # runtime) + the app's protected key. Both shared across contours. The redirect URL is
+      # derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
+      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
+      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
+      # Planted honeytoken bearer: presenting it earns a 24h IP ban + a high-severity alarm.
+      # Per-contour secret; empty = trap off. Rendered by deploy/write-prod-env.sh.
+      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
       # Signs the finished-game export download URLs (backend BACKEND_EXPORT_SIGN_KEY).
       EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # Transactional email via the shared Selectel relay (confirm-codes).
-      SMTP_RELAY_USER: ${{ secrets.PROD_SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.PROD_SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.PROD_SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.PROD_SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.PROD_SMTP_RELAY_TLS }}
+      # Transactional email via the shared Selectel relay (confirm-codes): one account for
+      # every contour -> unprefixed host/port/tls/user/pass.
+      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
+      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
+      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
+      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
+      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
       SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
       # Operator alerts: backend admin emails + Grafana infra alerts (distinct senders +
       # recipients; Grafana uses the relay's STARTTLS host:port).
@@ -99,20 +123,20 @@ jobs:
       ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
       SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
       SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_HOST: ${{ vars.PROD_GRAFANA_SMTP_HOST }}
+      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
       GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
       PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
       PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
       PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
       PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
       GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
-      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
       CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
+      DICT_VERSION: ${{ vars.DICT_VERSION }}
       POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
       POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
+      # TELEGRAM_MINIAPP_URL and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in
+      # deploy/write-prod-env.sh, not stored variables.
     steps:
       - uses: actions/checkout@v4
         with:
@@ -140,39 +164,8 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
-          cat > stage/env.sh <<EOF
-          export REGISTRY='$REGISTRY'
-          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
-          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
-          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
-          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
-          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
-          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
-          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
-          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
-          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
-          export LOG_LEVEL='${LOG_LEVEL:-info}'
-          export DICT_VERSION='$DICT_VERSION'
-          export APP_VERSION='$TAG'
-          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
-          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
-          export GATEWAY_VK_APP_SECRET='$GATEWAY_VK_APP_SECRET'
-          export EXPORT_SIGN_KEY='$EXPORT_SIGN_KEY'
-          export SMTP_RELAY_HOST='$SMTP_RELAY_HOST'
-          export SMTP_RELAY_PORT='$SMTP_RELAY_PORT'
-          export SMTP_RELAY_TLS='$SMTP_RELAY_TLS'
-          export SMTP_RELAY_USER='$SMTP_RELAY_USER'
-          export SMTP_RELAY_PASS='$SMTP_RELAY_PASS'
-          export SMTP_RELAY_FROM='$SMTP_RELAY_FROM'
-          export SMTP_RELAY_ADMIN_FROM='$SMTP_RELAY_ADMIN_FROM'
-          export ADMIN_EMAIL='$ADMIN_EMAIL'
-          export SMTP_RELAY_SERVICE_FROM='$SMTP_RELAY_SERVICE_FROM'
-          export SERVICE_EMAIL='$SERVICE_EMAIL'
-          export GRAFANA_SMTP_HOST='$GRAFANA_SMTP_HOST'
-          export GF_SMTP_ENABLED='$GF_SMTP_ENABLED'
-          export PUBLIC_BASE_URL='$PUBLIC_BASE_URL'
-          export GATEWAY_ABUSE_BAN_ENABLED='true'
-          EOF
+          # Shared with prod-rollback so the two paths render an identical runtime env.
+          APP_VERSION="$TAG" bash deploy/write-prod-env.sh stage/env.sh
           printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
@@ -183,7 +176,7 @@ jobs:
           ssh_main 'mkdir -p /opt/scrabble/compose'
           tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
             | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
+          tar -C deploy -czf - caddy otelcol prometheus tempo grafana blackbox \
             | ssh_main 'tar -C /opt/scrabble -xzf -'
           tar -C stage -czf - certs-main \
             | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
@@ -211,7 +204,8 @@ jobs:
       PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
       PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
+      # PUBLIC_BASE_URL drives the derived Mini App URL in deploy/write-prod-bot-env.sh.
+      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
       TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
       TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
       TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
@@ -228,20 +222,8 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-bot
-          cat > stage/env.bot.sh <<EOF
-          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
-          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TAG'
-          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
-          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
-          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
-          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
-          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
-          export TELEGRAM_SUPPORT_CHAT_ID='$TELEGRAM_SUPPORT_CHAT_ID'
-          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
-          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
-          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
-          export LOG_LEVEL='${LOG_LEVEL:-info}'
-          EOF
+          # Shared with prod-rollback so the two paths render an identical bot env.
+          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TAG" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
           printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key

.gitea/workflows/prod-rollback.yaml

@@ -51,13 +51,32 @@ jobs:
       PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
       PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
       GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
-      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
       CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
+      DICT_VERSION: ${{ vars.DICT_VERSION }}
       POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
       POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
+      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+      # Full runtime env — parity with prod-deploy's deploy-main so a rollback re-renders
+      # the SAME env.sh (email / VK login / Grafana alerts survive a rollback). TELEGRAM_MINIAPP_URL
+      # and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
+      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
+      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
+      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
+      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
+      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
+      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
+      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
+      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
+      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
+      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
+      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
+      SMTP_RELAY_ADMIN_FROM: ${{ vars.PROD_SMTP_RELAY_ADMIN_FROM }}
+      ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
+      SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
+      SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
+      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
+      GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
       INPUT_TARGET: ${{ inputs.target_version }}
     steps:
       - uses: actions/checkout@v4
@@ -89,24 +108,9 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
-          cat > stage/env.sh <<EOF
-          export REGISTRY='$REGISTRY'
-          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
-          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
-          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
-          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
-          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
-          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
-          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
-          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
-          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
-          export LOG_LEVEL='${LOG_LEVEL:-info}'
-          export DICT_VERSION='$DICT_VERSION'
-          export APP_VERSION='$TARGET'
-          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
-          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
-          export GATEWAY_ABUSE_BAN_ENABLED='true'
-          EOF
+          # Same writer as prod-deploy's deploy-main -> the rollback re-renders the FULL
+          # runtime env (not a subset), so email / VK login / Grafana alerts survive it.
+          APP_VERSION="$TARGET" bash deploy/write-prod-env.sh stage/env.sh
           printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
@@ -147,9 +151,11 @@ jobs:
       PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
       PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
+      # PUBLIC_BASE_URL drives the derived Mini App URL; SUPPORT_CHAT_ID for parity with deploy.
+      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
       TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
       TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
+      TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
       TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
       TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
     steps:
@@ -163,19 +169,8 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-bot
-          cat > stage/env.bot.sh <<EOF
-          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
-          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TARGET'
-          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
-          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
-          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
-          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
-          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
-          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
-          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
-          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
-          export LOG_LEVEL='${LOG_LEVEL:-info}'
-          EOF
+          # Same writer as prod-deploy's deploy-bot (parity; includes TELEGRAM_SUPPORT_CHAT_ID).
+          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TARGET" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
           printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key

backend/cmd/backend/main.go

@@ -12,7 +12,6 @@ import (
 	"fmt"
 	"log"
 	"os/signal"
-	"strings"
 	"syscall"
 	"time"
 
@@ -216,11 +215,9 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// Operator alert emails on new feedback / word complaints, coalesced into one digest
 	// per interval. Inert unless a distinct admin sender and recipient are configured.
 	if cfg.SMTP.AdminFrom != "" && cfg.SMTP.AdminTo != "" {
-		consoleURL := ""
-		if cfg.PublicBaseURL != "" {
-			consoleURL = strings.TrimRight(cfg.PublicBaseURL, "/") + "/_gm"
-		}
-		alerts := adminalert.New(mailer, feedbackSvc, games, cfg.SMTP.AdminFrom, cfg.SMTP.AdminTo, consoleURL, logger)
+		// The alert digest carries no admin-console link on purpose — an admin URL must not
+		// travel in an email (a mail provider could cache or index it); see adminalert.New.
+		alerts := adminalert.New(mailer, feedbackSvc, games, cfg.SMTP.AdminFrom, cfg.SMTP.AdminTo, logger)
 		go alerts.Run(ctx, adminAlertInterval)
 		logger.Info("admin alert worker started", zap.Duration("interval", adminAlertInterval))
 	}

backend/internal/account/email.go

@@ -105,9 +105,10 @@ func (s *EmailService) allowSend(email string) bool {
 
 // issueCode generates a fresh confirm-code and one-tap deeplink token for (accountID,
 // email), replaces any prior pending confirmation, and mails the branded code in
-// locale; purpose selects the email wording and what verifying does. Only the SHA-256
-// hashes of the code and token are stored.
-func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string) error {
+// locale; purpose selects the email wording and what verifying does. omitLink drops the
+// one-tap deeplink from the email (account deletion, or a login requested from an installed
+// PWA). Only the SHA-256 hashes of the code and token are stored.
+func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string, omitLink bool) error {
 	code, codeHash, err := generateCode()
 	if err != nil {
 		return err
@@ -119,11 +120,12 @@ func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email
 	if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, tokenHash, purpose, s.now().Add(emailCodeTTL)); err != nil {
 		return err
 	}
-	// Account deletion is never a one-tap link (a prefetch or a stray click must not delete
-	// an account): the delete code is entered in the app only, so the email omits the
-	// deeplink and ConfirmByToken refuses a delete token.
+	// Omit the one-tap deeplink when asked: for a login from an installed PWA (the link would
+	// open in a separate browser whose minted session cannot reach the PWA), or for account
+	// deletion (a prefetch or stray click must not delete an account — the delete code is entered
+	// in the app only, and ConfirmByToken refuses a delete token).
 	deeplink := s.confirmURL(token, locale)
-	if purpose == purposeDelete {
+	if purpose == purposeDelete || omitLink {
 		deeplink = ""
 	}
 	msg, err := renderConfirmationEmail(purpose, code, deeplink, s.baseURL, locale)
@@ -175,7 +177,7 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 		}
 		return ErrEmailTaken
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
 }
 
 // ConfirmCode verifies code for accountID and email. On success it attaches a
@@ -221,8 +223,11 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 // the ordinary returning-user login. The code is mailed to the address, so only its
 // real owner can complete the login. On first contact browserTZ (the client's
 // detected "±HH:MM" UTC offset) seeds the new account's time zone and language its UI
-// language. It returns the target account id for the subsequent LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string) (uuid.UUID, error) {
+// language. When pwa is set (the request came from an installed PWA) the login email omits the
+// one-tap confirm link — it would open in a separate browser, out of the PWA's reach — so the
+// code is entered in the same window. It returns the target account id for the subsequent
+// LoginWithCode.
+func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string, pwa bool) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
@@ -234,7 +239,7 @@ func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, l
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language); err != nil {
+	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language, pwa); err != nil {
 		return uuid.UUID{}, err
 	}
 	return acc.ID, nil

backend/internal/account/link.go

@@ -92,7 +92,7 @@ func (s *EmailService) RequestLinkCode(ctx context.Context, accountID uuid.UUID,
 	if !s.allowSend(addr) {
 		return ErrTooManyRequests
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
 }
 
 // ConfirmLink verifies code for (accountID, email) and reports the address's
@@ -140,7 +140,7 @@ func (s *EmailService) RequestChangeCode(ctx context.Context, accountID uuid.UUI
 	if !s.allowSend(addr) {
 		return ErrTooManyRequests
 	}
-	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID), false)
 }
 
 // ConfirmChange verifies code for (accountID, newEmail) and atomically replaces the
@@ -199,7 +199,7 @@ func (s *EmailService) RequestDeleteCode(ctx context.Context, accountID uuid.UUI
 	if !s.allowSend(addr) {
 		return ErrTooManyRequests
 	}
-	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID), false)
 }
 
 // VerifyDeleteCode verifies the account-deletion code against the account's own email and

backend/internal/account/retention.go

@@ -21,9 +21,11 @@ import (
 const RetentionTTL = 2 * 365 * 24 * time.Hour
 
 // Reasons recorded on a retained_identities row: what detached the credential from its
-// account. The row is written just before the live identities row is removed, preserving
-// the legal dossier (which email/vk/tg was linked, and when) even as the identity frees
-// for reuse. See docs/ARCHITECTURE.md §9.1.
+// account (unlink / email change / account deletion here; an account merge that drops a
+// same-kind colliding identity writes reason "merge" from the accountmerge package). The
+// row is written just before the live identities row is removed, preserving the legal
+// dossier (which email/vk/tg was linked, and when) even as the identity frees for reuse.
+// See docs/ARCHITECTURE.md §9.1.
 const (
 	retainUnlink = "unlink"
 	retainChange = "change"

backend/internal/accountmerge/merge.go

@@ -27,6 +27,11 @@ import (
 // without taking a dependency on the game package.
 const statusActive = "active"
 
+// retainReasonMerge is the retained_identities.reason for a credential dropped by a merge
+// collision (both accounts held the same kind). It mirrors the account package's retain
+// reasons, kept local to avoid importing that package's unexported constants.
+const retainReasonMerge = "merge"
+
 // Friendship statuses, highest precedence first, mirroring internal/social.
 const (
 	friendAccepted = "accepted"
@@ -75,6 +80,9 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		if err := mergeAccountFields(ctx, tx, primary, secondary, now); err != nil {
 			return err
 		}
+		if err := dedupeIdentities(ctx, tx, primary, secondary); err != nil {
+			return err
+		}
 		if err := reassignColumn(ctx, tx, table.Identities, table.Identities.AccountID, primary, secondary); err != nil {
 			return fmt.Errorf("accountmerge: identities: %w", err)
 		}
@@ -300,6 +308,77 @@ func reassignColumn(ctx context.Context, tx *sql.Tx, tbl postgres.Table, col pos
 	return err
 }
 
+// dedupeIdentities resolves a same-kind identity collision before the blanket identity
+// reassign: when both accounts already hold an identity of the same kind (e.g. each has a
+// confirmed email — reachable when two email-bearing accounts merge), the primary keeps
+// its own and the secondary's is journaled to retained_identities (reason=merge) and
+// removed. Without this the blanket reassign would leave the survivor with two identities
+// of one kind (there is no per-account-kind unique on identities), which the profile and
+// the retention dossier both treat as singular. Non-colliding identities are untouched and
+// move with the blanket reassign.
+func dedupeIdentities(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID) error {
+	var prows []model.Identities
+	if err := postgres.SELECT(table.Identities.Kind).
+		FROM(table.Identities).
+		WHERE(table.Identities.AccountID.EQ(postgres.UUID(primary))).
+		QueryContext(ctx, tx, &prows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
+		return fmt.Errorf("accountmerge: primary identity kinds: %w", err)
+	}
+	occupied := make(map[string]struct{}, len(prows))
+	for _, r := range prows {
+		occupied[r.Kind] = struct{}{}
+	}
+	if len(occupied) == 0 {
+		return nil
+	}
+	var srows []model.Identities
+	if err := postgres.SELECT(
+		table.Identities.Kind, table.Identities.ExternalID,
+		table.Identities.Confirmed, table.Identities.CreatedAt,
+	).FROM(table.Identities).
+		WHERE(table.Identities.AccountID.EQ(postgres.UUID(secondary))).
+		QueryContext(ctx, tx, &srows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
+		return fmt.Errorf("accountmerge: secondary identities: %w", err)
+	}
+	for _, s := range srows {
+		if _, dup := occupied[s.Kind]; !dup {
+			continue
+		}
+		if err := retainMergedIdentity(ctx, tx, secondary, s); err != nil {
+			return err
+		}
+		del := table.Identities.DELETE().WHERE(
+			table.Identities.AccountID.EQ(postgres.UUID(secondary)).
+				AND(table.Identities.Kind.EQ(postgres.String(s.Kind))).
+				AND(table.Identities.ExternalID.EQ(postgres.String(s.ExternalID))),
+		)
+		if _, err := del.ExecContext(ctx, tx); err != nil {
+			return fmt.Errorf("accountmerge: drop colliding %s identity: %w", s.Kind, err)
+		}
+	}
+	return nil
+}
+
+// retainMergedIdentity appends a retained_identities row for a secondary identity dropped
+// by a merge collision (reason=merge), preserving it in the legal dossier. It mirrors
+// account.retainIdentityTx, which is unexported; detached_at falls to the column default.
+func retainMergedIdentity(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, id model.Identities) error {
+	rid, err := uuid.NewV7()
+	if err != nil {
+		return fmt.Errorf("accountmerge: new retained id: %w", err)
+	}
+	ins := table.RetainedIdentities.INSERT(
+		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
+		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
+		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
+		table.RetainedIdentities.Reason,
+	).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainReasonMerge)
+	if _, err := ins.ExecContext(ctx, tx); err != nil {
+		return fmt.Errorf("accountmerge: retain merged %s identity: %w", id.Kind, err)
+	}
+	return nil
+}
+
 // friendRank ranks a friendship status for dedupe precedence (higher wins).
 func friendRank(status string) int {
 	switch status {

backend/internal/adminalert/notify.go

@@ -33,21 +33,21 @@ type Notifier struct {
 	complaints ComplaintCounter
 	from       string
 	to         string
-	consoleURL string
 	clock      func() time.Time
 	log        *zap.Logger
 	last       time.Time
 }
 
-// New constructs a Notifier. from and to are the alert sender and recipient(s); consoleURL,
-// when non-empty, is the admin-console link included in the email. log may be nil. The
-// watermark starts at "now", so only items arriving after start-up are reported.
-func New(mailer account.Mailer, fb FeedbackCounter, cp ComplaintCounter, from, to, consoleURL string, log *zap.Logger) *Notifier {
+// New constructs a Notifier. from and to are the alert sender and recipient(s); log may be
+// nil. The watermark starts at "now", so only items arriving after start-up are reported. The
+// digest deliberately carries no admin-console link — an admin URL must never travel in an
+// email, where a mail provider could cache or index it.
+func New(mailer account.Mailer, fb FeedbackCounter, cp ComplaintCounter, from, to string, log *zap.Logger) *Notifier {
 	if log == nil {
 		log = zap.NewNop()
 	}
 	return &Notifier{
-		mailer: mailer, feedback: fb, complaints: cp, from: from, to: to, consoleURL: consoleURL,
+		mailer: mailer, feedback: fb, complaints: cp, from: from, to: to,
 		clock: func() time.Time { return time.Now().UTC() }, log: log, last: time.Now().UTC(),
 	}
 }
@@ -103,10 +103,9 @@ func (n *Notifier) digest(fb, cp int) account.Message {
 		parts = append(parts, fmt.Sprintf("%d new word complaint(s)", cp))
 	}
 	summary := strings.Join(parts, ", ")
+	// No admin-console link in the body: an admin URL must never travel in an email (a mail
+	// provider could cache or index it). The operator opens the console directly.
 	text := summary + "."
-	if n.consoleURL != "" {
-		text += "\n\nOpen the admin console: " + n.consoleURL
-	}
 	return account.Message{
 		From:    n.from,
 		To:      n.to,

backend/internal/adminalert/notify_test.go

@@ -28,7 +28,7 @@ func (m *recordingMailer) Send(_ context.Context, msg account.Message) error {
 
 func TestNotifierSkipsWhenNothingNew(t *testing.T) {
 	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{0}, cpCounter{0}, "alerts@erudit-game.ru", "op@x.ru", "", nil)
+	n := New(mailer, fbCounter{0}, cpCounter{0}, "alerts@erudit-game.ru", "op@x.ru", nil)
 	n.tick(context.Background())
 	if len(mailer.sent) != 0 {
 		t.Fatalf("sent %d emails, want 0 when nothing is new", len(mailer.sent))
@@ -37,7 +37,7 @@ func TestNotifierSkipsWhenNothingNew(t *testing.T) {
 
 func TestNotifierDigestsNewItems(t *testing.T) {
 	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{2}, cpCounter{1}, "alerts@erudit-game.ru", "op@x.ru, two@x.ru", "https://erudit-game.ru/_gm", nil)
+	n := New(mailer, fbCounter{2}, cpCounter{1}, "alerts@erudit-game.ru", "op@x.ru, two@x.ru", nil)
 	n.tick(context.Background())
 	if len(mailer.sent) != 1 {
 		t.Fatalf("sent %d emails, want 1 digest", len(mailer.sent))
@@ -49,7 +49,9 @@ func TestNotifierDigestsNewItems(t *testing.T) {
 	if !strings.Contains(msg.Subject, "2 new feedback") || !strings.Contains(msg.Subject, "1 new word complaint") {
 		t.Errorf("digest subject = %q, want the feedback + complaint counts", msg.Subject)
 	}
-	if !strings.Contains(msg.Text, "/_gm") {
-		t.Errorf("digest body = %q, want the console link", msg.Text)
+	// The digest must never carry an admin-console link — an admin URL in an email is a leak
+	// (mail providers cache/index it).
+	if strings.Contains(msg.Text, "/_gm") || strings.Contains(strings.ToLower(msg.Text), "admin console") {
+		t.Errorf("digest body = %q, must not carry an admin-console link", msg.Text)
 	}
 }

backend/internal/adminconsole/assets/console.css

@@ -193,3 +193,24 @@ code { background: var(--bg); padding: 0.05rem 0.3rem; border-radius: 4px; }
 .replay-log { margin: 0.4rem 0 0; padding-left: 1.4rem; max-height: 14rem; overflow: auto; font-size: 0.85rem; }
 .replay-log li { color: var(--ink-dim); padding: 0.1rem 0; }
 .replay-log li.cur { color: var(--ink); font-weight: 600; }
+
+/* Banner colour override editor + live preview (banner_detail). The override
+   fieldsets group the enable toggle with the native colour swatches; the preview
+   renders a sample strip on both themes from those inputs (see the inline script). */
+.ovr { border: 1px solid var(--line); border-radius: 6px; padding: 0.3rem 0.8rem 0.7rem; margin: 0.2rem 0; }
+.ovr legend { padding: 0 0.3rem; font-size: 0.85rem; color: var(--ink); }
+.ovr legend label { flex-direction: row; align-items: center; gap: 0.4rem; color: var(--ink); }
+.ovr .note { margin: 0.2rem 0 0.4rem; }
+.ovr .swatches { display: flex; flex-wrap: wrap; gap: 1rem; }
+.ovr .swatches label { flex-direction: column; gap: 0.25rem; align-items: flex-start; }
+.ovr input[type=color] { width: 3rem; height: 1.8rem; padding: 0; border: 1px solid var(--line); border-radius: 4px; background: var(--bg); cursor: pointer; }
+.ovr input[type=color]:disabled { opacity: 0.4; cursor: default; }
+.ovr .hex { font-size: 0.72rem; color: var(--ink-dim); font-variant-numeric: tabular-nums; }
+.banner-preview { display: flex; flex-wrap: wrap; gap: 0.8rem; margin: 0.7rem 0 0.2rem; }
+.banner-preview .bp { flex: 1 1 18rem; }
+.banner-preview .bp-label { display: block; font-size: 0.75rem; color: var(--ink-dim); margin-bottom: 0.25rem; }
+.ad-frame { padding: 0.7rem; border-radius: 6px; border: 1px solid var(--line); }
+.ad-frame.light { background: #f4f6f9; }
+.ad-frame.dark { background: #0f1420; }
+.ad-sample { padding: 0.35rem 0.7rem; font-size: 0.85rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.ad-sample .ad-link { text-decoration: underline; }

backend/internal/adminconsole/templates/pages/banner_detail.gohtml

@@ -11,10 +11,72 @@
 <label>Starts (UTC) <input type="datetime-local" name="starts_at" value="{{.StartsAt}}"></label>
 <label>Ends (UTC) <input type="datetime-local" name="ends_at" value="{{.EndsAt}}"></label>
 <label><input type="checkbox" name="enabled"{{if .Enabled}} checked{{end}}> Enabled</label>
+<fieldset class="ovr">
+<legend><label><input type="checkbox" name="urgent"{{if .Urgent}} checked{{end}}> Urgent</label></legend>
+<p class="note">Shows to <em>everyone</em>, always — bypassing paid accounts, hint wallets and the no-banner role. While any urgent campaign is live it is the only thing the strip shows (other campaigns and the default are suppressed). For system alerts.</p>
+</fieldset>
+<fieldset class="ovr" data-ovr-group>
+<legend><label><input type="checkbox" name="override_all_on" data-ovr="all"{{if .OverrideAllOn}} checked{{end}}> Colour override — all themes</label></legend>
+<div class="swatches">
+<label>Background <input type="color" name="override_bg" value="{{.AllBg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Text <input type="color" name="override_fg" value="{{.AllFg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Link <input type="color" name="override_link" value="{{.AllLink}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
+</div>
+</fieldset>
+<fieldset class="ovr" data-ovr-group>
+<legend><label><input type="checkbox" name="override_dark_on" data-ovr="dark"{{if .OverrideDarkOn}} checked{{end}}> Colour override — dark theme only</label></legend>
+<div class="swatches">
+<label>Background <input type="color" name="override_bg_dark" value="{{.DarkBg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Text <input type="color" name="override_fg_dark" value="{{.DarkFg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Link <input type="color" name="override_link_dark" value="{{.DarkLink}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
+</div>
+</fieldset>
 {{end}}
 <div><button type="submit">Save</button></div>
 </form>
 {{if not .IsDefault}}
+<div class="banner-preview">
+<div class="bp"><span class="bp-label">Light theme</span><div class="ad-frame light"><div class="ad-sample" id="prev-light"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
+<div class="bp"><span class="bp-label">Dark theme</span><div class="ad-frame dark"><div class="ad-sample" id="prev-dark"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
+</div>
+<p class="note">Live preview of the strip on both themes. An empty override falls back to the neutral theme colours; the top/bottom border is derived from the background.</p>
+<script>
+(function(){
+  // Neutral fallbacks — mirror ui/src/app.css (--ad-bg / --text-muted / --accent).
+  var TOK={light:{bg:'#e3e7ee',fg:'#6b7280',link:'#2f6df6'},dark:{bg:'#272f3c',fg:'#9aa3b2',link:'#5b8cff'}};
+  function byName(n){return document.querySelector('[name="'+n+'"]');}
+  var allOn=byName('override_all_on'), darkOn=byName('override_dark_on');
+  if(!allOn||!darkOn){return;}
+  var f={ab:byName('override_bg'),af:byName('override_fg'),al:byName('override_link'),db:byName('override_bg_dark'),df:byName('override_fg_dark'),dl:byName('override_link_dark')};
+  var lightEl=document.getElementById('prev-light'), darkEl=document.getElementById('prev-dark');
+  function hexToRgb(h){h=h.replace('#','');return [parseInt(h.slice(0,2),16),parseInt(h.slice(2,4),16),parseInt(h.slice(4,6),16)];}
+  function pad(x){x=Math.max(0,Math.min(255,Math.round(x))).toString(16);return x.length<2?'0'+x:x;}
+  function rgbToHex(r){return '#'+pad(r[0])+pad(r[1])+pad(r[2]);}
+  function mix(a,b,t){return [a[0]+(b[0]-a[0])*t,a[1]+(b[1]-a[1])*t,a[2]+(b[2]-a[2])*t];}
+  function lum(r){return (0.2126*r[0]+0.7152*r[1]+0.0722*r[2])/255;}
+  // Derived border: nudge the background 14% toward black on a light bg, toward white on a dark bg.
+  function border(bg){var r=hexToRgb(bg);return rgbToHex(mix(r, lum(r)>0.5?[0,0,0]:[255,255,255], 0.14));}
+  function paint(el,c){
+    el.style.background=c.bg; el.style.color=c.fg;
+    el.style.borderTop='1px solid '+border(c.bg); el.style.borderBottom='1px solid '+border(c.bg);
+    var a=el.querySelector('.ad-link'); if(a){a.style.color=c.link;}
+  }
+  function resolve(){
+    var light=allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.light;
+    var dark=darkOn.checked?{bg:f.db.value,fg:f.df.value,link:f.dl.value}
+            :(allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.dark);
+    paint(lightEl,light); paint(darkEl,dark);
+    document.querySelectorAll('.ovr .swatches label').forEach(function(lab){
+      var inp=lab.querySelector('input[type=color]'), hx=lab.querySelector('.hex');
+      if(inp&&hx){hx.textContent=inp.value;}
+    });
+  }
+  function toggleGroup(chk){chk.closest('fieldset').querySelectorAll('[data-ovr-color]').forEach(function(inp){inp.disabled=!chk.checked;});}
+  [allOn,darkOn].forEach(function(chk){chk.addEventListener('change',function(){toggleGroup(chk);resolve();});});
+  Object.keys(f).forEach(function(k){f[k].addEventListener('input',resolve);});
+  resolve();
+})();
+</script>
 <form class="form" method="post" action="/_gm/banners/{{.ID}}/delete" onsubmit="return confirm('Delete this campaign and its messages?')">
 <button type="submit" class="danger">Delete campaign</button>
 </form>

backend/internal/adminconsole/views.go

@@ -498,15 +498,30 @@ type BannerCampaignRow struct {
 
 // BannerDetailView is the campaign detail/edit page. StartsAt/EndsAt are the
 // "YYYY-MM-DDTHH:MM" (UTC) values for the datetime-local inputs, empty when open.
+//
+// The colour-override and urgent fields drive the non-default campaign's editor:
+// OverrideAllOn/OverrideDarkOn report whether each colour set is active, and the
+// six *Bg/*Fg/*Link values seed the native colour inputs — the stored override
+// when a set is on, otherwise the neutral theme token so the picker starts from a
+// sensible colour and the live preview shows the real fallback.
 type BannerDetailView struct {
-	ID        string
-	Name      string
-	Weight    int
-	IsDefault bool
-	Enabled   bool
-	StartsAt  string
-	EndsAt    string
-	Messages  []BannerMessageRow
+	ID             string
+	Name           string
+	Weight         int
+	IsDefault      bool
+	Enabled        bool
+	StartsAt       string
+	EndsAt         string
+	Urgent         bool
+	OverrideAllOn  bool
+	AllBg          string
+	AllFg          string
+	AllLink        string
+	OverrideDarkOn bool
+	DarkBg         string
+	DarkFg         string
+	DarkLink       string
+	Messages       []BannerMessageRow
 }
 
 // BannerMessageRow is one bilingual message of a campaign. First/Last drive the

backend/internal/ads/ads.go

@@ -30,6 +30,15 @@ var ErrDefaultImmutable = errors.New("ads: the default campaign cannot be modifi
 // window or message body).
 var ErrValidation = errors.New("ads: validation")
 
+// ColorSet is an optional per-campaign colour override for the banner strip:
+// background, foreground (text) and link, each a "#rrggbb" hex string. The three
+// are set together or the whole set is absent (a nil *ColorSet).
+type ColorSet struct {
+	Bg   string
+	Fg   string
+	Link string
+}
+
 // Campaign is one advertising placement order with its messages.
 type Campaign struct {
 	ID        uuid.UUID // uuid.Nil on create
@@ -40,6 +49,16 @@ type Campaign struct {
 	StartsAt  *time.Time // nil = open-ended start; always nil for the default
 	EndsAt    *time.Time // nil = open-ended end; always nil for the default
 	Messages  []Message
+	// OverrideAll paints the strip on every theme; OverrideDark, when set, further
+	// overrides the dark theme (the client resolves dark ← dark ?? all ?? token,
+	// light ← all ?? token). Both are nil for the default campaign and for a
+	// campaign that keeps the neutral theme tokens. Non-default only.
+	OverrideAll  *ColorSet
+	OverrideDark *ColorSet
+	// Urgent forces the banner on every viewer (bypassing eligibility) and, while
+	// any urgent campaign is active, suppresses every non-urgent campaign and the
+	// default remainder. Non-default only; always false for the default campaign.
+	Urgent    bool
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
@@ -70,10 +89,15 @@ type Timings struct {
 
 // ActiveCampaign is one campaign in the resolved rotation feed sent to a client:
 // its GCD-reduced show weight and its messages, already resolved to the viewer's
-// language and in display (round-robin) order.
+// language and in display (round-robin) order, plus the optional colour overrides
+// the client applies to the strip (nil = the neutral theme tokens). Urgency is not
+// carried here: it is resolved server-side into the set's membership and the
+// eligibility bypass, so the client only ever renders what it is sent.
 type ActiveCampaign struct {
-	Weight   int
-	Messages []string
+	Weight       int
+	Messages     []string
+	OverrideAll  *ColorSet
+	OverrideDark *ColorSet
 }
 
 // Eligible reports whether an account should be shown the advertising banner: a
@@ -85,14 +109,20 @@ func Eligible(paidAccount bool, hintBalance int, hasNoBanner bool) bool {
 }
 
 // computeActiveSet builds the resolved rotation feed from the enabled campaigns
-// at time now, in language lang. Campaigns outside their validity window, and
-// campaigns with no messages, are dropped. The default campaign's effective
-// weight is the remainder up to 100% — max(0, 100 - sum of active timed
-// weights) — so it fills unsold inventory and is dropped entirely when timed
-// campaigns already reach 100%. Weights are then reduced by their GCD so the
-// fair rotation cycle stays short. The input is expected to be the enabled
-// campaigns (ActiveCampaigns); disabled ones must already be excluded.
-func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []ActiveCampaign {
+// at time now, in language lang, and reports whether the feed is an urgent one.
+// Campaigns outside their validity window, and campaigns with no messages, are
+// dropped.
+//
+// While any active campaign is urgent, the feed is the urgent campaigns alone —
+// every non-urgent timed campaign and the default remainder are suppressed for
+// the duration (and the caller shows the feed to every viewer, bypassing
+// eligibility). Otherwise the default campaign's effective weight is the
+// remainder up to 100% — max(0, 100 - sum of active timed weights) — so it fills
+// unsold inventory and is dropped entirely when timed campaigns already reach
+// 100%. Weights are then reduced by their GCD so the fair rotation cycle stays
+// short. The input is expected to be the enabled campaigns (ActiveCampaigns);
+// disabled ones must already be excluded.
+func computeActiveSet(campaigns []Campaign, now time.Time, lang string) ([]ActiveCampaign, bool) {
 	var timed []Campaign
 	var def *Campaign
 	for i := range campaigns {
@@ -108,20 +138,54 @@ func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []Active
 			timed = append(timed, c)
 		}
 	}
+	if urgent := filterUrgent(timed); len(urgent) > 0 {
+		out := make([]ActiveCampaign, 0, len(urgent))
+		for _, c := range urgent {
+			out = append(out, activeFrom(c, lang))
+		}
+		reduceByGCD(out)
+		return out, true
+	}
 	sumTimed := 0
 	for _, c := range timed {
 		sumTimed += c.Weight
 	}
 	out := make([]ActiveCampaign, 0, len(timed)+1)
 	for _, c := range timed {
-		out = append(out, ActiveCampaign{Weight: c.Weight, Messages: resolveBodies(c.Messages, lang)})
+		out = append(out, activeFrom(c, lang))
 	}
 	if def != nil {
 		if dw := 100 - sumTimed; dw > 0 {
-			out = append(out, ActiveCampaign{Weight: dw, Messages: resolveBodies(def.Messages, lang)})
+			a := activeFrom(*def, lang)
+			a.Weight = dw // the default's stored weight is nominal; it fills the remainder
+			out = append(out, a)
 		}
 	}
 	reduceByGCD(out)
+	return out, false
+}
+
+// activeFrom projects a campaign to its rotation-feed entry: its show weight, its
+// language-resolved messages and its colour overrides (carried through by
+// reference, they are read-only).
+func activeFrom(c Campaign, lang string) ActiveCampaign {
+	return ActiveCampaign{
+		Weight:       c.Weight,
+		Messages:     resolveBodies(c.Messages, lang),
+		OverrideAll:  c.OverrideAll,
+		OverrideDark: c.OverrideDark,
+	}
+}
+
+// filterUrgent returns the urgent campaigns among cs, preserving order. It is the
+// preempt selector: a non-empty result makes the whole feed urgent.
+func filterUrgent(cs []Campaign) []Campaign {
+	var out []Campaign
+	for _, c := range cs {
+		if c.Urgent {
+			out = append(out, c)
+		}
+	}
 	return out
 }
 

backend/internal/ads/ads_test.go

@@ -46,12 +46,19 @@ func TestComputeActiveSet(t *testing.T) {
 	timed := func(name string, weight int, starts, ends *time.Time, msgs []Message) Campaign {
 		return Campaign{Name: name, Weight: weight, Enabled: true, StartsAt: starts, EndsAt: ends, Messages: msgs}
 	}
+	urgent := func(name string, weight int, msgs []Message) Campaign {
+		c := timed(name, weight, nil, nil, msgs)
+		c.Urgent = true
+		return c
+	}
+	red := &ColorSet{Bg: "#aa0000", Fg: "#ffffff", Link: "#ffdd00"}
 
 	tests := []struct {
-		name      string
-		campaigns []Campaign
-		lang      string
-		want      []ActiveCampaign
+		name       string
+		campaigns  []Campaign
+		lang       string
+		want       []ActiveCampaign
+		wantUrgent bool
 	}{
 		{
 			name:      "default only reduces to weight 1",
@@ -152,22 +159,71 @@ func TestComputeActiveSet(t *testing.T) {
 			lang: "en",
 			want: []ActiveCampaign{{Weight: 1, Messages: []string{"one-en", "two-en"}}},
 		},
+		{
+			name: "urgent preempts default and normal timed",
+			campaigns: []Campaign{
+				def(msg("house")),
+				timed("promo", 40, nil, nil, msg("promo")),
+				urgent("alert", 50, msg("alert")),
+			},
+			lang: "en",
+			// only the urgent campaign survives; a lone weight reduces to 1.
+			want:       []ActiveCampaign{{Weight: 1, Messages: []string{"alert-en"}}},
+			wantUrgent: true,
+		},
+		{
+			name: "multiple urgent share the feed by gcd",
+			campaigns: []Campaign{
+				def(msg("house")),
+				urgent("a", 60, msg("a")),
+				urgent("b", 40, msg("b")),
+			},
+			lang: "en",
+			// default and any non-urgent dropped; gcd(60,40)=20 -> 3 and 2.
+			want: []ActiveCampaign{
+				{Weight: 3, Messages: []string{"a-en"}},
+				{Weight: 2, Messages: []string{"b-en"}},
+			},
+			wantUrgent: true,
+		},
+		{
+			name: "out-of-window urgent does not preempt",
+			campaigns: []Campaign{
+				def(msg("house")),
+				func() Campaign { c := urgent("future", 50, msg("future")); c.StartsAt = &future; return c }(),
+			},
+			lang: "en",
+			// the urgent campaign is not yet live, so the normal default feed stands.
+			want: []ActiveCampaign{{Weight: 1, Messages: []string{"house-en"}}},
+		},
+		{
+			name: "colour overrides ride the active campaign",
+			campaigns: []Campaign{
+				def(msg("house")),
+				func() Campaign { c := timed("promo", 100, nil, nil, msg("promo")); c.OverrideAll = red; return c }(),
+			},
+			lang: "en",
+			want: []ActiveCampaign{{Weight: 1, Messages: []string{"promo-en"}, OverrideAll: red}},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := computeActiveSet(tt.campaigns, now, tt.lang)
+			got, gotUrgent := computeActiveSet(tt.campaigns, now, tt.lang)
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("computeActiveSet() =\n  %#v\nwant\n  %#v", got, tt.want)
 			}
+			if gotUrgent != tt.wantUrgent {
+				t.Errorf("computeActiveSet() urgent = %v, want %v", gotUrgent, tt.wantUrgent)
+			}
 		})
 	}
 }
 
 func TestComputeActiveSetEmpty(t *testing.T) {
 	// No campaigns at all yields an empty (non-nil-or-nil) feed without panicking.
-	if got := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 {
-		t.Errorf("computeActiveSet(nil) = %#v, want empty", got)
+	if got, urgent := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 || urgent {
+		t.Errorf("computeActiveSet(nil) = %#v urgent=%v, want empty non-urgent", got, urgent)
 	}
 }
 

backend/internal/ads/service.go

@@ -3,6 +3,7 @@ package ads
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
@@ -40,17 +41,20 @@ func NewService(store *Store) *Service { return &Service{store: store} }
 // ActiveSet returns the resolved rotation feed for a viewer in language lang
 // (en/ru) together with the global display timings: the currently-active
 // campaigns, each with its GCD-reduced show weight and its messages resolved to
-// lang, ready for the client's weighted round-robin.
-func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, error) {
+// lang, ready for the client's weighted round-robin. The bool result reports
+// whether the feed is urgent — an urgent feed is shown to every viewer
+// regardless of eligibility (the caller skips the eligibility gate for it).
+func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, bool, error) {
 	campaigns, err := s.store.ActiveCampaigns(ctx)
 	if err != nil {
-		return nil, Timings{}, err
+		return nil, Timings{}, false, err
 	}
 	timings, err := s.store.Settings(ctx)
 	if err != nil {
-		return nil, Timings{}, err
+		return nil, Timings{}, false, err
 	}
-	return computeActiveSet(campaigns, time.Now().UTC(), lang), timings, nil
+	set, urgent := computeActiveSet(campaigns, time.Now().UTC(), lang)
+	return set, timings, urgent, nil
 }
 
 // ListCampaigns returns every campaign with its messages, for the admin console.
@@ -76,8 +80,13 @@ func (s *Service) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, er
 	if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 		return uuid.Nil, err
 	}
+	all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
+	if err != nil {
+		return uuid.Nil, err
+	}
 	return s.store.CreateCampaign(ctx, Campaign{
 		Name: name, Weight: c.Weight, Enabled: c.Enabled, StartsAt: c.StartsAt, EndsAt: c.EndsAt,
+		OverrideAll: all, OverrideDark: dark, Urgent: c.Urgent,
 	})
 }
 
@@ -99,6 +108,7 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		upd.Enabled = true
 		upd.StartsAt = nil
 		upd.EndsAt = nil
+		// The default (house) campaign stays plain: no colour overrides, never urgent.
 	} else {
 		if err := validWeight(c.Weight); err != nil {
 			return err
@@ -106,10 +116,17 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 			return err
 		}
+		all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
+		if err != nil {
+			return err
+		}
 		upd.Weight = c.Weight
 		upd.Enabled = c.Enabled
 		upd.StartsAt = c.StartsAt
 		upd.EndsAt = c.EndsAt
+		upd.OverrideAll = all
+		upd.OverrideDark = dark
+		upd.Urgent = c.Urgent
 	}
 	return s.store.UpdateCampaign(ctx, upd)
 }
@@ -254,6 +271,46 @@ func validWindow(starts, ends *time.Time) error {
 	return nil
 }
 
+// hexColor matches a "#rrggbb" colour — the format the console's native colour
+// input emits and the wire carries.
+var hexColor = regexp.MustCompile(`^#[0-9a-fA-F]{6}$`)
+
+// validOverrides validates the two optional colour sets together and returns
+// their normalised copies (nil when a set is absent), so a caller can store them
+// directly.
+func validOverrides(all, dark *ColorSet) (*ColorSet, *ColorSet, error) {
+	va, err := validColorSet(all)
+	if err != nil {
+		return nil, nil, err
+	}
+	vd, err := validColorSet(dark)
+	if err != nil {
+		return nil, nil, err
+	}
+	return va, vd, nil
+}
+
+// validColorSet validates one optional colour override: a nil set passes (no
+// override); otherwise all three colours must be present and "#rrggbb". It
+// returns a trimmed, lower-cased copy.
+func validColorSet(cs *ColorSet) (*ColorSet, error) {
+	if cs == nil {
+		return nil, nil
+	}
+	bg := strings.TrimSpace(cs.Bg)
+	fg := strings.TrimSpace(cs.Fg)
+	link := strings.TrimSpace(cs.Link)
+	if bg == "" || fg == "" || link == "" {
+		return nil, fmt.Errorf("%w: a colour override needs all of background, text and link", ErrValidation)
+	}
+	for _, h := range []string{bg, fg, link} {
+		if !hexColor.MatchString(h) {
+			return nil, fmt.Errorf("%w: colours must be #rrggbb hex", ErrValidation)
+		}
+	}
+	return &ColorSet{Bg: strings.ToLower(bg), Fg: strings.ToLower(fg), Link: strings.ToLower(link)}, nil
+}
+
 // validBodies trims and bounds both mandatory language bodies of a message.
 func validBodies(bodyEn, bodyRu string) (string, string, error) {
 	en := strings.TrimSpace(bodyEn)

backend/internal/ads/store.go

@@ -90,15 +90,23 @@ func (s *Store) Campaign(ctx context.Context, id uuid.UUID) (Campaign, error) {
 func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, error) {
 	id := uuid.New()
 	now := time.Now().UTC()
+	abg, afg, alink := colorCols(c.OverrideAll)
+	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.INSERT(
 		table.AdCampaigns.CampaignID, table.AdCampaigns.Name, table.AdCampaigns.Weight,
 		table.AdCampaigns.IsDefault, table.AdCampaigns.Enabled,
 		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
+		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
+		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
+		table.AdCampaigns.Urgent,
 		table.AdCampaigns.CreatedAt, table.AdCampaigns.UpdatedAt,
 	).VALUES(
 		postgres.UUID(id), postgres.String(c.Name), postgres.Int(int64(c.Weight)),
 		postgres.Bool(false), postgres.Bool(c.Enabled),
 		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
+		abg, afg, alink,
+		dbg, dfg, dlink,
+		postgres.Bool(c.Urgent),
 		postgres.TimestampzT(now), postgres.TimestampzT(now),
 	)
 	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
@@ -111,12 +119,20 @@ func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, erro
 // window. The default flag is never touched here. Returns ErrNotFound when no
 // campaign matches.
 func (s *Store) UpdateCampaign(ctx context.Context, c Campaign) error {
+	abg, afg, alink := colorCols(c.OverrideAll)
+	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.UPDATE(
 		table.AdCampaigns.Name, table.AdCampaigns.Weight, table.AdCampaigns.Enabled,
-		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt, table.AdCampaigns.UpdatedAt,
+		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
+		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
+		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
+		table.AdCampaigns.Urgent, table.AdCampaigns.UpdatedAt,
 	).SET(
 		postgres.String(c.Name), postgres.Int(int64(c.Weight)), postgres.Bool(c.Enabled),
-		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt), postgres.TimestampzT(time.Now().UTC()),
+		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
+		abg, afg, alink,
+		dbg, dfg, dlink,
+		postgres.Bool(c.Urgent), postgres.TimestampzT(time.Now().UTC()),
 	).WHERE(table.AdCampaigns.CampaignID.EQ(postgres.UUID(c.ID)))
 	return execOne(ctx, s.db, stmt, "update campaign")
 }
@@ -257,18 +273,40 @@ func execOne(ctx context.Context, db qrm.Executable, stmt postgres.Statement, wh
 
 func modelToCampaign(r model.AdCampaigns) Campaign {
 	return Campaign{
-		ID:        r.CampaignID,
-		Name:      r.Name,
-		Weight:    int(r.Weight),
-		IsDefault: r.IsDefault,
-		Enabled:   r.Enabled,
-		StartsAt:  r.StartsAt,
-		EndsAt:    r.EndsAt,
-		CreatedAt: r.CreatedAt,
-		UpdatedAt: r.UpdatedAt,
+		ID:           r.CampaignID,
+		Name:         r.Name,
+		Weight:       int(r.Weight),
+		IsDefault:    r.IsDefault,
+		Enabled:      r.Enabled,
+		StartsAt:     r.StartsAt,
+		EndsAt:       r.EndsAt,
+		OverrideAll:  colorSetFrom(r.OverrideBg, r.OverrideFg, r.OverrideLink),
+		OverrideDark: colorSetFrom(r.OverrideBgDark, r.OverrideFgDark, r.OverrideLinkDark),
+		Urgent:       r.Urgent,
+		CreatedAt:    r.CreatedAt,
+		UpdatedAt:    r.UpdatedAt,
 	}
 }
 
+// colorSetFrom rebuilds an optional ColorSet from three nullable colour columns.
+// The all-or-nothing CHECK keeps the trio consistent, so a nil in any one means
+// the set is absent.
+func colorSetFrom(bg, fg, link *string) *ColorSet {
+	if bg == nil || fg == nil || link == nil {
+		return nil
+	}
+	return &ColorSet{Bg: *bg, Fg: *fg, Link: *link}
+}
+
+// colorCols renders a *ColorSet as its three column value-expressions in
+// bg, fg, link order — NULL for each when the set is absent.
+func colorCols(cs *ColorSet) (bg, fg, link postgres.Expression) {
+	if cs == nil {
+		return postgres.NULL, postgres.NULL, postgres.NULL
+	}
+	return postgres.String(cs.Bg), postgres.String(cs.Fg), postgres.String(cs.Link)
+}
+
 func modelToMessage(r model.AdMessages) Message {
 	return Message{
 		ID:         r.MessageID,

backend/internal/inttest/banner_console_test.go

@@ -192,8 +192,9 @@ func TestBannerMessageOwnership(t *testing.T) {
 type profileBanner struct {
 	Banner *struct {
 		Campaigns []struct {
-			Weight   int      `json:"weight"`
-			Messages []string `json:"messages"`
+			Weight     int      `json:"weight"`
+			Messages   []string `json:"messages"`
+			OverrideBg string   `json:"override_bg"`
 		} `json:"campaigns"`
 		Timings struct {
 			HoldMs int `json:"hold_ms"`
@@ -274,3 +275,142 @@ func TestBannerSurvivesProfileUpdate(t *testing.T) {
 		t.Fatalf("profile update dropped the banner block: %v", p.Banner)
 	}
 }
+
+// TestBannerConsoleColorsAndUrgent drives the colour-override + urgent editor over
+// HTTP against real Postgres: an incomplete or malformed colour set is refused, a
+// full two-set override + urgent round-trips through the store (exercising the new
+// columns and CHECK constraints), clearing the sets removes the override, and the
+// default campaign stays plain (colours + urgent are ignored for it).
+func TestBannerConsoleColorsAndUrgent(t *testing.T) {
+	ctx := context.Background()
+	srv, adsSvc := bannerServer(t)
+	h := srv.Handler()
+	base := "http://admin.test/_gm"
+	const origin = "http://admin.test"
+
+	name := "Brand-" + uuid.NewString()[:8]
+	if code, body := consoleDo(h, http.MethodPost, base+"/banners", "name="+name+"&weight=20&enabled=on", origin); code != http.StatusOK || !strings.Contains(body, "Created") {
+		t.Fatalf("create = %d, has Created=%v", code, strings.Contains(body, "Created"))
+	}
+	id := findCampaign(t, adsSvc, name)
+	t.Cleanup(func() { _ = adsSvc.DeleteCampaign(ctx, id) })
+	detail := base + "/banners/" + id.String()
+
+	// A partial colour set (a missing colour) is refused by validation.
+	partial := "name=" + name + "&weight=20&enabled=on&override_all_on=on&override_bg=%23aa0000&override_fg=&override_link=%23ffdd00"
+	if code, b := consoleDo(h, http.MethodPost, detail, partial, origin); code != http.StatusOK || !strings.Contains(b, "Not saved") {
+		t.Fatalf("partial colour = %d, has 'Not saved'=%v", code, strings.Contains(b, "Not saved"))
+	}
+	// A malformed hex is refused.
+	badHex := "name=" + name + "&weight=20&enabled=on&override_all_on=on&override_bg=red&override_fg=%23ffffff&override_link=%23ffdd00"
+	if code, b := consoleDo(h, http.MethodPost, detail, badHex, origin); code != http.StatusOK || !strings.Contains(b, "Not saved") {
+		t.Fatalf("bad hex = %d, has 'Not saved'=%v", code, strings.Contains(b, "Not saved"))
+	}
+	// Both colour sets + urgent persist and round-trip through the store.
+	full := "name=" + name + "&weight=20&enabled=on&urgent=on" +
+		"&override_all_on=on&override_bg=%23aa0000&override_fg=%23ffffff&override_link=%23ffdd00" +
+		"&override_dark_on=on&override_bg_dark=%23330000&override_fg_dark=%23eeeeee&override_link_dark=%23ffcc00"
+	if code, b := consoleDo(h, http.MethodPost, detail, full, origin); code != http.StatusOK || !strings.Contains(b, "Saved") {
+		t.Fatalf("full save = %d, has Saved=%v", code, strings.Contains(b, "Saved"))
+	}
+	cm, err := adsSvc.Campaign(ctx, id)
+	if err != nil {
+		t.Fatalf("read campaign: %v", err)
+	}
+	if cm.OverrideAll == nil || cm.OverrideAll.Bg != "#aa0000" || cm.OverrideAll.Fg != "#ffffff" || cm.OverrideAll.Link != "#ffdd00" {
+		t.Fatalf("override all = %+v", cm.OverrideAll)
+	}
+	if cm.OverrideDark == nil || cm.OverrideDark.Bg != "#330000" || cm.OverrideDark.Fg != "#eeeeee" || cm.OverrideDark.Link != "#ffcc00" {
+		t.Fatalf("override dark = %+v", cm.OverrideDark)
+	}
+	if !cm.Urgent {
+		t.Fatal("urgent not persisted")
+	}
+	// Clearing the sets (both checkboxes off, urgent off) removes the override.
+	if code, _ := consoleDo(h, http.MethodPost, detail, "name="+name+"&weight=20&enabled=on", origin); code != http.StatusOK {
+		t.Fatalf("clear = %d", code)
+	}
+	if cm, _ := adsSvc.Campaign(ctx, id); cm.OverrideAll != nil || cm.OverrideDark != nil || cm.Urgent {
+		t.Fatalf("override not cleared: all=%v dark=%v urgent=%v", cm.OverrideAll, cm.OverrideDark, cm.Urgent)
+	}
+
+	// The default campaign stays plain: submitted colours + urgent are ignored for it.
+	def := defaultCampaign(t, adsSvc)
+	defForm := "name=Default+%28house%29&urgent=on&override_all_on=on&override_bg=%23aa0000&override_fg=%23ffffff&override_link=%23ffdd00"
+	if code, _ := consoleDo(h, http.MethodPost, base+"/banners/"+def.ID.String(), defForm, origin); code != http.StatusOK {
+		t.Fatalf("update default = %d", code)
+	}
+	if again := defaultCampaign(t, adsSvc); again.OverrideAll != nil || again.OverrideDark != nil || again.Urgent {
+		t.Fatalf("default not plain: all=%v dark=%v urgent=%v", again.OverrideAll, again.OverrideDark, again.Urgent)
+	}
+}
+
+// TestBannerUrgentBypassesEligibility checks the urgent flag at the profile level:
+// an urgent campaign preempts the feed (only it shows, with its colours) and reaches
+// every viewer — including the no_banner role and a non-empty hint wallet that
+// otherwise suppress the banner.
+func TestBannerUrgentBypassesEligibility(t *testing.T) {
+	ctx := context.Background()
+	srv, adsSvc := bannerServer(t)
+	accounts := account.NewStore(testDB)
+	id := provisionAccount(t)
+
+	urgentID, err := adsSvc.CreateCampaign(ctx, ads.Campaign{
+		Name: "Alert-" + uuid.NewString()[:8], Weight: 10, Enabled: true, Urgent: true,
+		OverrideAll: &ads.ColorSet{Bg: "#aa0000", Fg: "#ffffff", Link: "#ffdd00"},
+	})
+	if err != nil {
+		t.Fatalf("create urgent: %v", err)
+	}
+	t.Cleanup(func() { _ = adsSvc.DeleteCampaign(ctx, urgentID) })
+	if _, err := adsSvc.AddMessage(ctx, urgentID, "System maintenance tonight", "Ночью тех.работы"); err != nil {
+		t.Fatalf("add urgent message: %v", err)
+	}
+
+	get := func() profileBanner {
+		t.Helper()
+		rec := userGet(t, srv, "/api/v1/user/profile", id)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("profile = %d", rec.Code)
+		}
+		var p profileBanner
+		if err := json.Unmarshal(rec.Body.Bytes(), &p); err != nil {
+			t.Fatalf("decode: %v", err)
+		}
+		return p
+	}
+	assertUrgentOnly := func(what string, p profileBanner) {
+		t.Helper()
+		if p.Banner == nil {
+			t.Fatalf("%s: no banner", what)
+		}
+		if len(p.Banner.Campaigns) != 1 {
+			t.Fatalf("%s: %d campaigns, want only the urgent one (default preempted)", what, len(p.Banner.Campaigns))
+		}
+		c := p.Banner.Campaigns[0]
+		if len(c.Messages) != 1 || c.Messages[0] != "System maintenance tonight" {
+			t.Fatalf("%s: messages = %v, want only the urgent one", what, c.Messages)
+		}
+		if c.OverrideBg != "#aa0000" {
+			t.Fatalf("%s: override_bg = %q, want #aa0000", what, c.OverrideBg)
+		}
+	}
+
+	// A normal viewer sees only the urgent campaign (the default is preempted).
+	assertUrgentOnly("eligible", get())
+
+	// The no_banner role no longer suppresses it — urgent reaches everyone.
+	if err := accounts.GrantRole(ctx, id, account.RoleNoBanner); err != nil {
+		t.Fatalf("grant role: %v", err)
+	}
+	assertUrgentOnly("no_banner", get())
+	if err := accounts.RevokeRole(ctx, id, account.RoleNoBanner); err != nil {
+		t.Fatalf("revoke role: %v", err)
+	}
+
+	// A non-empty hint wallet no longer suppresses it either.
+	if _, err := accounts.GrantHints(ctx, id, 5); err != nil {
+		t.Fatalf("grant hints: %v", err)
+	}
+	assertUrgentOnly("hints", get())
+}

backend/internal/inttest/email_test.go

@@ -206,7 +206,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
 	email := "login-" + uuid.NewString() + "@example.com"
 
-	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00", "en")
+	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00", "en", false)
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -233,7 +233,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	}
 
 	// A second login for the same email is the returning user: same account.
-	if _, err := svc.RequestLoginCode(ctx, email, "", "ru"); err != nil {
+	if _, err := svc.RequestLoginCode(ctx, email, "", "ru", false); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
@@ -255,7 +255,7 @@ func TestEmailLoginProvisionsGuestUntilConfirmed(t *testing.T) {
 	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
 	email := "squat-" + uuid.NewString() + "@example.com"
 
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
+	id, err := svc.RequestLoginCode(ctx, email, "", "en", false)
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -279,6 +279,34 @@ func TestEmailLoginProvisionsGuestUntilConfirmed(t *testing.T) {
 	}
 }
 
+// TestEmailLoginPWAOmitsLink: a login requested from an installed PWA (pwa=true) mails only the
+// code — no one-tap confirm link, which would otherwise open in a separate browser out of the
+// PWA's reach. A non-PWA request keeps the link.
+func TestEmailLoginPWAOmitsLink(t *testing.T) {
+	ctx := context.Background()
+	mailer := &capturingMailer{}
+	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
+
+	pwaEmail := "pwa-login-" + uuid.NewString() + "@example.com"
+	if _, err := svc.RequestLoginCode(ctx, pwaEmail, "", "en", true); err != nil {
+		t.Fatalf("pwa request login: %v", err)
+	}
+	if sixDigit.FindString(mailer.lastBody) == "" {
+		t.Errorf("pwa login mail must still carry the code, body %q", mailer.lastBody)
+	}
+	if confirmToken.MatchString(mailer.lastBody) {
+		t.Errorf("pwa login mail must omit the one-tap confirm link, body %q", mailer.lastBody)
+	}
+
+	webEmail := "web-login-" + uuid.NewString() + "@example.com"
+	if _, err := svc.RequestLoginCode(ctx, webEmail, "", "en", false); err != nil {
+		t.Fatalf("web request login: %v", err)
+	}
+	if !confirmToken.MatchString(mailer.lastBody) {
+		t.Errorf("non-pwa login mail must keep the one-tap confirm link, body %q", mailer.lastBody)
+	}
+}
+
 // confirmToken extracts the one-tap deeplink token from the /app/#/confirm/<token> link
 // the branded email carries.
 var confirmToken = regexp.MustCompile(`/confirm/([A-Za-z0-9_-]+)`)
@@ -301,7 +329,7 @@ func TestConfirmByTokenLogin(t *testing.T) {
 	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
 	email := "tok-login-" + uuid.NewString() + "@example.com"
 
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
+	id, err := svc.RequestLoginCode(ctx, email, "", "en", false)
 	if err != nil {
 		t.Fatalf("request login: %v", err)
 	}
@@ -382,7 +410,7 @@ func TestEmailAccountSeedsDisplayName(t *testing.T) {
 	svc := account.NewEmailService(store, &capturingMailer{}, "https://erudit-game.ru")
 	local := "kaya-" + uuid.NewString()[:8]
 
-	id, err := svc.RequestLoginCode(ctx, local+"@example.com", "", "en")
+	id, err := svc.RequestLoginCode(ctx, local+"@example.com", "", "en", false)
 	if err != nil {
 		t.Fatalf("request login: %v", err)
 	}

backend/internal/inttest/merge_test.go

@@ -251,6 +251,44 @@ func TestAccountMergeFinishedSharedGameKept(t *testing.T) {
 	}
 }
 
+// TestAccountMergeDedupesEmail keeps the primary's email when both accounts have one and
+// journals the secondary's to the dossier (reason=merge), so the survivor never ends up
+// with two email identities.
+func TestAccountMergeDedupesEmail(t *testing.T) {
+	ctx := context.Background()
+	store := account.NewStore(testDB)
+	merger := accountmerge.NewMerger(testDB)
+
+	primary := provisionAccount(t)
+	secondary := provisionAccount(t)
+	primaryEmail := "keep-" + uuid.NewString() + "@example.com"
+	secondaryEmail := "absorb-" + uuid.NewString() + "@example.com"
+	bindEmailIdentity(t, primary, primaryEmail)
+	bindEmailIdentity(t, secondary, secondaryEmail)
+
+	if err := merger.Merge(ctx, primary, secondary); err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+
+	// The primary keeps its own email; the secondary's is gone from the live identities.
+	if owner, ok, _ := store.AccountIDByIdentity(ctx, account.KindEmail, primaryEmail); !ok || owner != primary {
+		t.Errorf("primary email owner = %s ok=%v, want primary %s", owner, ok, primary)
+	}
+	if _, ok, _ := store.AccountIDByIdentity(ctx, account.KindEmail, secondaryEmail); ok {
+		t.Error("the secondary's email must be removed (no duplicate email on the survivor)")
+	}
+	// The absorbed email stays in the legal dossier, tagged reason=merge.
+	var reason string
+	if err := testDB.QueryRowContext(ctx,
+		`SELECT reason FROM backend.retained_identities WHERE account_id=$1 AND kind='email' AND external_id=$2`,
+		secondary, secondaryEmail).Scan(&reason); err != nil {
+		t.Fatalf("retained email row: %v", err)
+	}
+	if reason != "merge" {
+		t.Errorf("retained reason = %q, want merge", reason)
+	}
+}
+
 // TestAccountLinkFreeEmail binds a free email and promotes a guest to durable.
 func TestAccountLinkFreeEmail(t *testing.T) {
 	ctx := context.Background()
@@ -355,3 +393,64 @@ func TestAccountLinkGuestInversion(t *testing.T) {
 		t.Errorf("email owner = %s, want durable", owner)
 	}
 }
+
+// TestAccountLinkFreeVK binds a free VK identity (gateway-validated, no code) and
+// promotes a guest to durable — the ConfirmVK counterpart of the free-email case.
+func TestAccountLinkFreeVK(t *testing.T) {
+	ctx := context.Background()
+	store := account.NewStore(testDB)
+	links := newLinkService(&capturingMailer{})
+
+	guest := provisionGuest(t)
+	vkID := "vk-" + uuid.NewString()
+	res, err := links.ConfirmVK(ctx, guest, vkID)
+	if err != nil {
+		t.Fatalf("confirm vk: %v", err)
+	}
+	if !res.Linked || res.MergeRequired {
+		t.Fatalf("confirm = %+v, want linked", res)
+	}
+	if acc, _ := store.GetByID(ctx, guest); acc.IsGuest {
+		t.Error("guest flag should clear once VK is linked")
+	}
+	if owner, ok, _ := store.AccountIDByIdentity(ctx, account.KindVK, vkID); !ok || owner != guest {
+		t.Errorf("vk owner = %s, want the promoted guest %s", owner, guest)
+	}
+}
+
+// TestAccountLinkVKMergeIntoCaller merges the account owning a VK identity into the
+// current durable account: ConfirmVK previews the merge, MergeVK folds it, the caller
+// stays primary and keeps its session, and the VK identity repoints to the caller.
+func TestAccountLinkVKMergeIntoCaller(t *testing.T) {
+	ctx := context.Background()
+	store := account.NewStore(testDB)
+	links := newLinkService(&capturingMailer{})
+
+	caller := provisionAccount(t)
+	other := provisionAccount(t)
+	vkID := "vk-" + uuid.NewString()
+	if err := store.AttachIdentity(ctx, other, account.KindVK, vkID, true); err != nil {
+		t.Fatalf("seed vk on other: %v", err)
+	}
+
+	confirm, err := links.ConfirmVK(ctx, caller, vkID)
+	if err != nil {
+		t.Fatalf("confirm vk: %v", err)
+	}
+	if !confirm.MergeRequired || confirm.SecondaryID != other {
+		t.Fatalf("confirm = %+v, want merge_required to other %s", confirm, other)
+	}
+	merge, err := links.MergeVK(ctx, caller, vkID)
+	if err != nil {
+		t.Fatalf("merge vk: %v", err)
+	}
+	if merge.PrimaryID != caller || merge.SwitchedToken != "" {
+		t.Fatalf("merge = %+v, want primary caller and no session switch", merge)
+	}
+	if mergedInto(t, other) != caller {
+		t.Error("other should be tombstoned into caller")
+	}
+	if owner, _, _ := store.AccountIDByIdentity(ctx, account.KindVK, vkID); owner != caller {
+		t.Errorf("vk owner = %s, want caller after merge", owner)
+	}
+}

backend/internal/link/service.go

@@ -133,6 +133,53 @@ func (s *Service) attachTelegram(ctx context.Context, callerID uuid.UUID, extern
 	return s.accounts.ClearGuest(ctx, callerID)
 }
 
+// ConfirmVK attaches a gateway-validated VK identity to the caller (Linked) or
+// reports that it belongs to another account (MergeRequired). The gateway has already
+// completed the VK ID code exchange, so externalID is the trusted vk user id.
+func (s *Service) ConfirmVK(ctx context.Context, callerID uuid.UUID, externalID string) (ConfirmResult, error) {
+	owner, ok, err := s.accounts.AccountIDByIdentity(ctx, account.KindVK, externalID)
+	if err != nil {
+		return ConfirmResult{}, err
+	}
+	if !ok {
+		if err := s.attachVK(ctx, callerID, externalID); err != nil {
+			return ConfirmResult{}, err
+		}
+		return ConfirmResult{Linked: true}, nil
+	}
+	if owner == callerID {
+		return ConfirmResult{Linked: true}, nil
+	}
+	return ConfirmResult{MergeRequired: true, SecondaryID: owner}, nil
+}
+
+// MergeVK merges the account owning a gateway-validated VK identity into the caller's
+// (subject to the guest-primary rule).
+func (s *Service) MergeVK(ctx context.Context, callerID uuid.UUID, externalID string) (MergeResult, error) {
+	owner, ok, err := s.accounts.AccountIDByIdentity(ctx, account.KindVK, externalID)
+	if err != nil {
+		return MergeResult{}, err
+	}
+	if !ok {
+		if err := s.attachVK(ctx, callerID, externalID); err != nil {
+			return MergeResult{}, err
+		}
+		return MergeResult{PrimaryID: callerID}, nil
+	}
+	if owner == callerID {
+		return MergeResult{PrimaryID: callerID}, nil
+	}
+	return s.merge(ctx, callerID, owner)
+}
+
+// attachVK links the identity to the caller and promotes a guest.
+func (s *Service) attachVK(ctx context.Context, callerID uuid.UUID, externalID string) error {
+	if err := s.accounts.AttachIdentity(ctx, callerID, account.KindVK, externalID, true); err != nil {
+		return err
+	}
+	return s.accounts.ClearGuest(ctx, callerID)
+}
+
 // merge decides the primary (the caller, unless it is a guest and the other is
 // durable), runs the data merge, retires the secondary's sessions and mints a new
 // session when the active account switches.

backend/internal/postgres/jet/backend/model/ad_campaigns.go

@@ -13,13 +13,20 @@ import (
 )
 
 type AdCampaigns struct {
-	CampaignID uuid.UUID `sql:"primary_key"`
-	Name       string
-	Weight     int32
-	IsDefault  bool
-	Enabled    bool
-	StartsAt   *time.Time
-	EndsAt     *time.Time
-	CreatedAt  time.Time
-	UpdatedAt  time.Time
+	CampaignID       uuid.UUID `sql:"primary_key"`
+	Name             string
+	Weight           int32
+	IsDefault        bool
+	Enabled          bool
+	StartsAt         *time.Time
+	EndsAt           *time.Time
+	CreatedAt        time.Time
+	UpdatedAt        time.Time
+	OverrideBg       *string
+	OverrideFg       *string
+	OverrideLink     *string
+	OverrideBgDark   *string
+	OverrideFgDark   *string
+	OverrideLinkDark *string
+	Urgent           bool
 }

backend/internal/postgres/jet/backend/table/ad_campaigns.go

@@ -17,15 +17,22 @@ type adCampaignsTable struct {
 	postgres.Table
 
 	// Columns
-	CampaignID postgres.ColumnString
-	Name       postgres.ColumnString
-	Weight     postgres.ColumnInteger
-	IsDefault  postgres.ColumnBool
-	Enabled    postgres.ColumnBool
-	StartsAt   postgres.ColumnTimestampz
-	EndsAt     postgres.ColumnTimestampz
-	CreatedAt  postgres.ColumnTimestampz
-	UpdatedAt  postgres.ColumnTimestampz
+	CampaignID       postgres.ColumnString
+	Name             postgres.ColumnString
+	Weight           postgres.ColumnInteger
+	IsDefault        postgres.ColumnBool
+	Enabled          postgres.ColumnBool
+	StartsAt         postgres.ColumnTimestampz
+	EndsAt           postgres.ColumnTimestampz
+	CreatedAt        postgres.ColumnTimestampz
+	UpdatedAt        postgres.ColumnTimestampz
+	OverrideBg       postgres.ColumnString
+	OverrideFg       postgres.ColumnString
+	OverrideLink     postgres.ColumnString
+	OverrideBgDark   postgres.ColumnString
+	OverrideFgDark   postgres.ColumnString
+	OverrideLinkDark postgres.ColumnString
+	Urgent           postgres.ColumnBool
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -67,33 +74,47 @@ func newAdCampaignsTable(schemaName, tableName, alias string) *AdCampaignsTable
 
 func newAdCampaignsTableImpl(schemaName, tableName, alias string) adCampaignsTable {
 	var (
-		CampaignIDColumn = postgres.StringColumn("campaign_id")
-		NameColumn       = postgres.StringColumn("name")
-		WeightColumn     = postgres.IntegerColumn("weight")
-		IsDefaultColumn  = postgres.BoolColumn("is_default")
-		EnabledColumn    = postgres.BoolColumn("enabled")
-		StartsAtColumn   = postgres.TimestampzColumn("starts_at")
-		EndsAtColumn     = postgres.TimestampzColumn("ends_at")
-		CreatedAtColumn  = postgres.TimestampzColumn("created_at")
-		UpdatedAtColumn  = postgres.TimestampzColumn("updated_at")
-		allColumns       = postgres.ColumnList{CampaignIDColumn, NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn}
-		mutableColumns   = postgres.ColumnList{NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn}
-		defaultColumns   = postgres.ColumnList{IsDefaultColumn, EnabledColumn, CreatedAtColumn, UpdatedAtColumn}
+		CampaignIDColumn       = postgres.StringColumn("campaign_id")
+		NameColumn             = postgres.StringColumn("name")
+		WeightColumn           = postgres.IntegerColumn("weight")
+		IsDefaultColumn        = postgres.BoolColumn("is_default")
+		EnabledColumn          = postgres.BoolColumn("enabled")
+		StartsAtColumn         = postgres.TimestampzColumn("starts_at")
+		EndsAtColumn           = postgres.TimestampzColumn("ends_at")
+		CreatedAtColumn        = postgres.TimestampzColumn("created_at")
+		UpdatedAtColumn        = postgres.TimestampzColumn("updated_at")
+		OverrideBgColumn       = postgres.StringColumn("override_bg")
+		OverrideFgColumn       = postgres.StringColumn("override_fg")
+		OverrideLinkColumn     = postgres.StringColumn("override_link")
+		OverrideBgDarkColumn   = postgres.StringColumn("override_bg_dark")
+		OverrideFgDarkColumn   = postgres.StringColumn("override_fg_dark")
+		OverrideLinkDarkColumn = postgres.StringColumn("override_link_dark")
+		UrgentColumn           = postgres.BoolColumn("urgent")
+		allColumns             = postgres.ColumnList{CampaignIDColumn, NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn, OverrideBgColumn, OverrideFgColumn, OverrideLinkColumn, OverrideBgDarkColumn, OverrideFgDarkColumn, OverrideLinkDarkColumn, UrgentColumn}
+		mutableColumns         = postgres.ColumnList{NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn, OverrideBgColumn, OverrideFgColumn, OverrideLinkColumn, OverrideBgDarkColumn, OverrideFgDarkColumn, OverrideLinkDarkColumn, UrgentColumn}
+		defaultColumns         = postgres.ColumnList{IsDefaultColumn, EnabledColumn, CreatedAtColumn, UpdatedAtColumn, UrgentColumn}
 	)
 
 	return adCampaignsTable{
 		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
 
 		//Columns
-		CampaignID: CampaignIDColumn,
-		Name:       NameColumn,
-		Weight:     WeightColumn,
-		IsDefault:  IsDefaultColumn,
-		Enabled:    EnabledColumn,
-		StartsAt:   StartsAtColumn,
-		EndsAt:     EndsAtColumn,
-		CreatedAt:  CreatedAtColumn,
-		UpdatedAt:  UpdatedAtColumn,
+		CampaignID:       CampaignIDColumn,
+		Name:             NameColumn,
+		Weight:           WeightColumn,
+		IsDefault:        IsDefaultColumn,
+		Enabled:          EnabledColumn,
+		StartsAt:         StartsAtColumn,
+		EndsAt:           EndsAtColumn,
+		CreatedAt:        CreatedAtColumn,
+		UpdatedAt:        UpdatedAtColumn,
+		OverrideBg:       OverrideBgColumn,
+		OverrideFg:       OverrideFgColumn,
+		OverrideLink:     OverrideLinkColumn,
+		OverrideBgDark:   OverrideBgDarkColumn,
+		OverrideFgDark:   OverrideFgDarkColumn,
+		OverrideLinkDark: OverrideLinkDarkColumn,
+		Urgent:           UrgentColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/migrations/00008_retained_identities_merge_reason.sql

@@ -0,0 +1,22 @@
+-- Admit the 'merge' reason into retained_identities. An account merge folds a secondary
+-- account into a primary; when both hold an identity of the same kind (e.g. each has a
+-- confirmed email), the survivor keeps its own and the secondary's is journaled to the
+-- legal dossier and removed — so the survivor never ends up with two identities of one
+-- kind, and the absorbed credential is still retained. That journal row carries reason
+-- 'merge', alongside the existing unlink / change / delete.
+--
+-- Expand-contract: the Up only WIDENS the allowed reason set, so an older backend image
+-- (which writes only unlink/change/delete) still satisfies the constraint — a rollback
+-- stays DB-safe. The Down narrows it again and would reject pre-existing 'merge' rows, so
+-- it is a dev-only convenience, not a production rollback path (image rollback runs old
+-- code against this schema, not the Down migration).
+
+-- +goose Up
+ALTER TABLE backend.retained_identities DROP CONSTRAINT retained_identities_reason_chk;
+ALTER TABLE backend.retained_identities ADD CONSTRAINT retained_identities_reason_chk
+    CHECK ((reason = ANY (ARRAY['unlink'::text, 'change'::text, 'delete'::text, 'merge'::text])));
+
+-- +goose Down
+ALTER TABLE backend.retained_identities DROP CONSTRAINT retained_identities_reason_chk;
+ALTER TABLE backend.retained_identities ADD CONSTRAINT retained_identities_reason_chk
+    CHECK ((reason = ANY (ARRAY['unlink'::text, 'change'::text, 'delete'::text])));

backend/internal/postgres/migrations/00009_banner_colors_urgent.sql

@@ -0,0 +1,60 @@
+-- Per-campaign banner colour overrides and the urgent (always-show) flag.
+--
+-- ad_campaigns gains two optional colour sets and an urgent flag, all for
+-- non-default campaigns only:
+--   override_bg/fg/link           — paints the strip on every theme
+--   override_bg/fg/link_dark      — further overrides the dark theme
+--   urgent                        — force the banner on every viewer (bypassing
+--                                   eligibility) and suppress all non-urgent
+--                                   campaigns while any urgent one is active
+--
+-- Each colour set is all-or-nothing (bg+fg+link together, or absent) and every
+-- colour is a "#rrggbb" hex string. The default (house) campaign stays plain: no
+-- colours, never urgent.
+--
+-- Expand-contract: additive (nullable columns plus one NOT NULL boolean with a
+-- default), so a backend image rollback stays DB-safe — older code ignores them.
+-- The ad_campaigns table shape changes, so its generated go-jet model is
+-- regenerated (by hand here, to keep the diff to this one table).
+
+-- +goose Up
+ALTER TABLE backend.ad_campaigns
+    ADD COLUMN override_bg text,
+    ADD COLUMN override_fg text,
+    ADD COLUMN override_link text,
+    ADD COLUMN override_bg_dark text,
+    ADD COLUMN override_fg_dark text,
+    ADD COLUMN override_link_dark text,
+    ADD COLUMN urgent boolean DEFAULT false NOT NULL,
+    ADD CONSTRAINT ad_campaigns_override_all_chk CHECK (
+        (override_bg IS NULL AND override_fg IS NULL AND override_link IS NULL)
+        OR (override_bg IS NOT NULL AND override_fg IS NOT NULL AND override_link IS NOT NULL)
+    ),
+    ADD CONSTRAINT ad_campaigns_override_dark_chk CHECK (
+        (override_bg_dark IS NULL AND override_fg_dark IS NULL AND override_link_dark IS NULL)
+        OR (override_bg_dark IS NOT NULL AND override_fg_dark IS NOT NULL AND override_link_dark IS NOT NULL)
+    ),
+    ADD CONSTRAINT ad_campaigns_override_hex_chk CHECK (
+        (override_bg IS NULL OR override_bg ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_fg IS NULL OR override_fg ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_link IS NULL OR override_link ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_bg_dark IS NULL OR override_bg_dark ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_fg_dark IS NULL OR override_fg_dark ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_link_dark IS NULL OR override_link_dark ~ '^#[0-9a-fA-F]{6}$')
+    ),
+    ADD CONSTRAINT ad_campaigns_default_plain_chk CHECK (
+        (NOT is_default)
+        OR (override_bg IS NULL AND override_fg IS NULL AND override_link IS NULL
+            AND override_bg_dark IS NULL AND override_fg_dark IS NULL AND override_link_dark IS NULL
+            AND NOT urgent)
+    );
+
+-- +goose Down
+ALTER TABLE backend.ad_campaigns
+    DROP COLUMN override_bg,
+    DROP COLUMN override_fg,
+    DROP COLUMN override_link,
+    DROP COLUMN override_bg_dark,
+    DROP COLUMN override_fg_dark,
+    DROP COLUMN override_link_dark,
+    DROP COLUMN urgent;

backend/internal/server/banner.go

@@ -22,10 +22,20 @@ type bannerDTO struct {
 
 // bannerCampaignDTO is one campaign in the rotation feed: its GCD-reduced show
 // weight (for the client's smooth weighted round-robin) and its messages, in
-// display order, already resolved to one language.
+// display order, already resolved to one language. The override_* colours are
+// present only for a campaign that carries a colour override: override_bg/fg/link
+// paint every theme, and the *_dark trio further overrides the dark theme (the
+// client resolves the cascade). They are absent for a plain campaign, which keeps
+// the neutral theme tokens.
 type bannerCampaignDTO struct {
-	Weight   int      `json:"weight"`
-	Messages []string `json:"messages"`
+	Weight           int      `json:"weight"`
+	Messages         []string `json:"messages"`
+	OverrideBg       string   `json:"override_bg,omitempty"`
+	OverrideFg       string   `json:"override_fg,omitempty"`
+	OverrideLink     string   `json:"override_link,omitempty"`
+	OverrideBgDark   string   `json:"override_bg_dark,omitempty"`
+	OverrideFgDark   string   `json:"override_fg_dark,omitempty"`
+	OverrideLinkDark string   `json:"override_link_dark,omitempty"`
 }
 
 // bannerTimingsDTO mirrors ads.Timings on the wire.
@@ -83,22 +93,27 @@ func (s *Server) bannerFor(ctx context.Context, acc account.Account) *bannerDTO
 	if s.ads == nil {
 		return nil
 	}
-	hasNoBanner, err := s.accounts.HasRole(ctx, acc.ID, account.RoleNoBanner)
-	if err != nil {
-		s.log.Warn("banner: role check failed", zap.String("account", acc.ID.String()), zap.Error(err))
-		return nil
-	}
-	if !ads.Eligible(acc.PaidAccount, acc.HintBalance, hasNoBanner) {
-		return nil
-	}
-	set, timings, err := s.ads.ActiveSet(ctx, bannerLang(acc))
+	set, timings, urgent, err := s.ads.ActiveSet(ctx, bannerLang(acc))
 	if err != nil {
 		s.log.Warn("banner: active set failed", zap.String("account", acc.ID.String()), zap.Error(err))
 		return nil
 	}
+	// An urgent campaign is shown to every viewer; otherwise the normal eligibility
+	// gate applies (a paid account, a non-empty hint wallet or the no_banner role
+	// hides the banner).
+	if !urgent {
+		hasNoBanner, err := s.accounts.HasRole(ctx, acc.ID, account.RoleNoBanner)
+		if err != nil {
+			s.log.Warn("banner: role check failed", zap.String("account", acc.ID.String()), zap.Error(err))
+			return nil
+		}
+		if !ads.Eligible(acc.PaidAccount, acc.HintBalance, hasNoBanner) {
+			return nil
+		}
+	}
 	campaigns := make([]bannerCampaignDTO, 0, len(set))
 	for _, c := range set {
-		campaigns = append(campaigns, bannerCampaignDTO{Weight: c.Weight, Messages: c.Messages})
+		campaigns = append(campaigns, bannerCampaignFromActive(c))
 	}
 	return &bannerDTO{
 		Campaigns: campaigns,
@@ -113,6 +128,20 @@ func (s *Server) bannerFor(ctx context.Context, acc account.Account) *bannerDTO
 	}
 }
 
+// bannerCampaignFromActive flattens a resolved campaign into its wire DTO,
+// projecting each optional colour set into its three "#rrggbb" fields (empty when
+// the set is absent, so JSON omitempty drops them).
+func bannerCampaignFromActive(c ads.ActiveCampaign) bannerCampaignDTO {
+	d := bannerCampaignDTO{Weight: c.Weight, Messages: c.Messages}
+	if c.OverrideAll != nil {
+		d.OverrideBg, d.OverrideFg, d.OverrideLink = c.OverrideAll.Bg, c.OverrideAll.Fg, c.OverrideAll.Link
+	}
+	if c.OverrideDark != nil {
+		d.OverrideBgDark, d.OverrideFgDark, d.OverrideLinkDark = c.OverrideDark.Bg, c.OverrideDark.Fg, c.OverrideDark.Link
+	}
+	return d
+}
+
 // bannerLang resolves the message language for a viewer: their interface language
 // (Russian, or English by default).
 func bannerLang(acc account.Account) string {

backend/internal/server/handlers.go

@@ -74,6 +74,8 @@ func (s *Server) registerRoutes() {
 		u.POST("/link/email/merge", s.handleLinkEmailMerge)
 		u.POST("/link/telegram", s.handleLinkTelegram)
 		u.POST("/link/telegram/merge", s.handleLinkTelegramMerge)
+		u.POST("/link/vk", s.handleLinkVK)
+		u.POST("/link/vk/merge", s.handleLinkVKMerge)
 		u.POST("/link/unlink", s.handleUnlink)
 		// Change the account's confirmed email: mail a code to the new address, then
 		// atomically switch on confirm (a new address owned by another account is

backend/internal/server/handlers_admin_banners.go

@@ -19,6 +19,15 @@ const bannersBack = "/_gm/banners"
 // bound; the operator's entry is interpreted as UTC.
 const localTimeLayout = "2006-01-02T15:04"
 
+// Neutral banner theme tokens, mirrored from ui/src/app.css (--ad-bg,
+// --text-muted, --accent for the light and dark themes). They seed the console's
+// colour pickers and the preview fallback when a campaign has no override, so the
+// operator always edits against the real neutral colours.
+const (
+	tokenLightBg, tokenLightFg, tokenLightLink = "#e3e7ee", "#6b7280", "#2f6df6"
+	tokenDarkBg, tokenDarkFg, tokenDarkLink    = "#272f3c", "#9aa3b2", "#5b8cff"
+)
+
 // consoleBanners lists the advertising campaigns (default first), each with its
 // weight, validity window, enabled flag, message count and live-now status.
 func (s *Server) consoleBanners(c *gin.Context) {
@@ -56,14 +65,19 @@ func (s *Server) consoleBannerDetail(c *gin.Context) {
 		return
 	}
 	view := adminconsole.BannerDetailView{
-		ID:        cm.ID.String(),
-		Name:      cm.Name,
-		Weight:    cm.Weight,
-		IsDefault: cm.IsDefault,
-		Enabled:   cm.Enabled,
-		StartsAt:  localInput(cm.StartsAt),
-		EndsAt:    localInput(cm.EndsAt),
+		ID:             cm.ID.String(),
+		Name:           cm.Name,
+		Weight:         cm.Weight,
+		IsDefault:      cm.IsDefault,
+		Enabled:        cm.Enabled,
+		StartsAt:       localInput(cm.StartsAt),
+		EndsAt:         localInput(cm.EndsAt),
+		Urgent:         cm.Urgent,
+		OverrideAllOn:  cm.OverrideAll != nil,
+		OverrideDarkOn: cm.OverrideDark != nil,
 	}
+	view.AllBg, view.AllFg, view.AllLink = seedColors(cm.OverrideAll, tokenLightBg, tokenLightFg, tokenLightLink)
+	view.DarkBg, view.DarkFg, view.DarkLink = seedColors(cm.OverrideDark, tokenDarkBg, tokenDarkFg, tokenDarkLink)
 	for i, m := range cm.Messages {
 		view.Messages = append(view.Messages, adminconsole.BannerMessageRow{
 			ID:     m.ID.String(),
@@ -111,12 +125,15 @@ func (s *Server) consoleUpdateBanner(c *gin.Context) {
 		return
 	}
 	err = s.ads.UpdateCampaign(c.Request.Context(), ads.Campaign{
-		ID:       id,
-		Name:     trimForm(c, "name"),
-		Weight:   atoiForm(c, "weight"),
-		Enabled:  c.PostForm("enabled") != "",
-		StartsAt: starts,
-		EndsAt:   ends,
+		ID:           id,
+		Name:         trimForm(c, "name"),
+		Weight:       atoiForm(c, "weight"),
+		Enabled:      c.PostForm("enabled") != "",
+		StartsAt:     starts,
+		EndsAt:       ends,
+		Urgent:       c.PostForm("urgent") != "",
+		OverrideAll:  colorSetForm(c, "override_all_on", "override_bg", "override_fg", "override_link"),
+		OverrideDark: colorSetForm(c, "override_dark_on", "override_bg_dark", "override_fg_dark", "override_link_dark"),
 	})
 	if err != nil {
 		s.bannerError(c, err, back)
@@ -321,3 +338,29 @@ func atoiForm(c *gin.Context, name string) int {
 	n, _ := strconv.Atoi(trimForm(c, name))
 	return n
 }
+
+// seedColors returns the three colour-input seed values for a campaign's optional
+// override: the stored colours when the set is present, otherwise the given
+// neutral theme tokens (so the native picker starts sensibly and the preview
+// shows the real fallback).
+func seedColors(cs *ads.ColorSet, tokenBg, tokenFg, tokenLink string) (bg, fg, link string) {
+	if cs == nil {
+		return tokenBg, tokenFg, tokenLink
+	}
+	return cs.Bg, cs.Fg, cs.Link
+}
+
+// colorSetForm reads an optional colour override from the form: the on flag gates
+// it (an unchecked set is absent, nil), otherwise the three posted colours are
+// returned for the ads service to validate. The colour inputs are disabled in the
+// browser while the set is off, so they are not posted then.
+func colorSetForm(c *gin.Context, on, bg, fg, link string) *ads.ColorSet {
+	if c.PostForm(on) == "" {
+		return nil
+	}
+	return &ads.ColorSet{
+		Bg:   trimForm(c, bg),
+		Fg:   trimForm(c, fg),
+		Link: trimForm(c, link),
+	}
+}

backend/internal/server/handlers_auth.go

@@ -174,6 +174,10 @@ type emailRequest struct {
 	Email     string `json:"email"`
 	BrowserTZ string `json:"browser_tz"`
 	Language  string `json:"language"`
+	// Pwa marks a request from an installed PWA (standalone display mode): the login email then
+	// omits the one-tap confirm link so the code is typed in the same window (the link would open
+	// in a separate browser whose session cannot reach the PWA). See EmailService.RequestLoginCode.
+	Pwa bool `json:"pwa"`
 }
 
 // handleEmailRequest issues a login confirm-code to the email. It always reports
@@ -185,7 +189,7 @@ func (s *Server) handleEmailRequest(c *gin.Context) {
 		abortBadRequest(c, "email is required")
 		return
 	}
-	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ, req.Language); err != nil {
+	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ, req.Language, req.Pwa); err != nil {
 		s.abortErr(c, err)
 		return
 	}

backend/internal/server/handlers_link.go

@@ -34,6 +34,12 @@ type linkTelegramBody struct {
 	ExternalID string `json:"external_id"`
 }
 
+// linkVKBody carries a gateway-validated VK identity (the trusted vk user id the
+// gateway resolved from the VK ID code exchange).
+type linkVKBody struct {
+	ExternalID string `json:"external_id"`
+}
+
 // linkResultResponse is the unified result of a confirm or merge step. Status is
 // "linked" (bound to the caller), "merge_required" (the identity belongs to another
 // account — the secondary_* fields summarise it for the irreversible confirmation),
@@ -233,6 +239,48 @@ func (s *Server) handleLinkTelegramMerge(c *gin.Context) {
 	c.JSON(http.StatusOK, s.mergeResultResponse(c, res))
 }
 
+// handleLinkVK attaches a gateway-validated VK identity to the caller or reports a
+// required merge.
+func (s *Server) handleLinkVK(c *gin.Context) {
+	uid, ok := userID(c)
+	if !ok {
+		abortBadRequest(c, "missing identity")
+		return
+	}
+	var req linkVKBody
+	if err := c.ShouldBindJSON(&req); err != nil || req.ExternalID == "" {
+		abortBadRequest(c, "missing external_id")
+		return
+	}
+	res, err := s.links.ConfirmVK(c.Request.Context(), uid, req.ExternalID)
+	if err != nil {
+		s.abortErr(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, s.confirmResultResponse(c, uid, res))
+}
+
+// handleLinkVKMerge merges the account owning a gateway-validated VK identity into
+// the caller's.
+func (s *Server) handleLinkVKMerge(c *gin.Context) {
+	uid, ok := userID(c)
+	if !ok {
+		abortBadRequest(c, "missing identity")
+		return
+	}
+	var req linkVKBody
+	if err := c.ShouldBindJSON(&req); err != nil || req.ExternalID == "" {
+		abortBadRequest(c, "missing external_id")
+		return
+	}
+	res, err := s.links.MergeVK(c.Request.Context(), uid, req.ExternalID)
+	if err != nil {
+		s.abortErr(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, s.mergeResultResponse(c, res))
+}
+
 // confirmResultResponse renders a confirm step: a merge preview (secondary summary)
 // or a completed link (the active account's refreshed profile).
 func (s *Server) confirmResultResponse(c *gin.Context, activeID uuid.UUID, res link.ConfirmResult) linkResultResponse {

deploy/.env.example

@@ -1,6 +1,10 @@
 # Environment for deploy/docker-compose.yml. The CI deploy job (ci.yaml) maps the
 # Gitea TEST_-prefixed secrets/variables onto these unprefixed names; the prod
-# deploy maps the PROD_-prefixed set the same way. Copy to deploy/.env for a local run.
+# deploy maps the PROD_-prefixed set the same way. Values that are identical on every
+# contour (DICT_VERSION, SMTP_RELAY_HOST/PORT/TLS/USER/PASS, GRAFANA_SMTP_PORT,
+# VITE_VK_APP_LINK/ID, the two VK secrets) live as ONE unprefixed Gitea entry, and the
+# deploy derives TELEGRAM_MINIAPP_URL / GRAFANA_ROOT_URL / VITE_VK_ID_REDIRECT_URL from
+# PUBLIC_BASE_URL. Copy to deploy/.env for a local run (set the derived ones directly).
 #
 # Full reference (required vs optional, defaults, secret-vs-variable): deploy/README.md.
 
@@ -15,8 +19,9 @@ POSTGRES_PASSWORD=change-me            # required
 # boot the dawg-data volume preserves versions uploaded through the admin console and
 # the active version lives in the DB. On a live volume a changed value is ignored (the
 # recorded .seed_version marker wins — the seed-drift guard); change a running
-# contour's dictionary through /_gm/dictionary (ARCHITECTURE.md §5).
-DICT_VERSION=v1.3.0
+# contour's dictionary through /_gm/dictionary (ARCHITECTURE.md §5). One shared Gitea
+# variable (DICT_VERSION) seeds both contours + pins the CI test suite.
+DICT_VERSION=v1.3.1
 
 # --- Logging ----------------------------------------------------------------
 LOG_LEVEL=info
@@ -47,13 +52,13 @@ PUBLIC_BASE_URL=                       # required when SMTP_RELAY_HOST is set (e
 
 # Operator alerts (email). The backend emails the admin on new feedback / word complaints
 # (coalesced), and Grafana emails infra alerts. Distinct senders; recipients may be several
-# comma-separated addresses. Grafana speaks STARTTLS, so it needs the relay's STARTTLS
-# host:port (GRAFANA_SMTP_HOST) and reuses SMTP_RELAY_USER/PASS. All empty = alerts off.
+# comma-separated addresses. Grafana reuses SMTP_RELAY_HOST/USER/PASS but dials the STARTTLS
+# port (it can't do the backend's implicit TLS), GRAFANA_SMTP_PORT. All empty = off.
 SMTP_RELAY_ADMIN_FROM=                 # backend admin-alert From (e.g. alerts@erudit-game.ru)
 ADMIN_EMAIL=                           # backend admin-alert recipient(s), comma-separated
-SMTP_RELAY_SERVICE_FROM=               # Grafana alert From (e.g. grafana@erudit-game.ru)
+SMTP_RELAY_SERVICE_FROM=               # Grafana alert From; the deploy derives a bare address for Grafana (it rejects "Name" <addr>)
 SERVICE_EMAIL=                         # Grafana alert recipient(s), comma-separated
-GRAFANA_SMTP_HOST=                     # relay host:STARTTLS-port for Grafana (e.g. smtp.mail.selcloud.ru:1126)
+GRAFANA_SMTP_PORT=                     # Grafana STARTTLS port on SMTP_RELAY_HOST (Selectel: 1126)
 GF_SMTP_ENABLED=false                  # set true to enable Grafana alert emails
 
 # --- Edge / caddy -----------------------------------------------------------
@@ -68,10 +73,12 @@ VITE_TELEGRAM_BOT_ID=
 VITE_TELEGRAM_LINK=                                 # friend-invite Mini App link (full URL, e.g. https://t.me/<bot>/<app>)
 VITE_TELEGRAM_GAME_CHANNEL_NAME=                    # landing "Play in Telegram" link, the bot's game channel
 VITE_VK_APP_LINK=                                   # landing "Play on VK" link (full URL, https://vk.com/app<id>)
+VITE_VK_APP_ID=                                     # VK ID "Web" app id (client_id) for VK web-login linking; also the gateway's GATEWAY_VK_ID_APP_ID
+VITE_VK_ID_REDIRECT_URL=                            # VK ID trusted redirect URL (e.g. https://erudit-game.ru/app/); also the gateway's exchange redirect_uri. Deploy derives it as PUBLIC_BASE_URL + /app/
 VITE_GATEWAY_URL=
 
 # --- Grafana ----------------------------------------------------------------
-GRAFANA_ROOT_URL=/_gm/grafana/         # set the full https URL behind a real domain
+GRAFANA_ROOT_URL=/_gm/grafana/         # deploy derives PUBLIC_BASE_URL + /_gm/grafana/; set the full https URL for a local run
 GRAFANA_ADMIN_PASSWORD=admin
 
 # --- Telegram validator + bot -----------------------------------------------
@@ -88,7 +95,7 @@ TELEGRAM_PROMO_BOT_TOKEN=             # optional standalone promo bot token; emp
 TELEGRAM_BOT_USERNAME=               # main bot @username without the @ (promo message); required when the promo token is set
 TELEGRAM_BOT_LINK=                    # main bot Mini App link for the promo button (reuse VITE_TELEGRAM_LINK); required when the promo token is set
 TELEGRAM_PROMO_START_PARAM=           # promo button startapp payload — a variant-seed deep link (default verudit_ru-scrabble_en) adding English Scrabble for new users; empty forwards the user's /start payload
-TELEGRAM_MINIAPP_URL=                  # required
+TELEGRAM_MINIAPP_URL=                  # required; deploy derives it as PUBLIC_BASE_URL + /telegram/
 TELEGRAM_TEST_ENV=false
 TELEGRAM_API_BASE_URL=
 
@@ -97,3 +104,14 @@ TELEGRAM_API_BASE_URL=
 # launch-parameter signature in-process under it (a pure offline HMAC, no VK API call).
 # Empty disables the VK auth path (auth.vk). Set from the Gitea TEST_/PROD_ secret.
 GATEWAY_VK_APP_SECRET=
+# VK ID web login (browser VK-identity linking) — a SEPARATE VK "Web" app: the gateway runs
+# the confidential OAuth 2.1 code exchange under this protected key. The app id + redirect URL
+# come from VITE_VK_APP_ID / VITE_VK_ID_REDIRECT_URL above. All three empty disables link.vk.*.
+GATEWAY_VK_ID_CLIENT_SECRET=
+
+# --- Gateway anti-abuse ------------------------------------------------------
+# Planted honeytoken bearer value: any request presenting it is flagged — a 24h IP ban
+# where the IP ban is on (prod), logs + a ban metric otherwise (test). Plant the value
+# somewhere an attacker would find it; empty disables the trap. Gitea
+# TEST_/PROD_GATEWAY_HONEYTOKEN (secret).
+GATEWAY_HONEYTOKEN=

deploy/README.md

@@ -46,6 +46,18 @@ runs `docker compose up -d --build` on the runner host. The prod deploy maps the
 **`PROD_`** set the same way. So a Gitea secret named `TEST_POSTGRES_PASSWORD`
 feeds the compose's `POSTGRES_PASSWORD`, etc.
 
+Three naming classes in Gitea:
+- **Per-contour** (`TEST_`/`PROD_<NAME>`) — values that differ between the contours
+  (bots, hosts, public origin, log level, email senders): the common case below.
+- **Shared** (one unprefixed `<NAME>`, no prefix) — values identical on every contour,
+  stored once: `DICT_VERSION`, `SMTP_RELAY_HOST`/`PORT`/`TLS`/`USER`/`PASS`,
+  `GRAFANA_SMTP_PORT`, `VITE_VK_APP_LINK`, `VITE_VK_APP_ID`, `GATEWAY_VK_APP_SECRET`,
+  `GATEWAY_VK_ID_CLIENT_SECRET` (one Selectel relay + one pair of VK apps for all contours).
+- **Derived** — not stored at all; the deploy computes them from `PUBLIC_BASE_URL`
+  (`deploy/write-prod-env.sh`, and the `ci.yaml` deploy step): `TELEGRAM_MINIAPP_URL`
+  (`+ /telegram/`), `GRAFANA_ROOT_URL` (`+ /_gm/grafana/`), `VITE_VK_ID_REDIRECT_URL`
+  (`+ /app/`). Set them directly only for a local `.env` run.
+
 The deploy job also **seeds the config files** (`caddy`, `otelcol`, `prometheus`,
 `tempo`, `grafana`) to a stable host path (`$HOME/.scrabble-deploy`) and sets
 `SCRABBLE_CONFIG_DIR` to it before `up`. The runner's checkout is an ephemeral act
@@ -62,7 +74,7 @@ compose binds from this directory.
 | --- | --- | --- |
 | `POSTGRES_PASSWORD` | secret | Postgres password (also embedded in `BACKEND_POSTGRES_DSN`). |
 | `GM_BASICAUTH_HASH` | secret | bcrypt hash gating `/_gm` (admin console + Grafana). Generate with `docker run --rm caddy:2-alpine caddy hash-password --plaintext '<pw>'`. |
-| `TELEGRAM_MINIAPP_URL` | variable | The Mini App URL the bot hands out in deep links / buttons. |
+| `TELEGRAM_MINIAPP_URL` | derived | The Mini App URL the bot hands out in deep links / buttons. The deploy derives `PUBLIC_BASE_URL + /telegram/`; set it directly only for a local run (compose still `:?`-requires it). |
 | `EXPORT_SIGN_KEY` | secret | HMAC key signing the public finished-game export download URLs (`/dl/*`). Generate with `openssl rand -base64 32`. |
 
 **Plus the bot token** — `TELEGRAM_BOT_TOKEN` (secret), shared by the validator (HMAC
@@ -82,11 +94,11 @@ without it Docker's resolver handles `otelcol`, `gateway` and `api.telegram.org`
 | --- | --- | --- | --- |
 | `POSTGRES_DB` | variable | `scrabble` | Database name. |
 | `POSTGRES_USER` | variable | `scrabble` | Database user. |
-| `DICT_VERSION` | variable | `v1.3.0` | `scrabble-dictionary` release tag baked into the backend image as the **seed for a fresh volume** (build-arg). A live contour changes dictionary through the admin console, not this; on a seeded volume a changed value is ignored (the recorded `.seed_version` marker wins — the seed-drift guard, ARCHITECTURE.md §5). Set per contour as `TEST_`/`PROD_DICT_VERSION`. |
+| `DICT_VERSION` | variable (shared) | `v1.3.1` | `scrabble-dictionary` release tag baked into the backend image as the **seed for a fresh volume** (build-arg). A live contour changes dictionary through the admin console, not this; on a seeded volume a changed value is ignored (the recorded `.seed_version` marker wins — the seed-drift guard, ARCHITECTURE.md §5). One shared unprefixed Gitea variable seeds both contours and pins the CI test suite. |
 | `LOG_LEVEL` | variable | `info` | Shared log level for backend / gateway / validator / bot (`debug\|info\|warn\|error`). |
 | `CADDY_SITE_ADDRESS` | variable | `:80` | Caddy site address. Test: `:80` (host caddy terminates TLS). Prod: a domain, so caddy does its own ACME. |
 | `GM_BASICAUTH_USER` | variable | `gm` | Username for the `/_gm` Basic-Auth. |
-| `GRAFANA_ROOT_URL` | variable | `/_gm/grafana/` | Grafana root URL (sub-path serving). Set the full `https://<domain>/_gm/grafana/` behind a real domain. |
+| `GRAFANA_ROOT_URL` | derived | `/_gm/grafana/` | Grafana root URL (sub-path serving). The deploy derives `PUBLIC_BASE_URL + /_gm/grafana/`; set the full `https://<domain>/_gm/grafana/` only for a local run. |
 | `GRAFANA_ADMIN_PASSWORD` | secret | `admin` | Grafana admin password. Low impact (the login form is disabled, access is anonymous-admin behind caddy) but set it anyway. |
 | `TELEGRAM_GAME_CHANNEL_ID` | variable | _(empty)_ | The bot's game-channel id; empty/`0` disables channel posts. |
 | `TELEGRAM_TEST_ENV` | _pinned_ | `false` | `true` routes the bot through Telegram's test environment (`.../bot<token>/test/METHOD`). **The CI test contour pins this to `true` in `ci.yaml`** (the contour is the test environment) — it is not a Gitea variable. Set it in `.env` for a local run; prod leaves it `false`. |
@@ -94,20 +106,25 @@ without it Docker's resolver handles `otelcol`, `gateway` and `api.telegram.org`
 | `VITE_TELEGRAM_BOT_ID` | variable | _(empty)_ | UI build-arg: numeric bot id for the web Login Widget. |
 | `VITE_TELEGRAM_LINK` | variable | _(empty)_ | UI build-arg: friend-invite Mini App link (full URL, `https://t.me/<bot>/<app>` — `<app>` is the Mini App short name from BotFather). |
 | `VITE_TELEGRAM_GAME_CHANNEL_NAME` | variable | _(empty)_ | UI build-arg: the landing "Play in Telegram" link, the bot's game channel (e.g. `https://t.me/Erudit_Game`). |
-| `VITE_VK_APP_LINK` | variable | _(empty)_ | UI build-arg: the landing "Play on VK" link, the VK Mini App (full URL, `https://vk.com/app<id>`). |
+| `VITE_VK_APP_LINK` | variable (shared) | _(empty)_ | UI build-arg: the landing "Play on VK" link, the VK Mini App (full URL, `https://vk.com/app<id>`). One VK Mini App for all contours. |
+| `VITE_VK_APP_ID` | variable (shared) | _(empty)_ | VK ID "Web" app id (`client_id`) for VK web-login linking. Baked into the SPA authorize URL and reused as the gateway's `GATEWAY_VK_ID_APP_ID`. Empty disables the `link.vk.*` ops. One VK ID "Web" app for all contours. |
+| `VITE_VK_ID_REDIRECT_URL` | derived | _(empty)_ | VK ID trusted redirect URL — must match the app's registered redirect exactly. The deploy derives `PUBLIC_BASE_URL + /app/` (used by the SPA and as the gateway's exchange `redirect_uri`); set it only for a local run. |
+| `GATEWAY_VK_APP_SECRET` | secret (shared) | _(empty)_ | The VK Mini App's protected key (`client_secret`): the gateway verifies the launch-parameter signature in-process under it (offline HMAC, no VK API call). Empty disables the VK auth path (`auth.vk`). One VK Mini App for all contours. |
+| `GATEWAY_VK_ID_CLIENT_SECRET` | secret (shared) | _(empty)_ | The VK ID "Web" app's protected key (`client_secret`) for the gateway's server-side confidential code exchange. A SEPARATE VK app from `GATEWAY_VK_APP_SECRET` (the Mini App). One VK ID "Web" app for all contours. |
+| `GATEWAY_HONEYTOKEN` | secret | _(empty)_ | Planted honeytoken bearer value: presenting it earns a 24h IP ban + a high-severity alarm where the IP ban is on (prod), or logs + a `gateway_abuse_banned_total{reason="honeytoken"}` metric (test, ban off). Plant the value somewhere an attacker would find it; empty disables the trap. Per-contour `TEST_`/`PROD_GATEWAY_HONEYTOKEN`. |
 | `VITE_GATEWAY_URL` | variable | _(empty)_ | UI build-arg: gateway origin; empty = same-origin (the usual single-origin deploy). |
-| `SMTP_RELAY_HOST` | variable | _(empty)_ | Selectel SMTP relay host for confirm-code email. Empty leaves the backend on the log mailer (email disabled) — the contour still boots. One relay for every contour (limit 100 msgs / 5 min). |
-| `SMTP_RELAY_PORT` | variable | `465` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
-| `SMTP_RELAY_TLS` | variable | _(empty)_ | Transport security: `ssl` (implicit TLS) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); required for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
-| `SMTP_RELAY_USER` | secret | _(empty)_ | Relay SMTP AUTH username. |
-| `SMTP_RELAY_PASS` | secret | _(empty)_ | Relay SMTP AUTH password. |
+| `SMTP_RELAY_HOST` | variable (shared) | _(empty)_ | Selectel SMTP relay host for confirm-code email. Empty leaves the backend on the log mailer (email disabled) — the contour still boots. One relay for every contour (limit 100 msgs / 5 min). |
+| `SMTP_RELAY_PORT` | variable (shared) | `465` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
+| `SMTP_RELAY_TLS` | variable (shared) | _(empty)_ | Transport security: `ssl` (implicit TLS) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); required for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
+| `SMTP_RELAY_USER` | secret (shared) | _(empty)_ | Relay SMTP AUTH username. |
+| `SMTP_RELAY_PASS` | secret (shared) | _(empty)_ | Relay SMTP AUTH password. |
 | `SMTP_RELAY_FROM` | variable | `no-reply@localhost` | Sender address. **Must use the prod domain** (`no-reply@erudit-game.ru`) — Selectel only accepts the verified sender domain — so it is the same on every contour. |
 | `PUBLIC_BASE_URL` | variable | _(empty)_ | Canonical public https origin for links in the email (the contour's own URL, e.g. `https://erudit-game.ru`). **Required by the backend whenever `SMTP_RELAY_HOST` is set** — it is never derived from a request Host header (anti-injection). |
 | `SMTP_RELAY_ADMIN_FROM` | variable | _(empty)_ | Backend operator-alert sender (new feedback / word complaints), distinct from the confirm-code From. Empty (with `ADMIN_EMAIL`) disables the alert worker. |
 | `ADMIN_EMAIL` | variable | _(empty)_ | Backend operator-alert recipient(s); several comma-separated addresses allowed. |
 | `SMTP_RELAY_SERVICE_FROM` | variable | _(empty)_ | Grafana infra-alert sender address. |
 | `SERVICE_EMAIL` | variable | _(empty)_ | Grafana infra-alert recipient(s); comma-separated allowed (read by the provisioned contact point via `$__env{SERVICE_EMAIL}`). |
-| `GRAFANA_SMTP_HOST` | variable | _(empty)_ | Relay `host:port` on the **STARTTLS** port for Grafana (its client speaks STARTTLS, not the backend's implicit-TLS port), e.g. `smtp.mail.selcloud.ru:1126`. Reuses `SMTP_RELAY_USER`/`PASS`. |
+| `GRAFANA_SMTP_PORT` | variable (shared) | _(empty)_ | STARTTLS port Grafana dials on `SMTP_RELAY_HOST` (its client can't do the backend's implicit TLS), e.g. Selectel's `1126`. Reuses `SMTP_RELAY_HOST`/`USER`/`PASS`. |
 | `GF_SMTP_ENABLED` | variable | `false` | Set `true` to enable Grafana alert emails. |
 
 The six `VITE_*` are **build-args** baked into the gateway and landing images at
@@ -138,14 +155,13 @@ intentionally **unset** — caddy owns `/_gm` in the contour.
 
 The dictionary ships as a versioned **release artifact** (`scrabble-dawg-vX.Y.Z.tar.gz`) from
 [`scrabble-dictionary`](https://gitea.iliadenisov.ru/developer/scrabble-dictionary). The tag is
-a build-time input with **no default** in the images, so it is set in exactly two places to
-move the whole stack — change both to a new release:
+a build-time input with **no default** in the images. It is a single Gitea repo variable —
+**`DICT_VERSION`** (unprefixed, shared across contours) — so a release bump is **one edit**:
 
-1. **CI tests** — `.gitea/workflows/ci.yaml` `env.DICT_VERSION` (the unit/integration jobs
-   download that dawg).
-2. **Deploy seed** — the Gitea repo variables `TEST_DICT_VERSION` / `PROD_DICT_VERSION` (the tag
-   the deploy bakes into a **fresh** volume's image; the deploy job feeds it to `compose` as
-   `DICT_VERSION`).
+- the CI test jobs read it via `.gitea/workflows/ci.yaml`'s top-level
+  `env.DICT_VERSION: ${{ vars.DICT_VERSION }}` (the unit/integration jobs download that dawg), and
+- both deploy jobs feed the same variable to `compose` as the `DICT_VERSION` build-arg that
+  bakes a **fresh** volume's seed.
 
 For local builds set `DICT_VERSION` in `deploy/.env` (template: `.env.example`); a bare
 `docker build` needs `--build-arg DICT_VERSION=vX.Y.Z`. The Dockerfiles and `compose` carry no
@@ -174,6 +190,16 @@ public site. After `master` is green this workflow is the **only** thing that to
 prod — nothing auto-deploys there. It runs four visible jobs: **build → deploy-main →
 deploy-bot → verify** (the per-service rolling shows in the deploy-main log).
 
+**Maintenance page.** During the roll (and any migration window) `prod-deploy.sh` raises a
+flag the edge caddy serves a static 503 "технические работы" page from
+(`deploy/caddy/maintenance.html`), for the user-facing routes only — `/_gm` (Grafana) stays
+reachable. The flag is cleared on any exit (success, a health failure + rollback, or an
+error) by a shell trap, so it can never stick on. It arms from this feature's own deploy
+onward (the caddy carrying the gate must be live first). This is **not** a zero-downtime
+deploy — the backend is a single stateful instance (in-memory game state + push hub, no
+Redis), so its swap still blips (clients auto-reconnect the live stream); the page just
+makes the window graceful instead of raw 502s.
+
 **Versioning.** Each release is a git tag `vX.Y.Z` on `master`; the deploy stamps
 `git describe --tags` into every image tag, every binary (`-ldflags` → `pkg/version` →
 the `service.version` telemetry attribute) and the SPA About screen. Tag the release
@@ -206,20 +232,31 @@ together with the fresh CA.
 **Sizing / monitoring:** the main host launches undersized (2 vCPU / 1.9 GiB); the prod
 overlay trims limits + `GOMAXPROCS=2` + 7d Prometheus retention, and `node_exporter` feeds
 host memory to Grafana (`/_gm/grafana/`). Watch host memory and resize at Selectel when
-players arrive.
+players arrive. The per-container memory caps are enforced (Compose v2 → cgroup), so no one
+service can eat all RAM, but they **overcommit** the host (~2.8 GiB of caps vs 1.9 GiB) — a
+**1 GiB swap file** (Ansible `common` role, `swap_size`, `vm.swappiness=10`) cushions a
+simultaneous spike into swap instead of the kernel OOM-killer. The `host_mem_low` Grafana
+alert fires under 10% available.
 
-**`PROD_` Gitea set** (mirrors `TEST_`, mapped onto the unprefixed names above) — secrets:
+**Shared Gitea set** (one unprefixed entry each, used by every contour) — secrets:
+`GATEWAY_VK_APP_SECRET, GATEWAY_VK_ID_CLIENT_SECRET, SMTP_RELAY_USER, SMTP_RELAY_PASS`;
+variables: `DICT_VERSION, SMTP_RELAY_HOST, SMTP_RELAY_PORT, SMTP_RELAY_TLS, GRAFANA_SMTP_PORT,
+VITE_VK_APP_LINK, VITE_VK_APP_ID`. **Derived from `PUBLIC_BASE_URL` at deploy** (not stored):
+`TELEGRAM_MINIAPP_URL, GRAFANA_ROOT_URL, VITE_VK_ID_REDIRECT_URL`.
+
+**`PROD_` Gitea set** (per-contour, mirrors `TEST_`, mapped onto the unprefixed names above)
+— secrets:
 `PROD_{POSTGRES_PASSWORD, GM_BASICAUTH_HASH, GRAFANA_ADMIN_PASSWORD, TELEGRAM_BOT_TOKEN,
-TELEGRAM_PROMO_BOT_TOKEN, EXPORT_SIGN_KEY, REGISTRY_PASSWORD, SSH_KEY, SSH_KNOWN_HOSTS, BOTLINK_CA,
-BOTLINK_GATEWAY_CERT, BOTLINK_GATEWAY_KEY, BOTLINK_BOT_CERT, BOTLINK_BOT_KEY,
-SMTP_RELAY_USER, SMTP_RELAY_PASS}`; variables:
-`PROD_{REGISTRY_USER, MAIN_HOST, TG_HOST, CADDY_SITE_ADDRESS, GM_BASICAUTH_USER,
-GRAFANA_ROOT_URL, LOG_LEVEL, DICT_VERSION, TELEGRAM_MINIAPP_URL, TELEGRAM_GAME_CHANNEL_ID,
-TELEGRAM_CHAT_ID, TELEGRAM_BOT_USERNAME, VITE_TELEGRAM_BOT_ID, VITE_TELEGRAM_LINK,
-VITE_TELEGRAM_GAME_CHANNEL_NAME, VITE_VK_APP_LINK,
-SMTP_RELAY_HOST, SMTP_RELAY_PORT, SMTP_RELAY_TLS, SMTP_RELAY_FROM, PUBLIC_BASE_URL,
-SMTP_RELAY_ADMIN_FROM, ADMIN_EMAIL, SMTP_RELAY_SERVICE_FROM, SERVICE_EMAIL, GRAFANA_SMTP_HOST,
-GF_SMTP_ENABLED}`.
+TELEGRAM_PROMO_BOT_TOKEN, EXPORT_SIGN_KEY, GATEWAY_HONEYTOKEN, REGISTRY_PASSWORD, SSH_KEY,
+SSH_KNOWN_HOSTS, BOTLINK_CA, BOTLINK_GATEWAY_CERT, BOTLINK_GATEWAY_KEY, BOTLINK_BOT_CERT,
+BOTLINK_BOT_KEY}`; variables:
+`PROD_{REGISTRY_USER, MAIN_HOST, TG_HOST, CADDY_SITE_ADDRESS, GM_BASICAUTH_USER, LOG_LEVEL,
+TELEGRAM_GAME_CHANNEL_ID, TELEGRAM_CHAT_ID, TELEGRAM_SUPPORT_CHAT_ID, TELEGRAM_BOT_USERNAME,
+VITE_TELEGRAM_BOT_ID, VITE_TELEGRAM_LINK, VITE_TELEGRAM_GAME_CHANNEL_NAME, SMTP_RELAY_FROM,
+PUBLIC_BASE_URL, SMTP_RELAY_ADMIN_FROM, ADMIN_EMAIL, SMTP_RELAY_SERVICE_FROM, SERVICE_EMAIL,
+GF_SMTP_ENABLED}`. The test contour uses the same names under `TEST_`, minus the prod-only
+infra (`MAIN_HOST`/`TG_HOST`/`REGISTRY_*`/`SSH_*`/`BOTLINK_*`, which the test deploy generates
+or runs locally) and plus `TEST_AWG_CONF` (the bot's VPN egress).
 
 ## Host-side setup (outside this repo)
 

deploy/ansible/group_vars/all.yml

@@ -19,3 +19,11 @@ scrabble_base_dir: /opt/scrabble
 # the host's own containers (and any ad-hoc runs) rotate identically.
 docker_log_max_size: "10m"
 docker_log_max_file: "3"
+
+# Swap file as an OOM cushion. The per-container memory caps (docker-compose.prod.yml)
+# sum to more than the tight main host's RAM (2 vCPU / 1.9 GiB), so a simultaneous
+# spike could otherwise hit the kernel OOM-killer and it might pick postgres. A small
+# swap absorbs the overshoot; swappiness stays low so swap is a cushion, not a hot
+# path (a slow service beats a killed one). Set swap_size to "0" to skip provisioning.
+swap_size: "1G"
+swap_swappiness: 10

deploy/ansible/roles/common/tasks/main.yml

@@ -150,6 +150,57 @@
     enabled: true
     state: started
 
+# --- Swap file (OOM cushion) ---------------------------------------------------
+# The prod main host is tight (1.9 GiB) and the per-container memory caps
+# (docker-compose.prod.yml) sum to more than RAM, so a simultaneous spike could hit
+# the kernel OOM-killer (which might pick postgres). A small swap absorbs the
+# overshoot. Idempotent; skipped when swap_size == "0". Builtin-only (no ansible.posix).
+
+- name: Check whether the swap file is already active
+  ansible.builtin.command: swapon --show=NAME --noheadings
+  register: swap_active
+  changed_when: false
+  when: swap_size != "0"
+
+- name: Allocate the swap file
+  ansible.builtin.command:
+    cmd: "fallocate -l {{ swap_size }} /swapfile"
+    creates: /swapfile
+  when: swap_size != "0" and '/swapfile' not in swap_active.stdout
+
+- name: Secure the swap file (0600)
+  ansible.builtin.file:
+    path: /swapfile
+    owner: root
+    group: root
+    mode: "0600"
+  when: swap_size != "0"
+
+- name: Format and enable the swap file
+  ansible.builtin.shell: "mkswap /swapfile && swapon /swapfile"
+  when: swap_size != "0" and '/swapfile' not in swap_active.stdout
+
+- name: Persist the swap file in /etc/fstab
+  ansible.builtin.lineinfile:
+    path: /etc/fstab
+    line: "/swapfile none swap sw 0 0"
+    regexp: '^/swapfile\s'
+    state: present
+  when: swap_size != "0"
+
+- name: Keep swap a cushion, not a hot path (low swappiness)
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/60-scrabble-swap.conf
+    mode: "0644"
+    content: "vm.swappiness = {{ swap_swappiness }}\n"
+  register: swappiness_conf
+  when: swap_size != "0"
+
+- name: Apply swappiness now
+  ansible.builtin.command: sysctl --system
+  changed_when: false
+  when: swap_size != "0" and swappiness_conf is changed
+
 # --- Deploy directories --------------------------------------------------------
 
 - name: Create the scrabble base directories

deploy/caddy/Caddyfile

@@ -33,6 +33,39 @@
 	# is the prod fix. Background + alternatives (incl. serving h3 for real): docs/EDGE_HTTP3.md.
 	header Alt-Svc clear
 
+	# Maintenance gate. While the deploy holds the flag file /srv/maint/on (touched by
+	# prod-deploy.sh around a rolling swap, removed on the script's exit), serve a static
+	# 503 "works in progress" page instead of proxying to a mid-recreate upstream —
+	# a graceful signal rather than raw 502s. Operator surfaces (/_gm) are excluded so
+	# Grafana stays reachable during the window. Caddy stat()s the flag per request, so
+	# toggling it needs no reload; the page + flag live in the caddy config dir bind-mounted
+	# read-only at /srv/maint (docker-compose.yml). The test contour never sets the flag
+	# (only prod-deploy.sh does), so this is inert there.
+	@maintenance {
+		not path /_gm /_gm/*
+		file {
+			root /srv/maint
+			try_files on
+		}
+	}
+	handle @maintenance {
+		error 503
+	}
+	handle_errors {
+		@maint503 expression {err.status_code} == 503
+		handle @maint503 {
+			root * /srv/maint
+			rewrite * /maintenance.html
+			header Retry-After 120
+			# Distinctive maintenance marker so the SPA can tell a planned window apart from
+			# a transient upstream 503 and show its own dimmed overlay (an in-session user
+			# never sees this static page — it only renders on a fresh load). The header
+			# rides every gated response, incl. the Connect/gRPC edge the app polls.
+			header X-Scrabble-Maintenance 1
+			file_server
+		}
+	}
+
 	# Operator surfaces under /_gm: a single shared Basic-Auth, then route.
 	@gm path /_gm /_gm/*
 	handle @gm {
@@ -53,7 +86,7 @@
 	# The game SPA and the Connect edge are served by the gateway. Strip any
 	# client-supplied X-Scrabble-Honeypot here so the gateway only ever honours the
 	# tag the honeypot block sets below (a client cannot self-tag a real request).
-	@gateway path /app /app/* /telegram /telegram/* /vk /vk/* /dict/* /dl/* /metrics/* /scrabble.edge.v1.Gateway/*
+	@gateway path /app /app/* /telegram /telegram/* /vk /vk/* /dict/* /dl/* /metrics/* /telemetry/* /scrabble.edge.v1.Gateway/*
 	handle @gateway {
 		reverse_proxy gateway:8081 {
 			header_up -X-Scrabble-Honeypot

deploy/caddy/maintenance.html

@@ -0,0 +1,44 @@
+<!doctype html>
+<!--
+  Served with 503 by the edge caddy while the deploy holds the maintenance flag
+  (/srv/maint/on, toggled by deploy/prod-deploy.sh around a rolling swap). Static and
+  self-contained (no upstream, no external assets) so it renders while the backend /
+  gateway are mid-recreate.
+-->
+<html lang="ru">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="robots" content="noindex">
+  <title>Эрудит — технические работы</title>
+  <style>
+    :root { color-scheme: light dark; }
+    html, body { height: 100%; margin: 0; }
+    body {
+      display: flex; align-items: center; justify-content: center;
+      font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+      background: #f4f1ea; color: #2b2b2b;
+      padding: 24px; box-sizing: border-box;
+    }
+    @media (prefers-color-scheme: dark) { body { background: #1d1b17; color: #e8e4da; } }
+    .card { max-width: 30rem; text-align: center; line-height: 1.5; }
+    .tile {
+      display: inline-block; width: 3.5rem; height: 3.5rem; line-height: 3.5rem;
+      font-size: 2rem; font-weight: 700; border-radius: 10px;
+      background: #d9b451; color: #2b2b2b; box-shadow: 0 2px 4px rgba(0,0,0,.25);
+      margin-bottom: 1.25rem;
+    }
+    h1 { font-size: 1.4rem; margin: 0 0 .5rem; }
+    p { margin: .35rem 0; }
+    .en { opacity: .7; font-size: .95rem; }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <div class="tile">Э</div>
+    <h1>Технические работы</h1>
+    <p>Идёт короткое обновление игры. Мы скоро вернёмся — обновите страницу через пару минут.</p>
+    <p class="en">Scrabble is briefly down for an update. Please refresh in a couple of minutes.</p>
+  </main>
+</body>
+</html>

deploy/docker-compose.yml

@@ -190,6 +190,8 @@ services:
         VITE_TELEGRAM_LINK: ${VITE_TELEGRAM_LINK:-}
         VITE_TELEGRAM_GAME_CHANNEL_NAME: ${VITE_TELEGRAM_GAME_CHANNEL_NAME:-}
         VITE_VK_APP_LINK: ${VITE_VK_APP_LINK:-}
+        VITE_VK_APP_ID: ${VITE_VK_APP_ID:-}
+        VITE_VK_ID_REDIRECT_URL: ${VITE_VK_ID_REDIRECT_URL:-}
         VITE_GATEWAY_URL: ${VITE_GATEWAY_URL:-}
         VITE_APP_VERSION: ${APP_VERSION:-dev}
         # Go binary version (the SPA's VITE_APP_VERSION is the same git tag).
@@ -207,6 +209,14 @@ services:
       # app's protected key (a pure offline HMAC, no VK API round-trip). Empty disables
       # the VK auth path (auth.vk is then unregistered).
       GATEWAY_VK_APP_SECRET: ${GATEWAY_VK_APP_SECRET:-}
+      # VK ID web login (browser VK-identity linking): the confidential OAuth 2.1 code
+      # exchange runs server-side under the VK ID "Web" app's protected key. This is a
+      # SEPARATE VK app from the Mini App above, so the credentials are distinct. The app id
+      # and redirect URL are the same values the SPA builds its authorize URL from (one
+      # source each). All three empty disables the link.vk.* ops.
+      GATEWAY_VK_ID_APP_ID: ${VITE_VK_APP_ID:-}
+      GATEWAY_VK_ID_CLIENT_SECRET: ${GATEWAY_VK_ID_CLIENT_SECRET:-}
+      GATEWAY_VK_ID_REDIRECT_URL: ${VITE_VK_ID_REDIRECT_URL:-}
       # The reverse bot-link: the bot dials :9443 over mTLS; the backend admin relay
       # reaches the gateway at :9092 (plaintext, internal). In the test contour both
       # listeners stay on the internal network (the bot shares the VPN netns); in prod
@@ -217,10 +227,12 @@ services:
       GATEWAY_BOTLINK_TLS_KEY: /certs/gateway.key
       GATEWAY_BOTLINK_TLS_CA: /certs/ca.crt
       # Anti-abuse IP ban (fail2ban-style), fed by rate-limit rejections and the
-      # honeypot/honeytoken. Off by default: it bans by client IP, which is only
-      # real in prod — the test contour arrives as one shared NAT address, so a ban
-      # there would be self-inflicted (the honeypot/honeytoken still log). Prod sets
-      # these from PROD_ inputs; GATEWAY_HONEYTOKEN is the planted bearer trap.
+      # honeypot/honeytoken. Off by default: it bans by client IP, which is only real
+      # in prod — the test contour arrives as one shared NAT address, so a ban there
+      # would be self-inflicted (the honeypot still logs). The prod deploy forces it on
+      # in env.sh (deploy/write-prod-env.sh), not via a Gitea variable. GATEWAY_HONEYTOKEN
+      # is the planted bearer trap, fed from the per-contour TEST_/PROD_GATEWAY_HONEYTOKEN
+      # secret; empty (unset secret) leaves the trap off.
       GATEWAY_ABUSE_BAN_ENABLED: ${GATEWAY_ABUSE_BAN_ENABLED:-false}
       GATEWAY_HONEYTOKEN: ${GATEWAY_HONEYTOKEN:-}
       GATEWAY_LOG_LEVEL: ${LOG_LEVEL:-info}
@@ -264,6 +276,8 @@ services:
         VITE_TELEGRAM_LINK: ${VITE_TELEGRAM_LINK:-}
         VITE_TELEGRAM_GAME_CHANNEL_NAME: ${VITE_TELEGRAM_GAME_CHANNEL_NAME:-}
         VITE_VK_APP_LINK: ${VITE_VK_APP_LINK:-}
+        VITE_VK_APP_ID: ${VITE_VK_APP_ID:-}
+        VITE_VK_ID_REDIRECT_URL: ${VITE_VK_ID_REDIRECT_URL:-}
         VITE_GATEWAY_URL: ${VITE_GATEWAY_URL:-}
         VITE_APP_VERSION: ${APP_VERSION:-dev}
     restart: unless-stopped
@@ -414,6 +428,11 @@ services:
       GM_BASICAUTH_HASH: ${GM_BASICAUTH_HASH:?set GM_BASICAUTH_HASH}
     volumes:
       - ${SCRABBLE_CONFIG_DIR:-.}/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      # Maintenance page + toggle flag: the caddy config dir holds maintenance.html and the
+      # `on` flag prod-deploy.sh touches around a rolling swap; the Caddyfile serves a 503
+      # from here while the flag exists (read-only mount — the deploy writes the flag on the
+      # host side). See deploy/caddy/Caddyfile and deploy/prod-deploy.sh.
+      - ${SCRABBLE_CONFIG_DIR:-.}/caddy:/srv/maint:ro
       - caddy-data:/data
     deploy:
       resources:
@@ -501,14 +520,17 @@ services:
       # caddy's Basic-Auth and re-prompts for the password on every dashboard; the
       # dashboards poll and do not need Live.
       GF_LIVE_MAX_CONNECTIONS: "0"
-      # SMTP for alert emails, reusing the shared relay credentials on its STARTTLS host:port
-      # (GRAFANA_SMTP_HOST — Grafana's client speaks STARTTLS, not the backend's implicit-TLS
-      # port), the SERVICE From, and the SERVICE recipient. Disabled unless GF_SMTP_ENABLED.
+      # SMTP for alert emails, reusing the shared relay host + credentials + the SERVICE
+      # From/recipient. Grafana's client speaks STARTTLS (not the backend's implicit-TLS
+      # port), so it dials the relay host on its STARTTLS port (GRAFANA_SMTP_PORT).
+      # Disabled unless GF_SMTP_ENABLED.
       GF_SMTP_ENABLED: ${GF_SMTP_ENABLED:-false}
-      GF_SMTP_HOST: ${GRAFANA_SMTP_HOST:-}
+      GF_SMTP_HOST: ${SMTP_RELAY_HOST:-}:${GRAFANA_SMTP_PORT:-}
       GF_SMTP_USER: ${SMTP_RELAY_USER:-}
       GF_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-}
-      GF_SMTP_FROM_ADDRESS: ${SMTP_RELAY_SERVICE_FROM:-}
+      # A BARE address (Grafana rejects the "Name" <addr> form); the deploy derives it from
+      # SMTP_RELAY_SERVICE_FROM, splitting off the display name into GRAFANA_SMTP_FROM_NAME.
+      GF_SMTP_FROM_ADDRESS: ${GRAFANA_SMTP_FROM_ADDRESS:-}
       GF_SMTP_FROM_NAME: ${GRAFANA_SMTP_FROM_NAME:-Erudit Alerts}
       GF_SMTP_STARTTLS_POLICY: MandatoryStartTLS
       # The alert recipient(s), read by the provisioned contact point via $__env{SERVICE_EMAIL}.

deploy/grafana/dashboards/users.json

@@ -56,6 +56,22 @@
       "gridPos": { "h": 8, "w": 24, "x": 0, "y": 24 },
       "datasource": { "type": "prometheus", "uid": "prometheus" },
       "targets": [{ "refId": "A", "expr": "sum(rate(local_eval_preview_total[1h])) by (path)", "legendFormat": "{{path}}" }]
+    },
+    {
+      "type": "timeseries",
+      "title": "Unsupported-engine screens (cumulative by reason)",
+      "description": "Clients turned away by the index.html boot guard because the engine cannot run the app (an old Android System WebView), by reason: no_bigint / no_proxy (a missing unpolyfillable primitive) or boot_error (an uncaught startup failure). Deduped per device/version, so this counts distinct blocked installs, not launches. The effective floor is Chrome 67 (BigInt).",
+      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 32 },
+      "datasource": { "type": "prometheus", "uid": "prometheus" },
+      "targets": [{ "refId": "A", "expr": "sum(unsupported_engine_total) by (reason)", "legendFormat": "{{reason}}" }]
+    },
+    {
+      "type": "timeseries",
+      "title": "Unsupported engines by Chromium (rate)",
+      "description": "The same blocked clients by reported Chromium major version — which old in-app WebViews are still in the wild. \"other\" is an unparseable or out-of-range version.",
+      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 32 },
+      "datasource": { "type": "prometheus", "uid": "prometheus" },
+      "targets": [{ "refId": "A", "expr": "sum(rate(unsupported_engine_total[1h])) by (chromium)", "legendFormat": "Chromium {{chromium}}" }]
     }
   ]
 }

deploy/prod-deploy.sh

@@ -42,6 +42,15 @@ PREV_STATE_FILE="${PREV_STATE_FILE:-/opt/scrabble/PREVIOUS_TAG}"
 PG_USER="${POSTGRES_USER:-scrabble}"
 PG_DB="${POSTGRES_DB:-scrabble}"
 
+# Edge maintenance page. caddy serves a static 503 "works in progress" page for the
+# user-facing routes while this flag file exists (deploy/caddy/Caddyfile). We hold it
+# across the roll / migration window and clear it on ANY exit — success, a health
+# failure + rollback, or an unexpected error — via the trap, so users get a graceful
+# page instead of raw mid-swap 502s and the flag can never get stuck on.
+MAINT_FLAG="${MAINT_FLAG:-${SCRABBLE_CONFIG_DIR:-/opt/scrabble}/caddy/on}"
+maint_off() { rm -f "$MAINT_FLAG" 2>/dev/null || true; }
+trap maint_off EXIT
+
 cd "$COMPOSE_DIR" || { echo "compose dir $COMPOSE_DIR missing"; exit 1; }
 export REGISTRY
 # otelcol joins the host docker group to read the socket; the GID varies per host.
@@ -119,6 +128,13 @@ if [ -z "$(docker ps -aq -f name=scrabble-backend)" ]; then
   exit 0
 fi
 
+# Existing stack: raise the maintenance page for the whole roll (and any migration
+# window). It shows once caddy carries the gate (from this feature's own deploy
+# onward); the EXIT trap lowers it however this run ends.
+mkdir -p "$(dirname "$MAINT_FLAG")"
+: > "$MAINT_FLAG"
+echo "maintenance page raised ($MAINT_FLAG)"
+
 # Migration deploy: freeze writes and snapshot a consistent dump before migrating.
 if [ "$MIGRATION" = 1 ]; then
   echo "migration deploy: opening maintenance window (stopping the backend = the only writer)"

deploy/write-prod-bot-env.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Render the prod bot-host env.bot.sh from the workflow job environment.
+#
+# Sourced identically by prod-deploy (deploy-bot) and prod-rollback
+# (rollback-bot) so the two paths cannot drift (see deploy/write-prod-env.sh
+# for the same rationale on the main host).
+#
+# Usage:  BOT_IMAGE=<image ref> bash deploy/write-prod-bot-env.sh <out-path>
+#
+# Every other value comes from the caller's environment (the job `env:` block).
+out="${1:?usage: write-prod-bot-env.sh <out-path>}"
+
+# The bot's Mini App URL is the same public origin the SPA serves; derive it
+# rather than storing a second copy.
+base="${PUBLIC_BASE_URL%/}"
+TELEGRAM_MINIAPP_URL="$base/telegram/"
+
+cat > "$out" <<EOF
+export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+export BOT_IMAGE='$BOT_IMAGE'
+export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
+export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
+export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
+export TELEGRAM_SUPPORT_CHAT_ID='$TELEGRAM_SUPPORT_CHAT_ID'
+export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
+export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
+export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
+export LOG_LEVEL='${LOG_LEVEL:-info}'
+EOF

deploy/write-prod-env.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Render the prod main-host runtime env.sh from the workflow job environment.
+#
+# Sourced identically by prod-deploy (deploy-main) and prod-rollback
+# (rollback-main) so the two paths cannot drift: a rollback recreates the
+# containers, so it must re-render the SAME runtime env a full deploy does —
+# otherwise transactional email, VK login and Grafana alerts silently go dark
+# after a rollback until the next full deploy.
+#
+# Usage:  APP_VERSION=<tag> bash deploy/write-prod-env.sh <out-path>
+#
+# Every other value comes from the caller's environment (the job `env:` block,
+# vars.* / secrets.*). Mirrors the compose interpolation contract in
+# deploy/.env.example; keep in sync with deploy/docker-compose{,.prod}.yml.
+out="${1:?usage: write-prod-env.sh <out-path>}"
+
+# Derive the public URLs from the one canonical origin instead of storing each
+# under its own variable. The path suffixes are structural (SPA routes / the
+# Caddy /_gm sub-path), identical on every contour.
+base="${PUBLIC_BASE_URL%/}"
+TELEGRAM_MINIAPP_URL="$base/telegram/"
+GRAFANA_ROOT_URL="$base/_gm/grafana/"
+VITE_VK_ID_REDIRECT_URL="$base/app/"
+
+# Grafana needs a BARE from-address (it rejects the "Name" <addr> form the backend
+# go-mail accepts, and validates it even when SMTP is disabled — a bad value
+# crash-loops Grafana). Split the display-format SERVICE From into address + name;
+# the backend keeps the full form.
+svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+GRAFANA_SMTP_FROM_NAME=''
+case "$svc_from" in
+  *"<"*">"*)
+    GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+    GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+  *) GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+esac
+
+cat > "$out" <<EOF
+export REGISTRY='$REGISTRY'
+export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
+export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
+export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
+export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
+export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
+export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
+export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
+export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
+export LOG_LEVEL='${LOG_LEVEL:-info}'
+export DICT_VERSION='$DICT_VERSION'
+export APP_VERSION='$APP_VERSION'
+export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+export GATEWAY_VK_APP_SECRET='$GATEWAY_VK_APP_SECRET'
+export VITE_VK_APP_ID='$VITE_VK_APP_ID'
+export VITE_VK_ID_REDIRECT_URL='$VITE_VK_ID_REDIRECT_URL'
+export GATEWAY_VK_ID_CLIENT_SECRET='$GATEWAY_VK_ID_CLIENT_SECRET'
+export EXPORT_SIGN_KEY='$EXPORT_SIGN_KEY'
+export SMTP_RELAY_HOST='$SMTP_RELAY_HOST'
+export SMTP_RELAY_PORT='$SMTP_RELAY_PORT'
+export SMTP_RELAY_TLS='$SMTP_RELAY_TLS'
+export SMTP_RELAY_USER='$SMTP_RELAY_USER'
+export SMTP_RELAY_PASS='$SMTP_RELAY_PASS'
+export SMTP_RELAY_FROM='$SMTP_RELAY_FROM'
+export SMTP_RELAY_ADMIN_FROM='$SMTP_RELAY_ADMIN_FROM'
+export ADMIN_EMAIL='$ADMIN_EMAIL'
+export SMTP_RELAY_SERVICE_FROM='$SMTP_RELAY_SERVICE_FROM'
+export GRAFANA_SMTP_FROM_ADDRESS='$GRAFANA_SMTP_FROM_ADDRESS'
+export GRAFANA_SMTP_FROM_NAME='$GRAFANA_SMTP_FROM_NAME'
+export SERVICE_EMAIL='$SERVICE_EMAIL'
+export GRAFANA_SMTP_PORT='$GRAFANA_SMTP_PORT'
+export GF_SMTP_ENABLED='$GF_SMTP_ENABLED'
+export PUBLIC_BASE_URL='$PUBLIC_BASE_URL'
+export GATEWAY_HONEYTOKEN='$GATEWAY_HONEYTOKEN'
+export GATEWAY_ABUSE_BAN_ENABLED='true'
+EOF

docs/ARCHITECTURE.md

@@ -244,7 +244,9 @@ arrive from a platform rather than completing a mandatory registration).
   256-bit token stored only as its SHA-256, 12-hour TTL): a login mints a session in the
   browser that opens it (magic-link), a link confirms the identity and emits a `notify`
   profile-refresh to the in-app session, a change switches the account's email in place,
-  and a would-be merge is deferred to the interactive flow. The confirm runs on load; the token rides the URL fragment (never
+  and a would-be merge is deferred to the interactive flow. A login requested from an installed **PWA** omits the deeplink
+  entirely — its email carries the code only, typed in the same window, since the link would open
+  in a separate browser whose minted session cannot reach the PWA. The confirm runs on load; the token rides the URL fragment (never
   sent to the server), so a plain link prefetch cannot reach it, and the manual
   six-digit code is the fallback if an aggressive scanner runs the page. An
   **email-login** account is created flagged `is_guest` and stays reapable until the
@@ -257,11 +259,19 @@ arrive from a platform rather than completing a mandatory registration).
   control of the identity before attaching it: **email** through the confirm-code
   flow, **Telegram** through the web **Login Widget** (validated by the validator,
   HMAC under `SHA-256(bot_token)` — distinct from Mini App initData; the gateway
-  passes the trusted `external_id` to the backend, as for `auth.telegram`). The
+  passes the trusted `external_id` to the backend, as for `auth.telegram`), and **VK**
+  through **VK ID web login** (`gateway/internal/vkid`): the browser runs the VK ID raw
+  OAuth 2.1 flow with PKCE — a full-page redirect to VK's hosted login, no `@vkid/sdk` —
+  and the gateway completes the **confidential code exchange** server-side under the VK
+  "Web" app's protected key (a distinct VK app from the Mini App) to obtain the trusted
+  `external_id`. A browser has no signed launch parameters, so unlike the VK Mini App
+  (offline HMAC, §12) this makes an outbound call to `id.vk.com`, and it is web-only — a
+  full-page redirect would strand a native Mini App webview. The
   request step **always** sends/accepts the proof (no pre-send "already taken"
   signal, so a probe cannot enumerate registered addresses); a required **merge**
   is revealed **only after** the proof is verified and is performed behind an
-  explicit, irreversible confirmation. A free identity is simply attached (and a
+  explicit, irreversible confirmation (for VK, whose authorization code is single-use,
+  the merge re-authorizes for a fresh code). A free identity is simply attached (and a
   guest is promoted to durable, clearing `is_guest`).
 - **Unlink** detaches a platform identity (`telegram`/`vk`) from the profile. The
   backend **refuses removing the last identity** (`ErrLastIdentity`), so an account
@@ -284,8 +294,11 @@ arrive from a platform rather than completing a mandatory registration).
   invitations / friend-codes / drafts / pending-codes. **Chat, feedback and complaints are
   kept.** The orchestration a layer up resigns the account's active games (so opponents are
   not stranded), **drops its all-robot games** (no human opponent; children cascade), and
-  revokes its sessions. Every credential detachment — **unlink, email change and delete** —
-  writes a `retained_identities` row (`reason`), so the dossier keeps the full timeline.
+  revokes its sessions. Every credential detachment — **unlink, email change, delete and a
+  merge collision** — writes a `retained_identities` row (`reason`), so the dossier keeps the
+  full timeline. (A merge that would otherwise leave the survivor with two identities of one
+  kind — e.g. each account held a confirmed email — keeps the primary's and journals the
+  secondary's with `reason=merge` before dropping it.)
   Step-up is a mailed code (`purpose=delete`, no deeplink — a stray click must not delete;
   `ConfirmByToken` refuses a delete token) for an email account, else a typed phrase.
   `last_login_at` / `last_login_ip` are stamped on the cold-load profile fetch (throttled
@@ -969,10 +982,25 @@ edge-pause, scroll speed, and the fade-out → gap → fade-in transition) are o
 eligibility inputs (grants hints, grants/revokes `no_banner`; a future payment flow sets
 `paid_account`), the backend emits a `notify` **`banner`** sub-kind (a payload-free re-poll signal),
 and the open client re-fetches `profile.get` to show or hide the banner in place. Operator *content*
-edits take effect on the next `profile.get` (open/reconnect/foreground), not mid-session. The same
+edits take effect on the next `profile.get` (open/reconnect/foreground), not mid-session. A
+non-default campaign may also carry an optional **colour override** (background, text, link) in two
+sets — one for every theme, one for the dark theme only — plus an **urgent** flag. The colours ride
+the same block (six optional strings appended to each `BannerCampaign` on the wire — trailing,
+backward-compatible); the client resolves the cascade (dark ← dark ?? all, light ← all) and derives
+the strip's border from the background in JS (no CSS `color-mix`, for the old-WebView floor).
+**Urgent is resolved entirely server-side, with no wire field**: while any enabled, in-window urgent
+campaign exists, `computeActiveSet` returns *only* the urgent campaigns (preempting the timed set and
+the default remainder) and `bannerFor` **skips the eligibility gate** for that feed, so an urgent
+notice reaches every viewer — paid, hint-holding or `no_banner` included. There is no instant
+broadcast on an urgent toggle (the notify path is per-user); an urgent campaign appears on each
+viewer's next `profile.get`. The default campaign stays plain (no colours, never urgent), enforced by
+both the service and a DB CHECK. The same
 mechanism carries a **`profile`** sub-kind — a payload-free re-fetch signal emitted when a viewer's
 own account changed out of band (an email confirmed through the one-tap deeplink opened in another
-browser), so an open in-app session reflects it at once.
+browser), so an open in-app session reflects it at once. The live stream is single-shot with no
+replay, so a **backgrounded Mini App** — suspended while the user is in their mail app tapping the
+link — misses the event; while an add-email confirmation is pending the client therefore also
+**polls `profile.get`** (and on foreground regain) as a fallback until the address lands.
 
 > A single `app.load` bootstrap aggregator (collapsing `profile.get` + lobby + badge fetches into
 > one round-trip) was **considered and deferred**: client↔gateway is HTTP/2 (h2c), so the bootstrap
@@ -1015,7 +1043,9 @@ browser), so an open in-app session reflects it at once.
   (`internal/adminalert`, started from `main`) emails the operator (`ADMIN_EMAIL`, from a
   distinct `SMTP_RELAY_ADMIN_FROM`) when new player feedback or word complaints arrive,
   **coalescing** a burst into one digest per interval; both recipients may be several
-  comma-separated addresses. Both paths are inert unless configured.
+  comma-separated addresses. The digest carries **no admin-console link** — an admin URL must
+  never travel in an email, where a mail provider could cache or index it; the operator opens the
+  console directly. Both paths are inert unless configured.
 - Per-request server-side timing via gin middleware from day one (the access log
   carries method, route, status, latency and the active trace id). A
   client-measured RTT piggybacked on the next request is a later enhancement.
@@ -1059,6 +1089,17 @@ browser), so an open in-app session reflects it at once.
   it fills IndexedDB — and is surfaced on the **Scrabble — Users** dashboard. Lossy by
   design (a dropped beacon just retries its batch on the next flush); it is telemetry, never
   a game input.
+- **Unsupported-engine screens (client-reported):** the ES5 boot guard in `index.html` (§13)
+  shows a full-screen "your device's OS or browser can't run the app" screen — instead of a white
+  screen — when the engine lacks an unpolyfillable essential (`BigInt`, the 64-bit FlatBuffers
+  decode; or `Proxy`, Svelte 5 runes) or an uncaught error aborts boot; the effective floor is
+  Chrome 67. It then fires one fire-and-forget beacon (`POST /telemetry/unsupported` —
+  unauthenticated, since the client never booted, but per-IP public-limited and body-capped),
+  deduped in `localStorage` by app version + reason + Chromium so a user reopening the app is one
+  report. The gateway folds it into `unsupported_engine_total` (`reason` =
+  no_bigint/no_proxy/boot_error/other; `chromium` = the major version reduced to a bounded range so
+  a spoofed beacon cannot inflate cardinality) and logs the full user agent (not a label). Surfaced
+  on the **Scrabble — Users** dashboard beside app opens.
 - **Rate-limit observability:** every limiter rejection increments the gateway
   counter `gateway_rate_limited_total` (`class` = user/public/email/admin — aggregate
   only, honouring the no-per-user-label discipline above) and logs one **Debug** line;
@@ -1196,7 +1237,14 @@ origin, so the test contour canonicalises to production instead of being indexed
 separate site; the SPA shell is `noindex`, and the landing always boots in Russian (no
 browser-language detection — crawlers render with arbitrary languages). The favicon set,
 `og-image.png` and `robots.txt` ship unhashed from `ui/public/` (generated by
-`assets/icons/`, same tile design as the VK loader). Hash-named `/assets/*` are served
+`assets/icons/`, same tile design as the VK loader). On the web (`/app/`) the SPA is an installable **PWA**:
+`manifest.webmanifest` and an install-only **service worker** (`sw.js`) ship unhashed from
+`ui/public/`, and the client registers the worker **web-only** — never inside a Mini App or the
+mock build. The worker intercepts only top-level navigations (network-first with a cached-shell
+fallback), leaving `/assets/*` and the Connect stream untouched; it exists to satisfy Chromium's
+installability requirement (a registered SW, needed for install on Android) and is the single
+growth point for a future opt-in offline mode. The gateway registers the `.webmanifest` MIME type
+in-process (the distroless image has no `/etc/mime.types`). Hash-named `/assets/*` are served
 `immutable` (a relaunch is a cache hit, not a re-download); the HTML shells are
 `no-cache` so a new deploy is picked up — both containers apply the same caching. An
 in-compose **caddy** is the contour's edge: it owns a single `/_gm` Basic-Auth and

docs/FUNCTIONAL.md

@@ -21,7 +21,8 @@ Settings also pick the board's bonus-label style (beginner / classic / none). A
 costs nothing when the rack has no legal move. The word-check accepts only the
 variant's alphabet, remembers answers within the session and rate-limits repeats.
 A public **landing page** at the site root introduces the game, switches language and
-theme, and links to the Telegram game channel and the VK Mini App; the game itself runs at
+theme, and links to the Telegram game channel, the VK Mini App and the **web version**
+(`/app/`) — each under a caption (Telegram / VK / Веб-версия); the game itself runs at
 `/app/` (web), `/telegram/` (the Telegram Mini App) and `/vk/` (the VK Mini App). The landing's theme is ephemeral
 (it follows the system scheme, not the saved preference); its language choice is saved. The
 landing always opens in **Russian** — the browser language is never auto-detected (crawlers
@@ -31,6 +32,11 @@ nondeterministic); a saved 🌐 choice still wins. The page carries a static Rus
 pinned to the production origin, JSON-LD, the favicon set and `robots.txt`), while the SPA
 shell is `noindex` — the landing is the only indexable page.
 
+On the plain web the client is an **installable PWA**: a logged-out player sees an install
+call-to-action under the login form (and at the bottom of Settings) that installs the app to the
+home screen / desktop in one tap where the browser supports it (Chromium), or shows manual
+Add-to-Home-Screen steps on iOS Safari; it is hidden once installed and inside the Mini Apps.
+
 ### First-run onboarding
 The first time a player opens the app it walks them through the interface with a light
 **coachmark overlay**: a dimmed layer draws one hint bubble at a time, each pointing — with a
@@ -70,7 +76,9 @@ per address), so a mistyped address or an impatient tap cannot flood an inbox. T
 also carries a **one-tap link** that confirms the address — or signs the player straight
 in — in a single tap; opening it in another browser reflects in the app at once, and a
 mail scanner that merely fetches the link cannot reach it — the token rides the URL
-fragment, which is never sent to the server.
+fragment, which is never sent to the server. A sign-in requested from an **installed PWA** omits
+this link: the email carries only the code, entered in the same window, since the link would open
+in a separate browser the app cannot reach.
 Telegram runs a **single bot**: every player uses
 the same bot, and all of its chat and out-of-app notifications are written in the
 player's own **interface language** (en/ru). A separate optional **promo bot** can run alongside the
@@ -108,8 +116,12 @@ account is kept and the guest's games move into it. A merge is blocked only whil
 two accounts share a game still in progress.
 
 The profile lists the account's **sign-in methods**. On the web a player can add
-Telegram; adding VK on the web is not offered yet, and inside a Mini App the host
-platform is already linked. A linked provider can be **unlinked** — except the last
+Telegram (a login-widget popup) or VK (VK ID web login — a redirect to VK's sign-in and
+back); inside a Mini App the host platform is already linked, and its own sign-in-method
+row is hidden — the platform the player is currently signed in through cannot be unlinked
+from there, only the other provider's row is shown. Linking a provider that
+already belongs to another account offers the same irreversible **merge** as email
+linking. A linked provider can be **unlinked** — except the last
 remaining sign-in method, which is refused so the account stays reachable. **Email is
 never unlinked; it is changed**: the player enters a new address, confirms a code
 mailed to it, and the account switches to it atomically, freeing the old address. A new
@@ -481,8 +493,19 @@ through**, regardless of their interface language. The client rotates the eligib
 **fairly** — every campaign gets its weighted share each cycle, evenly spread rather than at random —
 and a campaign with several messages shows them in turn.
 
+A non-default campaign can carry its own **colours** — background, text and link — so a sponsored or
+operational message stands out from the neutral strip. Colours come in two sets: one that applies on
+**every theme**, and an optional second that overrides the **dark theme** only, so a campaign reads
+well on both; the strip's border is derived from the background automatically. A campaign can also be
+marked **urgent**: an urgent campaign is shown to **everyone** — even paid players, hint holders and
+`no_banner` users — and, while it is live, it is the **only** thing the strip shows (ordinary
+campaigns and the house default step aside). Urgent is for genuine system notices (maintenance,
+outages), not advertising.
+
 Operators manage all of this in the admin console at **`/_gm/banners`**: create, edit, enable/disable
-and schedule campaigns, write each campaign's bilingual messages (reorder or remove them), and set
-the global display **timings** (how long a message holds, the scroll of an over-long message, and the
-fade-out → gap → fade-in transition between messages). The default campaign cannot be deleted and
-keeps at least one message.
+and schedule campaigns, write each campaign's bilingual messages (reorder or remove them), pick a
+non-default campaign's optional override colours (a native colour picker with a live light-and-dark
+preview of the strip) and mark it urgent, and set the global display **timings** (how long a message
+holds, the scroll of an over-long message, and the fade-out → gap → fade-in transition between
+messages). The default campaign cannot be deleted, keeps at least one message, and stays plain (no
+colours, never urgent).

docs/FUNCTIONAL_ru.md

@@ -22,7 +22,8 @@ top-1 подсказку, безлимитную проверку слова с
 Проверка слова принимает только алфавит варианта, запоминает ответы в рамках сессии
 и ограничивает частоту повторов.
 Публичная **посадочная страница** в корне сайта представляет игру, переключает язык и
-тему и ведёт в Telegram-канал игры и в VK Mini App; сама игра живёт по адресам
+тему и ведёт в Telegram-канал игры, в VK Mini App и в **веб-версию** (`/app/`) — каждая под
+подписью (Telegram / VK / Веб-версия); сама игра живёт по адресам
 `/app/` (веб), `/telegram/` (Telegram Mini App) и `/vk/` (VK Mini App). Тема на странице эфемерна (берётся из
 системной настройки, а не из сохранённой), выбор языка сохраняется. Страница всегда
 открывается на **русском** — язык браузера не определяется автоматически (роботы
@@ -33,6 +34,11 @@ Open Graph, которую используют превью ссылок в Tel
 продакшен-домена, JSON-LD, набор favicon и `robots.txt`), а оболочка SPA помечена
 `noindex` — индексируется только посадочная страница.
 
+В обычном вебе клиент — **устанавливаемое PWA**: незалогиненный игрок видит призыв к установке
+под формой входа (и внизу «Настроек»), который в один тап ставит приложение на рабочий стол
+(домашний экран) там, где браузер это умеет (Chromium), либо показывает ручные шаги
+«На экран „Домой“» в Safari на iOS; он скрыт после установки и внутри Mini App.
+
 ### Первый запуск: онбординг
 При первом открытии приложения игрока один раз проводят по интерфейсу лёгким
 **coachmark-оверлеем**: затемнённый слой показывает по одной подсказке-«облачку» за раз, каждое
@@ -74,7 +80,9 @@ launch-параметрам VK (их проверяет gateway), и при пе
 не завалили почтовый ящик. В письме также есть **ссылка одного нажатия**, которая подтверждает
 адрес — или сразу выполняет вход — в один тап; открытие её в другом браузере тут же отражается в
 приложении, а почтовый сканер, который просто загружает ссылку, до токена не дотянется —
-он едет в URL-фрагменте, который не уходит на сервер.
+он едет в URL-фрагменте, который не уходит на сервер. Вход, запрошенный из **установленного
+PWA**, эту ссылку не содержит: в письме только код, который вводится в том же окне (ссылка
+открылась бы в отдельном браузере, недоступном приложению).
 Telegram держит **единого бота**: все игроки пользуются одним
 и тем же ботом, а весь его чат и внеприложенческие уведомления пишутся на **языке
 интерфейса** самого игрока (en/ru). Рядом с основным может работать отдельный опциональный
@@ -112,8 +120,12 @@ Telegram держит **единого бота**: все игроки поль
 запрещено, только пока у аккаунтов есть общая незавершённая игра.
 
 В профиле перечислены **способы входа** аккаунта. В вебе игрок может добавить
-Telegram; добавление VK в вебе пока не предлагается, а внутри Mini App платформа-хозяин
-уже привязана. Привязанного провайдера можно **отвязать** — кроме последнего
+Telegram (попап логин-виджета) или VK (веб-вход VK ID — редирект на страницу входа VK и
+обратно); внутри Mini App платформа-хозяин уже привязана, и её собственная плашка способа
+входа скрыта — платформу, через которую игрок сейчас вошёл, отсюда отвязать нельзя,
+показывается только плашка другого провайдера. Привязка провайдера, уже
+принадлежащего другому аккаунту, предлагает то же необратимое **слияние**, что и привязка
+email. Привязанного провайдера можно **отвязать** — кроме последнего
 оставшегося способа входа: он не отвязывается, чтобы аккаунт оставался достижимым.
 **Email не отвязывают — его меняют**: игрок вводит новый адрес, подтверждает код,
 отправленный на него, и аккаунт атомарно переключается на новый адрес, освобождая
@@ -492,8 +504,19 @@ high-rate флага. С карточки пользователя операт
 **честно** — каждая получает свою долю по весу за цикл, равномерно размазанную, а не случайно — а
 кампания с несколькими сообщениями показывает их по очереди.
 
+Недефолтная кампания может нести собственные **цвета** — фон, текст и ссылку — чтобы рекламное или
+служебное сообщение выделялось на фоне нейтральной ленты. Цвета задаются двумя наборами: один
+применяется на **любой теме**, а необязательный второй переопределяет только **тёмную тему**, чтобы
+кампания хорошо читалась на обеих; рамка ленты выводится из фона автоматически. Кампанию можно также
+пометить как **срочную (urgent)**: срочная кампания показывается **всем** — даже платным игрокам,
+владельцам подсказок и пользователям с ролью `no_banner` — и, пока она активна, лента показывает
+**только её** (обычные кампании и домашняя дефолтная уступают место). Срочность — для настоящих
+системных уведомлений (тех.работы, сбои), а не для рекламы.
+
 Всем этим оператор управляет в админ-консоли по адресу **`/_gm/banners`**: создаёт, редактирует,
 включает/выключает и планирует кампании, пишет двуязычные сообщения кампании (переставляет и удаляет
-их) и задаёт общие **тайминги** показа (сколько держится сообщение, прокрутка слишком длинного, и
-переход fade-out → пауза → fade-in между сообщениями). Дефолтную кампанию нельзя удалить, и в ней
-всегда остаётся хотя бы одно сообщение.
+их), выбирает необязательные цвета недефолтной кампании (нативный color-picker с живым превью ленты
+на светлой и тёмной темах) и помечает её срочной, а также задаёт общие **тайминги** показа (сколько
+держится сообщение, прокрутка слишком длинного, и переход fade-out → пауза → fade-in между
+сообщениями). Дефолтную кампанию нельзя удалить, в ней всегда остаётся хотя бы одно сообщение, и она
+остаётся простой (без цветов, никогда не срочная).

docs/UI_DESIGN.md

@@ -315,6 +315,19 @@ left. A **viewport size change** (e.g. a portrait↔landscape rotation) re-measu
 operator-set (`/_gm/banner-settings`). Under **reduce-motion** the fades collapse to an instant swap
 and a long message does not scroll.
 
+**Per-campaign colours.** A campaign may override the strip's colours (background, text, link). The
+engine carries the current message's campaign colours to the host, and `AdBanner` resolves them for
+the **rendered theme** (`lib/bannerColors`: dark ← dark-set ?? all-set, light ← all-set) and applies
+them as inline CSS variables scoped to `.ad` (`--ad-bg`, `--text-muted`, `--accent`, and a derived
+`--ad-border`) — so an override never leaks past the strip, and a campaign with no override keeps the
+neutral tokens. The border is computed from the background in JS (a luminance-aware nudge toward
+black/white — no CSS `color-mix`, which the old Android WebView floor lacks), matching the admin
+console's live preview. The resolution re-runs when the theme flips (a `[data-theme]` /
+`prefers-color-scheme` observer), so switching light↔dark repaints an overridden strip at once. An
+**urgent** campaign has no client-specific styling — it simply arrives (with its colours) as the only
+campaign in the feed; the preempt-and-show-everyone behaviour is entirely server-side (ARCHITECTURE
+§10).
+
 ## Result / status iconography (`lib/result.ts`)
 
 Lobby rows show two lines (opponents, then result + score) with a large place-based emoji

gateway/Dockerfile

@@ -25,12 +25,16 @@ ARG VITE_TELEGRAM_BOT_ID=
 ARG VITE_TELEGRAM_LINK=
 ARG VITE_TELEGRAM_GAME_CHANNEL_NAME=
 ARG VITE_VK_APP_LINK=
+ARG VITE_VK_APP_ID=
+ARG VITE_VK_ID_REDIRECT_URL=
 ARG VITE_GATEWAY_URL=
 ARG VITE_APP_VERSION=
 ENV VITE_TELEGRAM_BOT_ID=$VITE_TELEGRAM_BOT_ID \
     VITE_TELEGRAM_LINK=$VITE_TELEGRAM_LINK \
     VITE_TELEGRAM_GAME_CHANNEL_NAME=$VITE_TELEGRAM_GAME_CHANNEL_NAME \
     VITE_VK_APP_LINK=$VITE_VK_APP_LINK \
+    VITE_VK_APP_ID=$VITE_VK_APP_ID \
+    VITE_VK_ID_REDIRECT_URL=$VITE_VK_ID_REDIRECT_URL \
     VITE_GATEWAY_URL=$VITE_GATEWAY_URL \
     VITE_APP_VERSION=$VITE_APP_VERSION
 

gateway/README.md

@@ -8,6 +8,9 @@ backend over REST/JSON, and bridges the backend's gRPC push stream to each
 client's in-app live channel. It **embeds the static UI build** (`go:embed`, baked
 in by the gateway image's node stage) and serves a **landing page** at `/` and the game
 **SPA** at `/app/` (web), `/telegram/` (the Telegram Mini App) and `/vk/` (the VK Mini App) — the single-origin model.
+The web SPA is an installable **PWA**: it serves `manifest.webmanifest` (with the `.webmanifest`
+MIME type registered in-process — the distroless image has no `/etc/mime.types`) and the
+install-only `sw.js`, both shipped unhashed from `ui/public/`.
 Hash-named `/assets/*` are served `immutable`; the HTML shells are `no-cache`. It can also serve the
 backend's admin console at `/_gm` behind HTTP Basic-Auth for a local non-caddy run;
 in the deployed contour the front caddy owns `/_gm` (see
@@ -61,6 +64,12 @@ round-trip, then forwards the trusted `vk_user_id` (and the client-read display
 from the signed params) to the backend. When `GATEWAY_VK_APP_SECRET` is unset VK auth is disabled
 (`auth.vk` is unregistered).
 
+`link.vk.confirm`/`merge` link a VK identity from a **browser** (not a Mini App) via **VK ID web
+login** (`internal/vkid`): the SPA runs the VK ID raw OAuth 2.1 flow (PKCE, no `@vkid/sdk`) and
+the gateway completes the **confidential code exchange** at `id.vk.com` under a SEPARATE VK "Web"
+app's protected key — the only op here that calls VK (the Mini App path above is offline). All
+three `GATEWAY_VK_ID_*` unset leaves the ops unregistered.
+
 The message-type catalog: `auth.telegram`, `auth.vk`, `auth.guest`,
 `auth.email.request`, `auth.email.login`, `profile.get`, `game.submit_play`,
 `game.state`, `lobby.enqueue`, `lobby.poll`, `chat.post`, `chat.read` and the play-loop ops;
@@ -72,9 +81,10 @@ refetch). The social/account/history ops —
 `blocks.*`, `invitation.*` (list/create/accept/decline/cancel), `profile.update`,
 `stats.get`, `game.gcg`, and the `notify` live event — go through the identical
 transcode pattern (`transcode_social.go`). Account linking & merge
-— `link.email.request/confirm/merge` and `link.telegram.confirm/merge`
-(`transcode_link.go`); the telegram ops validate the **Login Widget** payload via the
-validator (`ValidateLoginWidget`) and forward the trusted `external_id`. These
+— `link.email.request/confirm/merge`, `link.telegram.confirm/merge` and
+`link.vk.confirm/merge` (`transcode_link.go`); the telegram ops validate the **Login
+Widget** payload via the validator (`ValidateLoginWidget`), the vk ops complete the VK ID
+web code exchange via `internal/vkid`, and both forward the trusted `external_id`. These
 **superseded** the former `email.bind.*` ops, which were removed.
 
 ## Configuration
@@ -89,6 +99,7 @@ validator (`ValidateLoginWidget`) and forward the trusted `external_id`. These
 | `GATEWAY_ADMIN_USER` / `GATEWAY_ADMIN_PASSWORD` | unset | enable + guard the admin console at `/_gm` |
 | `GATEWAY_VALIDATOR_ADDR` | unset | Telegram validator gRPC address (enables initData / Login Widget validation) |
 | `GATEWAY_VK_APP_SECRET` | unset | VK app protected key; enables in-process VK Mini App launch-signature verification (`auth.vk`) |
+| `GATEWAY_VK_ID_APP_ID` / `GATEWAY_VK_ID_CLIENT_SECRET` / `GATEWAY_VK_ID_REDIRECT_URL` | unset | VK ID "Web" app credentials for VK web-login linking (`link.vk.*`): the server-side confidential OAuth 2.1 code exchange. A separate VK app from `GATEWAY_VK_APP_SECRET`; all three required to enable the ops |
 | `GATEWAY_BOTLINK_ADDR` | unset | reverse mTLS bot-link listener the remote bot dials (enables out-of-app push + admin relay) |
 | `GATEWAY_BOTLINK_RELAY_ADDR` | unset | plaintext internal listener serving the backend admin `SendToUser`/`SendToGameChannel` relay |
 | `GATEWAY_BOTLINK_TLS_CERT` / `_KEY` / `_CA` | unset | gateway server cert, its key, and the CA that signs accepted bot client certs (required when `GATEWAY_BOTLINK_ADDR` is set) |

gateway/cmd/gateway/main.go

@@ -33,6 +33,7 @@ import (
 	"scrabble/gateway/internal/ratelimit"
 	"scrabble/gateway/internal/session"
 	"scrabble/gateway/internal/transcode"
+	"scrabble/gateway/internal/vkid"
 	"scrabble/pkg/mtls"
 	botlinkv1 "scrabble/pkg/proto/botlink/v1"
 	telegramv1 "scrabble/pkg/proto/telegram/v1"
@@ -190,7 +191,15 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		logger.Info("admin console disabled (set GATEWAY_ADMIN_USER and GATEWAY_ADMIN_PASSWORD)")
 	}
 
-	registry := transcode.NewRegistry(backend, validator, transcode.WithVKAuth(cfg.VKAppSecret))
+	// VK ID web login (browser VK-identity linking) is optional: build the confidential
+	// code-exchanger only when fully configured, else leave the interface nil so the
+	// link.vk.* ops stay unregistered.
+	var vkidExchanger transcode.VKIDExchanger
+	if cfg.VKID.Enabled() {
+		vkidExchanger = vkid.New(cfg.VKID.AppID, cfg.VKID.ClientSecret, cfg.VKID.RedirectURI)
+		logger.Info("vk id web login enabled")
+	}
+	registry := transcode.NewRegistry(backend, validator, transcode.WithVKAuth(cfg.VKAppSecret), transcode.WithVKLink(vkidExchanger))
 	edge := connectsrv.NewServer(connectsrv.Deps{
 		Registry:     registry,
 		Sessions:     sessions,

gateway/internal/backendclient/api.go

@@ -53,9 +53,18 @@ type BannerResp struct {
 
 // BannerCampaignResp is one campaign in the rotation feed: a GCD-reduced show
 // weight and its messages, in display order, already resolved to one language.
+// The override_* colours are the optional per-campaign palette (empty when the
+// campaign keeps the neutral theme tokens); they ride through to the client
+// verbatim, mirroring the backend DTO.
 type BannerCampaignResp struct {
-	Weight   int      `json:"weight"`
-	Messages []string `json:"messages"`
+	Weight           int      `json:"weight"`
+	Messages         []string `json:"messages"`
+	OverrideBg       string   `json:"override_bg,omitempty"`
+	OverrideFg       string   `json:"override_fg,omitempty"`
+	OverrideLink     string   `json:"override_link,omitempty"`
+	OverrideBgDark   string   `json:"override_bg_dark,omitempty"`
+	OverrideFgDark   string   `json:"override_fg_dark,omitempty"`
+	OverrideLinkDark string   `json:"override_link_dark,omitempty"`
 }
 
 // BannerTimingsResp mirrors the backend's global display timings.
@@ -280,10 +289,11 @@ func (c *Client) GuestAuth(ctx context.Context, browserTz string) (SessionResp,
 
 // EmailRequest asks the backend to mail a login code, provisioning the account on
 // first contact; browserTz (the client's detected "±HH:MM" UTC offset) seeds the new
-// account's time zone, since the email account is created here, not at login.
-func (c *Client) EmailRequest(ctx context.Context, email, browserTz, language string) error {
+// account's time zone, since the email account is created here, not at login. pwa marks a
+// request from an installed PWA, so the backend omits the one-tap confirm link from the email.
+func (c *Client) EmailRequest(ctx context.Context, email, browserTz, language string, pwa bool) error {
 	return c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/email/request", "", "",
-		map[string]string{"email": email, "browser_tz": browserTz, "language": language}, nil)
+		map[string]any{"email": email, "browser_tz": browserTz, "language": language, "pwa": pwa}, nil)
 }
 
 // EmailLogin verifies a login code and mints a session.

gateway/internal/backendclient/api_social.go

@@ -335,6 +335,24 @@ func (c *Client) LinkTelegramMerge(ctx context.Context, userID, externalID strin
 	return out, err
 }
 
+// LinkVK attaches a gateway-validated VK identity to the caller or reports a required
+// merge. externalID is the trusted vk user id resolved from the VK ID code exchange.
+func (c *Client) LinkVK(ctx context.Context, userID, externalID string) (LinkResultResp, error) {
+	var out LinkResultResp
+	err := c.do(ctx, http.MethodPost, "/api/v1/user/link/vk", userID, "",
+		map[string]string{"external_id": externalID}, &out)
+	return out, err
+}
+
+// LinkVKMerge merges the account owning a gateway-validated VK identity into the
+// caller's.
+func (c *Client) LinkVKMerge(ctx context.Context, userID, externalID string) (LinkResultResp, error) {
+	var out LinkResultResp
+	err := c.do(ctx, http.MethodPost, "/api/v1/user/link/vk/merge", userID, "",
+		map[string]string{"external_id": externalID}, &out)
+	return out, err
+}
+
 // ChangeEmailRequest asks the backend to mail a confirm-code to a new address for an
 // authenticated email change.
 func (c *Client) ChangeEmailRequest(ctx context.Context, userID, email string) error {

gateway/internal/config/config.go

@@ -36,6 +36,11 @@ type Config struct {
 	// VK launch-parameter signature in-process under it (a pure offline HMAC, no VK API
 	// round-trip). Empty disables the VK auth path (auth.vk is then unregistered).
 	VKAppSecret string
+	// VKID configures the VK ID web login used to link a VK identity from a browser
+	// (the confidential OAuth 2.1 code exchange against id.vk.com). It belongs to a
+	// separate VK "Web" app from VKAppSecret's Mini App, so its credentials are distinct.
+	// Any field empty disables the VK web-link ops (link.vk.*).
+	VKID VKIDConfig
 	// BotLink configures the reverse mTLS channel to the remote Telegram bot. An
 	// empty BotLink.Addr disables the bot channel (out-of-app push and admin relay).
 	BotLink BotLinkConfig
@@ -161,6 +166,22 @@ func DefaultAbuse() AbuseConfig {
 	}
 }
 
+// VKIDConfig holds the VK ID web-login credentials for the confidential
+// authorization-code exchange. AppID is the VK "Web" app's client id; ClientSecret is
+// its protected key; RedirectURI must exactly match the trusted redirect URL registered
+// with the app and the one the frontend uses. All three are required to enable the flow.
+type VKIDConfig struct {
+	AppID        string
+	ClientSecret string
+	RedirectURI  string
+}
+
+// Enabled reports whether VK ID web login is fully configured. When false the gateway
+// leaves the VK web-link ops (link.vk.*) unregistered.
+func (c VKIDConfig) Enabled() bool {
+	return c.AppID != "" && c.ClientSecret != "" && c.RedirectURI != ""
+}
+
 // Load reads the configuration from the environment, applies defaults, and
 // validates the result.
 func Load() (Config, error) {
@@ -174,6 +195,11 @@ func Load() (Config, error) {
 		AdminPassword:   os.Getenv("GATEWAY_ADMIN_PASSWORD"),
 		ValidatorAddr:   os.Getenv("GATEWAY_VALIDATOR_ADDR"),
 		VKAppSecret:     os.Getenv("GATEWAY_VK_APP_SECRET"),
+		VKID: VKIDConfig{
+			AppID:        os.Getenv("GATEWAY_VK_ID_APP_ID"),
+			ClientSecret: os.Getenv("GATEWAY_VK_ID_CLIENT_SECRET"),
+			RedirectURI:  os.Getenv("GATEWAY_VK_ID_REDIRECT_URL"),
+		},
 		SessionCacheMax: defaultSessionCacheMax,
 		RateLimit:       DefaultRateLimit(),
 		Abuse:           DefaultAbuse(),

gateway/internal/connectsrv/metrics.go

@@ -32,6 +32,8 @@ type serverMetrics struct {
 	localColdStart metric.Int64Counter
 	localDictLoad  metric.Int64Counter
 	localPreview   metric.Int64Counter
+	// Clients turned away by the unsupported-engine boot screen (see unsupportedEngineHandler).
+	unsupportedEngine metric.Int64Counter
 }
 
 // newServerMetrics builds the instruments on meter (nil selects a no-op meter),
@@ -44,7 +46,13 @@ func newServerMetrics(meter metric.Meter) *serverMetrics {
 	}
 	h, err := meter.Float64Histogram("edge_request_duration",
 		metric.WithUnit("s"),
-		metric.WithDescription("Seconds to serve one Connect Execute call, by message type and result."))
+		metric.WithDescription("Seconds to serve one Connect Execute call, by message type and result."),
+		// Explicit second-scale buckets. The durations are recorded in seconds, so the SDK's
+		// default millisecond-calibrated boundaries (first boundary 5) would bin every sub-5s
+		// request into one bucket — making histogram_quantile(0.99) interpolate to ~4.95s
+		// regardless of the real latency, which flapped the >1s edge-latency alert. These
+		// boundaries straddle the 1s SLO so the p99 reflects real (mostly sub-second) latency.
+		metric.WithExplicitBucketBoundaries(0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10))
 	if err != nil {
 		h, _ = noop.NewMeterProvider().Meter(meterName).Float64Histogram("edge_request_duration")
 	}
@@ -63,6 +71,8 @@ func newServerMetrics(meter metric.Meter) *serverMetrics {
 		localColdStart: counterOf(meter, "local_eval_cold_start_total", "App cold starts reported by clients — the denominator for local-move-preview adoption."),
 		localDictLoad:  counterOf(meter, "local_eval_dict_load_total", "Client dictionary loads for the local move preview, by result (fetched, cache_hit or miss)."),
 		localPreview:   counterOf(meter, "local_eval_preview_total", "Client move previews, by path (local on-device, or network fallback)."),
+		unsupportedEngine: counterOf(meter, "unsupported_engine_total",
+			"Clients that hit the unsupported-engine boot screen (the app cannot run), by reason (no_bigint, no_proxy, boot_error, other) and Chromium major — a deduped beacon from the index.html boot guard; the full user agent is logged, not labelled."),
 	}
 
 	gauge, err := meter.Int64ObservableGauge("active_users",
@@ -108,6 +118,16 @@ func (m *serverMetrics) recordBan(ctx context.Context, reason string) {
 	m.banned.Add(ctx, 1, metric.WithAttributes(attribute.String("reason", reason)))
 }
 
+// recordUnsupportedEngine counts one client turned away by the unsupported-engine boot screen,
+// labelled by reason and Chromium major. The caller passes both already reduced to bounded label
+// sets (see normalizeUnsupported) so a spoofed beacon cannot explode the metric cardinality.
+func (m *serverMetrics) recordUnsupportedEngine(ctx context.Context, reason, chromium string) {
+	m.unsupportedEngine.Add(ctx, 1, metric.WithAttributes(
+		attribute.String("reason", reason),
+		attribute.String("chromium", chromium),
+	))
+}
+
 // localEvalReport is the client-reported local move-preview telemetry batch — deltas since
 // the client's previous report. It backs the adoption dashboard: app cold starts vs cached
 // dictionaries vs on-device previews.

gateway/internal/connectsrv/metrics_test.go

@@ -29,6 +29,7 @@ func TestEdgeMetric(t *testing.T) {
 
 	type key struct{ messageType, result string }
 	counts := map[key]uint64{}
+	var bounds []float64
 	for _, sm := range rm.ScopeMetrics {
 		for _, md := range sm.Metrics {
 			if md.Name != "edge_request_duration" {
@@ -42,6 +43,7 @@ func TestEdgeMetric(t *testing.T) {
 				mt, _ := dp.Attributes.Value(attribute.Key("message_type"))
 				res, _ := dp.Attributes.Value(attribute.Key("result"))
 				counts[key{mt.AsString(), res.AsString()}] += dp.Count
+				bounds = dp.Bounds
 			}
 		}
 	}
@@ -51,6 +53,19 @@ func TestEdgeMetric(t *testing.T) {
 	if got := counts[key{"auth.guest", "domain"}]; got != 1 {
 		t.Errorf("edge auth.guest/domain = %d, want 1", got)
 	}
+	// The buckets must be second-scaled. The default (millisecond-calibrated) boundaries have no
+	// boundary between 0 and 5, so every sub-5s request bins into one bucket and p99 interpolates
+	// to ~4.95s, flapping the >1s alert. Require at least one sub-second boundary.
+	subSecond := false
+	for _, b := range bounds {
+		if b > 0 && b < 1 {
+			subSecond = true
+			break
+		}
+	}
+	if !subSecond {
+		t.Errorf("edge_request_duration bounds = %v, want sub-second boundaries (seconds-scaled)", bounds)
+	}
 }
 
 // TestRateLimitedMetric records limiter rejections through a manual reader and
@@ -128,3 +143,70 @@ func TestBannedMetric(t *testing.T) {
 		t.Errorf("banned counts = %v, want tripwire=2 honeytoken=1", counts)
 	}
 }
+
+// TestUnsupportedEngineMetric records unsupported-engine beacons through a manual reader and asserts
+// unsupported_engine_total splits by reason and Chromium major.
+func TestUnsupportedEngineMetric(t *testing.T) {
+	ctx := context.Background()
+	reader := sdkmetric.NewManualReader()
+	meter := sdkmetric.NewMeterProvider(sdkmetric.WithReader(reader)).Meter("test")
+	m := newServerMetrics(meter)
+
+	m.recordUnsupportedEngine(ctx, "no_bigint", "66")
+	m.recordUnsupportedEngine(ctx, "no_bigint", "66")
+	m.recordUnsupportedEngine(ctx, "boot_error", "74")
+
+	var rm metricdata.ResourceMetrics
+	if err := reader.Collect(ctx, &rm); err != nil {
+		t.Fatalf("collect: %v", err)
+	}
+	type key struct{ reason, chromium string }
+	counts := map[key]int64{}
+	for _, sm := range rm.ScopeMetrics {
+		for _, md := range sm.Metrics {
+			if md.Name != "unsupported_engine_total" {
+				continue
+			}
+			sum, ok := md.Data.(metricdata.Sum[int64])
+			if !ok {
+				t.Fatalf("unsupported_engine_total is not an int64 sum")
+			}
+			for _, dp := range sum.DataPoints {
+				reason, _ := dp.Attributes.Value(attribute.Key("reason"))
+				chromium, _ := dp.Attributes.Value(attribute.Key("chromium"))
+				counts[key{reason.AsString(), chromium.AsString()}] += dp.Value
+			}
+		}
+	}
+	if got := counts[key{"no_bigint", "66"}]; got != 2 {
+		t.Errorf("unsupported no_bigint/66 = %d, want 2", got)
+	}
+	if got := counts[key{"boot_error", "74"}]; got != 1 {
+		t.Errorf("unsupported boot_error/74 = %d, want 1", got)
+	}
+}
+
+// TestNormalizeUnsupported checks that a beacon's reason and Chromium are reduced to bounded label
+// values, so a spoofed beacon cannot explode the metric cardinality.
+func TestNormalizeUnsupported(t *testing.T) {
+	cases := []struct {
+		reason, chromium         string
+		wantReason, wantChromium string
+	}{
+		{"no_bigint", "66", "no_bigint", "66"},
+		{"no_proxy", " 74 ", "no_proxy", "74"},
+		{"boot_error", "105", "boot_error", "105"},
+		{"garbage", "66", "other", "66"},
+		{"", "", "other", "other"},
+		{"no_bigint", "not-a-number", "no_bigint", "other"},
+		{"no_bigint", "9999", "no_bigint", "other"},
+		{"no_bigint", "0", "no_bigint", "other"},
+		{"no_bigint", "-5", "no_bigint", "other"},
+	}
+	for _, c := range cases {
+		gotR, gotC := normalizeUnsupported(c.reason, c.chromium)
+		if gotR != c.wantReason || gotC != c.wantChromium {
+			t.Errorf("normalizeUnsupported(%q,%q) = %q,%q; want %q,%q", c.reason, c.chromium, gotR, gotC, c.wantReason, c.wantChromium)
+		}
+	}
+}

gateway/internal/connectsrv/server.go

@@ -15,6 +15,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -197,6 +198,9 @@ func (s *Server) HTTPHandler() http.Handler {
 	mux.Handle("/dl/", s.exportDownloadHandler())
 	// The client posts its local-move-preview adoption telemetry here (session-gated).
 	mux.Handle("/metrics/local-eval", s.localEvalMetricsHandler())
+	// The index.html boot guard beacons here when it turns a client away on the unsupported-engine
+	// screen (the app cannot run). Unauthenticated — the client never booted — but rate-limited.
+	mux.Handle("/telemetry/unsupported", s.unsupportedEngineHandler())
 	// The embedded UI: the game SPA under /app/ (web), /telegram/ (the Telegram Mini
 	// App) and /vk/ (the VK Mini App) — the single-origin model (docs/ARCHITECTURE.md
 	// §13). All sit below the h2c wrap so the Connect edge (a more specific prefix) keeps
@@ -582,6 +586,76 @@ func clampReport(r *localEvalReport) {
 	clamp(&r.PreviewNetwork)
 }
 
+// unsupportedEngineBeacon is the small fire-and-forget report the index.html boot guard sends when
+// it turns a client away on the unsupported-engine screen (no BigInt/Proxy, or an uncaught boot
+// error). It is deduped client-side (one per device / app version / reason).
+type unsupportedEngineBeacon struct {
+	Reason   string `json:"reason"`
+	Chromium string `json:"chromium"`
+	Version  string `json:"version"`
+	UA       string `json:"ua"`
+}
+
+// unsupportedEngineHandler folds one unsupported-engine beacon into the edge counter. It is
+// unauthenticated (the client never booted, so it carries no session) but per-IP rate-limited with
+// the public limiter and body-capped. reason and the Chromium major are reduced to bounded label
+// sets (normalizeUnsupported) so a spoofed beacon cannot inflate the metric cardinality; the full
+// user agent is logged, not labelled. Only POST; the reply is always 204.
+func (s *Server) unsupportedEngineHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		ip := peerIP(r.RemoteAddr, r.Header)
+		if !s.limiter.Allow("public:"+ip, s.publicPolicy) {
+			s.noteRateLimited(r.Context(), classPublic, ip, "unsupported")
+			http.Error(w, "rate limited", http.StatusTooManyRequests)
+			return
+		}
+		var b unsupportedEngineBeacon
+		if err := json.NewDecoder(io.LimitReader(r.Body, 2048)).Decode(&b); err != nil {
+			http.Error(w, "bad request", http.StatusBadRequest)
+			return
+		}
+		reason, chromium := normalizeUnsupported(b.Reason, b.Chromium)
+		s.metrics.recordUnsupportedEngine(r.Context(), reason, chromium)
+		s.log.Info("unsupported engine",
+			zap.String("reason", reason),
+			zap.String("chromium", chromium),
+			zap.String("app_version", truncate(b.Version, 40)),
+			zap.String("user_agent", truncate(b.UA, 400)),
+		)
+		w.WriteHeader(http.StatusNoContent)
+	})
+}
+
+// normalizeUnsupported reduces a beacon's reason and Chromium fields to bounded label values, so a
+// spoofed beacon cannot explode the metric cardinality: reason is allow-listed, and Chromium is
+// parsed as a major version kept only within a plausible range, otherwise "other".
+func normalizeUnsupported(reason, chromium string) (string, string) {
+	switch reason {
+	case "no_bigint", "no_proxy", "boot_error":
+		// a recognised reason — keep as-is
+	default:
+		reason = "other"
+	}
+	major := "other"
+	if n, err := strconv.Atoi(strings.TrimSpace(chromium)); err == nil && n >= 1 && n <= 199 {
+		major = strconv.Itoa(n)
+	}
+	return reason, major
+}
+
+// truncate bounds a logged, client-supplied string to n bytes (a spoofed beacon field is not
+// trusted to be small).
+func truncate(s string, n int) string {
+	if len(s) > n {
+		return s[:n]
+	}
+	return s
+}
+
 // resolve extracts and resolves the Authorization bearer token to an account id
 // and its guest flag, returning a Connect Unauthenticated error when it is missing
 // or unknown.

gateway/internal/connectsrv/telemetry_test.go

@@ -0,0 +1,81 @@
+package connectsrv_test
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"go.opentelemetry.io/otel/attribute"
+	sdkmetric "go.opentelemetry.io/otel/sdk/metric"
+	"go.opentelemetry.io/otel/sdk/metric/metricdata"
+
+	"scrabble/gateway/internal/config"
+	"scrabble/gateway/internal/connectsrv"
+	"scrabble/gateway/internal/ratelimit"
+)
+
+// TestUnsupportedEngineHandler drives the /telemetry/unsupported beacon route end to end: a POST
+// increments unsupported_engine_total with the normalised labels and replies 204; a GET is 405.
+func TestUnsupportedEngineHandler(t *testing.T) {
+	reader := sdkmetric.NewManualReader()
+	meter := sdkmetric.NewMeterProvider(sdkmetric.WithReader(reader)).Meter("test")
+	edge := connectsrv.NewServer(connectsrv.Deps{
+		Limiter:   ratelimit.New(),
+		RateLimit: config.DefaultRateLimit(),
+		Meter:     meter,
+	})
+	srv := httptest.NewServer(edge.HTTPHandler())
+	defer srv.Close()
+	url := srv.URL + "/telemetry/unsupported"
+
+	// A GET is rejected.
+	getResp, err := http.Get(url)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	getResp.Body.Close()
+	if getResp.StatusCode != http.StatusMethodNotAllowed {
+		t.Errorf("GET status = %d, want 405", getResp.StatusCode)
+	}
+
+	// A POST is accepted (204) and folded into the counter with normalised labels.
+	body := `{"reason":"no_bigint","chromium":"66","version":"v1.2.3","ua":"Mozilla/5.0 ... Chrome/66"}`
+	resp, err := http.Post(url, "application/json", bytes.NewBufferString(body))
+	if err != nil {
+		t.Fatalf("post: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Errorf("POST status = %d, want 204", resp.StatusCode)
+	}
+
+	var rm metricdata.ResourceMetrics
+	if err := reader.Collect(context.Background(), &rm); err != nil {
+		t.Fatalf("collect: %v", err)
+	}
+	var total int64
+	for _, sm := range rm.ScopeMetrics {
+		for _, md := range sm.Metrics {
+			if md.Name != "unsupported_engine_total" {
+				continue
+			}
+			sum, ok := md.Data.(metricdata.Sum[int64])
+			if !ok {
+				t.Fatalf("unsupported_engine_total is not an int64 sum")
+			}
+			for _, dp := range sum.DataPoints {
+				reason, _ := dp.Attributes.Value(attribute.Key("reason"))
+				chromium, _ := dp.Attributes.Value(attribute.Key("chromium"))
+				if reason.AsString() != "no_bigint" || chromium.AsString() != "66" {
+					t.Errorf("labels = %s/%s, want no_bigint/66", reason.AsString(), chromium.AsString())
+				}
+				total += dp.Value
+			}
+		}
+	}
+	if total != 1 {
+		t.Errorf("unsupported_engine_total = %d, want 1", total)
+	}
+}

gateway/internal/transcode/encode.go

@@ -118,6 +118,23 @@ func encodeProfile(p backendclient.ProfileResp) []byte {
 	return b.FinishedBytes()
 }
 
+// optString creates a FlatBuffers string for a non-empty value, or 0 to omit the
+// optional field (the client then reads it as absent).
+func optString(b *flatbuffers.Builder, s string) flatbuffers.UOffsetT {
+	if s == "" {
+		return 0
+	}
+	return b.CreateString(s)
+}
+
+// addOptString adds an optional string slot only when it was created (a 0 offset
+// leaves the field absent). add is the generated BannerCampaignAdd* setter.
+func addOptString(b *flatbuffers.Builder, add func(*flatbuffers.Builder, flatbuffers.UOffsetT), off flatbuffers.UOffsetT) {
+	if off != 0 {
+		add(b, off)
+	}
+}
+
 // encodeBanner builds a BannerInfo table from the resolved banner block and
 // returns its offset. It is bottom-up: each campaign's messages vector and table
 // are built first, then the campaigns vector, then the BannerInfo table. The
@@ -134,9 +151,23 @@ func encodeBanner(b *flatbuffers.Builder, banner backendclient.BannerResp) flatb
 			b.PrependUOffsetT(msgOffsets[j])
 		}
 		msgs := b.EndVector(len(msgOffsets))
+		// The optional colour strings must be created before the table starts; an
+		// empty colour is omitted (offset 0), so the client reads it as absent.
+		obg := optString(b, c.OverrideBg)
+		ofg := optString(b, c.OverrideFg)
+		olink := optString(b, c.OverrideLink)
+		obgD := optString(b, c.OverrideBgDark)
+		ofgD := optString(b, c.OverrideFgDark)
+		olinkD := optString(b, c.OverrideLinkDark)
 		fb.BannerCampaignStart(b)
 		fb.BannerCampaignAddWeight(b, int32(c.Weight))
 		fb.BannerCampaignAddMessages(b, msgs)
+		addOptString(b, fb.BannerCampaignAddOverrideBg, obg)
+		addOptString(b, fb.BannerCampaignAddOverrideFg, ofg)
+		addOptString(b, fb.BannerCampaignAddOverrideLink, olink)
+		addOptString(b, fb.BannerCampaignAddOverrideBgDark, obgD)
+		addOptString(b, fb.BannerCampaignAddOverrideFgDark, ofgD)
+		addOptString(b, fb.BannerCampaignAddOverrideLinkDark, olinkD)
 		campOffsets[i] = fb.BannerCampaignEnd(b)
 	}
 	fb.BannerInfoStartCampaignsVector(b, len(campOffsets))

gateway/internal/transcode/transcode.go

@@ -14,6 +14,7 @@ import (
 	"scrabble/gateway/internal/backendclient"
 	"scrabble/gateway/internal/connector"
 	"scrabble/gateway/internal/vkauth"
+	"scrabble/gateway/internal/vkid"
 	fb "scrabble/pkg/fbs/scrabblefb"
 )
 
@@ -152,6 +153,15 @@ func WithVKAuth(secret string) Option {
 	}
 }
 
+// WithVKLink registers the VK web-link ops (link.vk.confirm/merge), which complete a
+// browser VK ID authorization via the server-side code exchange. A nil exchanger leaves
+// them unregistered, so the ops are unknown wherever VK ID web login is not configured.
+func WithVKLink(ex VKIDExchanger) Option {
+	return func(r *Registry, backend *backendclient.Client) {
+		registerVKLinkOps(r, backend, ex)
+	}
+}
+
 // Lookup returns the operation for messageType, and whether it is registered.
 func (r *Registry) Lookup(messageType string) (Op, bool) {
 	op, ok := r.ops[messageType]
@@ -172,6 +182,9 @@ func DomainCode(err error) (string, bool) {
 	if errors.Is(err, vkauth.ErrInvalid) {
 		return "invalid_vk_params", true
 	}
+	if errors.Is(err, vkid.ErrInvalid) {
+		return "invalid_vk_id", true
+	}
 	if errors.Is(err, connector.ErrInvalidLoginWidget) {
 		return "invalid_login_widget", true
 	}
@@ -240,7 +253,7 @@ func authGuestHandler(backend *backendclient.Client) Handler {
 func authEmailRequestHandler(backend *backendclient.Client) Handler {
 	return func(ctx context.Context, req Request) ([]byte, error) {
 		in := fb.GetRootAsEmailRequestRequest(req.Payload, 0)
-		if err := backend.EmailRequest(ctx, string(in.Email()), string(in.BrowserTz()), string(in.Language())); err != nil {
+		if err := backend.EmailRequest(ctx, string(in.Email()), string(in.BrowserTz()), string(in.Language()), in.Pwa()); err != nil {
 			return nil, err
 		}
 		return encodeAck(true), nil

gateway/internal/transcode/transcode_banner_test.go

@@ -61,6 +61,54 @@ func TestProfileGetEncodesBanner(t *testing.T) {
 	}
 }
 
+// TestProfileGetEncodesBannerColors verifies the gateway carries a campaign's
+// optional colour overrides into the FlatBuffers payload, and leaves an absent
+// colour (or an absent set) empty so the client falls back to the theme tokens.
+func TestProfileGetEncodesBannerColors(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`{"user_id":"u-1","display_name":"Kaya","preferred_language":"en",` +
+			`"banner":{"campaigns":[` +
+			`{"weight":1,"messages":["promo-en"],` +
+			`"override_bg":"#aa0000","override_fg":"#ffffff","override_link":"#ffdd00",` +
+			`"override_bg_dark":"#330000","override_fg_dark":"#eeeeee","override_link_dark":"#ffcc00"},` +
+			`{"weight":1,"messages":["plain-en"]}],` +
+			`"timings":{"hold_ms":60000,"edge_pause_ms":5000,"scroll_px_per_sec":40,` +
+			`"fade_out_ms":1000,"gap_ms":250,"fade_in_ms":1000}}}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, _ := reg.Lookup(transcode.MsgProfileGet)
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1"})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	banner := fb.GetRootAsProfile(payload, 0).Banner(nil)
+	if banner == nil {
+		t.Fatal("profile carries no banner block")
+	}
+	var c fb.BannerCampaign
+	banner.Campaigns(&c, 0)
+	if got := string(c.OverrideBg()); got != "#aa0000" {
+		t.Errorf("override_bg = %q, want #aa0000", got)
+	}
+	if got := string(c.OverrideLink()); got != "#ffdd00" {
+		t.Errorf("override_link = %q, want #ffdd00", got)
+	}
+	if got := string(c.OverrideBgDark()); got != "#330000" {
+		t.Errorf("override_bg_dark = %q, want #330000", got)
+	}
+	if got := string(c.OverrideLinkDark()); got != "#ffcc00" {
+		t.Errorf("override_link_dark = %q, want #ffcc00", got)
+	}
+	// The second campaign has no override: every colour field must be absent (nil).
+	banner.Campaigns(&c, 1)
+	if c.OverrideBg() != nil || c.OverrideFg() != nil || c.OverrideLink() != nil ||
+		c.OverrideBgDark() != nil || c.OverrideFgDark() != nil || c.OverrideLinkDark() != nil {
+		t.Error("plain campaign unexpectedly carries a colour override")
+	}
+}
+
 // TestProfileGetNoBanner verifies an ineligible viewer's profile carries no
 // banner block (the backend omits it).
 func TestProfileGetNoBanner(t *testing.T) {

gateway/internal/transcode/transcode_link.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"scrabble/gateway/internal/backendclient"
+	"scrabble/gateway/internal/vkid"
 	fb "scrabble/pkg/fbs/scrabblefb"
 )
 
@@ -18,6 +19,8 @@ const (
 	MsgLinkEmailMerge     = "link.email.merge"
 	MsgLinkTelegram       = "link.telegram.confirm"
 	MsgLinkTelegramMerge  = "link.telegram.merge"
+	MsgLinkVK             = "link.vk.confirm"
+	MsgLinkVKMerge        = "link.vk.merge"
 	MsgLinkUnlink         = "link.unlink"
 	MsgEmailChangeRequest = "link.email.change.request"
 	MsgEmailChangeConfirm = "link.email.change.confirm"
@@ -154,3 +157,44 @@ func linkTelegramHandler(backend *backendclient.Client, tg TelegramValidator, me
 		return encodeLinkResult(res), nil
 	}
 }
+
+// VKIDExchanger completes a VK ID web authorization-code exchange, returning the
+// launching user's trusted VK identity. It is satisfied by *vkid.Exchanger and lets the
+// VK web-link ops resolve a browser VK login, which — unlike the Mini App path — has no
+// offline launch signature to verify.
+type VKIDExchanger interface {
+	Exchange(ctx context.Context, code, deviceID, codeVerifier string) (vkid.Identity, error)
+}
+
+// registerVKLinkOps adds the VK web-link ops when a VK ID exchanger is configured; a nil
+// exchanger leaves them unregistered (VK ID web login not configured).
+func registerVKLinkOps(r *Registry, backend *backendclient.Client, ex VKIDExchanger) {
+	if ex == nil {
+		return
+	}
+	r.ops[MsgLinkVK] = Op{Handler: linkVKHandler(backend, ex, false), Auth: true}
+	r.ops[MsgLinkVKMerge] = Op{Handler: linkVKHandler(backend, ex, true), Auth: true}
+}
+
+// linkVKHandler completes the VK ID code exchange (server-side, under the app's
+// protected key) and then calls the backend's link or merge endpoint with the trusted
+// VK external id.
+func linkVKHandler(backend *backendclient.Client, ex VKIDExchanger, merge bool) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		in := fb.GetRootAsLinkVKRequest(req.Payload, 0)
+		user, err := ex.Exchange(ctx, string(in.Code()), string(in.DeviceId()), string(in.CodeVerifier()))
+		if err != nil {
+			return nil, err
+		}
+		var res backendclient.LinkResultResp
+		if merge {
+			res, err = backend.LinkVKMerge(ctx, req.UserID, user.ExternalID)
+		} else {
+			res, err = backend.LinkVK(ctx, req.UserID, user.ExternalID)
+		}
+		if err != nil {
+			return nil, err
+		}
+		return encodeLinkResult(res), nil
+	}
+}

gateway/internal/transcode/transcode_vk_link_test.go

@@ -0,0 +1,90 @@
+package transcode_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	flatbuffers "github.com/google/flatbuffers/go"
+
+	"scrabble/gateway/internal/transcode"
+	"scrabble/gateway/internal/vkid"
+	fb "scrabble/pkg/fbs/scrabblefb"
+)
+
+func linkVKPayload(code, deviceID, verifier string) []byte {
+	b := flatbuffers.NewBuilder(64)
+	c := b.CreateString(code)
+	d := b.CreateString(deviceID)
+	v := b.CreateString(verifier)
+	fb.LinkVKRequestStart(b)
+	fb.LinkVKRequestAddCode(b, c)
+	fb.LinkVKRequestAddDeviceId(b, d)
+	fb.LinkVKRequestAddCodeVerifier(b, v)
+	b.Finish(fb.LinkVKRequestEnd(b))
+	return b.FinishedBytes()
+}
+
+// fakeVKIDExchanger records the exchange inputs and returns a canned identity.
+type fakeVKIDExchanger struct {
+	id                              vkid.Identity
+	err                             error
+	gotCode, gotDevice, gotVerifier string
+}
+
+func (f *fakeVKIDExchanger) Exchange(_ context.Context, code, deviceID, codeVerifier string) (vkid.Identity, error) {
+	f.gotCode, f.gotDevice, f.gotVerifier = code, deviceID, codeVerifier
+	return f.id, f.err
+}
+
+func TestLinkVKExchangesAndForwards(t *testing.T) {
+	var gotExternalID string
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user/link/vk" {
+			t.Errorf("path = %q", r.URL.Path)
+		}
+		var body struct {
+			ExternalID string `json:"external_id"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&body)
+		gotExternalID = body.ExternalID
+		_, _ = w.Write([]byte(`{"status":"linked"}`))
+	})
+	defer cleanup()
+
+	ex := &fakeVKIDExchanger{id: vkid.Identity{ExternalID: "777"}}
+	reg := transcode.NewRegistry(backend, nil, transcode.WithVKLink(ex))
+	op, ok := reg.Lookup(transcode.MsgLinkVK)
+	if !ok {
+		t.Fatal("link.vk.confirm not registered")
+	}
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1", Payload: linkVKPayload("the-code", "dev-1", "verifier-1")})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	// The PKCE inputs from the wire must reach the exchanger verbatim...
+	if ex.gotCode != "the-code" || ex.gotDevice != "dev-1" || ex.gotVerifier != "verifier-1" {
+		t.Errorf("exchange got %q/%q/%q", ex.gotCode, ex.gotDevice, ex.gotVerifier)
+	}
+	// ...and the resolved vk id must be the one forwarded to the backend.
+	if gotExternalID != "777" {
+		t.Errorf("backend external_id = %q, want 777", gotExternalID)
+	}
+	if string(fb.GetRootAsLinkResult(payload, 0).Status()) != "linked" {
+		t.Error("expected a linked result")
+	}
+}
+
+func TestLinkVKUnregisteredWithoutExchanger(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(http.ResponseWriter, *http.Request) {})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	if _, ok := reg.Lookup(transcode.MsgLinkVK); ok {
+		t.Error("link.vk.confirm must be unregistered when no VK ID exchanger is configured")
+	}
+	if _, ok := reg.Lookup(transcode.MsgLinkVKMerge); ok {
+		t.Error("link.vk.merge must be unregistered when no VK ID exchanger is configured")
+	}
+}

gateway/internal/vkid/vkid.go

@@ -0,0 +1,163 @@
+// Package vkid completes VK ID web authorization on the server. A browser linking a
+// VK identity has no signed Mini App launch parameters (that offline HMAC path is
+// vkauth); instead the frontend runs the VK ID raw OAuth 2.1 flow (PKCE) and hands the
+// gateway the authorization code, which the gateway exchanges — confidentially, under
+// the app's protected key — for the launching user's trusted VK id. Unlike the Mini App
+// path this makes an outbound call to VK (there is no offline verification for the web
+// flow). See docs/ARCHITECTURE.md §12.
+package vkid
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+const (
+	// tokenEndpoint is VK ID's OAuth 2.1 token endpoint. The frontend obtains the
+	// authorization code against the same host, so the confidential exchange targets it
+	// too. It is a fixed constant (not user input), so the outbound request carries no
+	// SSRF risk.
+	tokenEndpoint = "https://id.vk.com/oauth2/auth"
+	// exchangeTimeout bounds one code-for-token exchange. Linking is interactive, so an
+	// unreachable VK must fail fast rather than hold the request open.
+	exchangeTimeout = 10 * time.Second
+	// maxResponseBytes caps the token-response read to bound memory on an oversized body.
+	maxResponseBytes = 1 << 16
+)
+
+// ErrInvalid reports an authorization fault: the exchange was rejected or yielded no vk
+// user id (a bad or expired code, a mismatched verifier or redirect). It is distinct
+// from a transport failure reaching VK, which surfaces as a wrapped error.
+var ErrInvalid = errors.New("vkid: vk id authorization exchange failed")
+
+// Identity is the user resolved from a completed VK ID exchange. ExternalID is the vk
+// user id, used as the identities external_id.
+type Identity struct {
+	ExternalID string
+}
+
+// numericID accepts a VK user id that the token endpoint returns inconsistently as a
+// JSON string or a JSON number, normalising both to their decimal string form (empty
+// for a null or absent field).
+type numericID string
+
+func (n *numericID) UnmarshalJSON(b []byte) error {
+	s := strings.Trim(string(b), `"`)
+	if s == "null" {
+		s = ""
+	}
+	*n = numericID(s)
+	return nil
+}
+
+// Exchanger completes VK ID confidential authorization-code exchanges for one app.
+type Exchanger struct {
+	appID        string
+	clientSecret string
+	redirectURI  string
+	endpoint     string
+	httpClient   *http.Client
+}
+
+// New constructs an Exchanger for the app credentials. redirectURI must equal the
+// trusted redirect URL registered with the app and the one the frontend used, or VK
+// rejects the exchange.
+func New(appID, clientSecret, redirectURI string) *Exchanger {
+	return &Exchanger{
+		appID:        appID,
+		clientSecret: clientSecret,
+		redirectURI:  redirectURI,
+		endpoint:     tokenEndpoint,
+		httpClient:   &http.Client{Timeout: exchangeTimeout},
+	}
+}
+
+// Exchange completes the authorization-code grant and returns the trusted vk user id.
+// code, deviceID and codeVerifier are the PKCE inputs the frontend obtained from the VK
+// ID authorization redirect; the exchange authenticates with the app's protected key.
+func (e *Exchanger) Exchange(ctx context.Context, code, deviceID, codeVerifier string) (Identity, error) {
+	if code == "" || deviceID == "" || codeVerifier == "" {
+		return Identity{}, ErrInvalid
+	}
+	form := url.Values{
+		"grant_type":    {"authorization_code"},
+		"code":          {code},
+		"code_verifier": {codeVerifier},
+		"device_id":     {deviceID},
+		"client_id":     {e.appID},
+		"client_secret": {e.clientSecret},
+		"redirect_uri":  {e.redirectURI},
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, e.endpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return Identity{}, fmt.Errorf("vkid: build exchange request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
+	resp, err := e.httpClient.Do(req)
+	if err != nil {
+		return Identity{}, fmt.Errorf("vkid: exchange request: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes))
+	if err != nil {
+		return Identity{}, fmt.Errorf("vkid: read exchange response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		// VK answers 400 with {error, error_description} on a bad/expired code or a
+		// verifier/redirect mismatch — an authorization fault, not a transport error.
+		return Identity{}, ErrInvalid
+	}
+	var out struct {
+		UserID  numericID `json:"user_id"`
+		IDToken string    `json:"id_token"`
+		Error   string    `json:"error"`
+	}
+	if err := json.Unmarshal(body, &out); err != nil {
+		return Identity{}, ErrInvalid
+	}
+	if out.Error != "" {
+		return Identity{}, ErrInvalid
+	}
+	uid := string(out.UserID)
+	if uid == "" || uid == "0" {
+		uid = subjectFromIDToken(out.IDToken)
+	}
+	if uid == "" {
+		return Identity{}, ErrInvalid
+	}
+	return Identity{ExternalID: uid}, nil
+}
+
+// subjectFromIDToken extracts the OIDC subject (the vk user id) from the payload of a
+// VK ID id_token. The token arrives inside a direct TLS response from VK, so its
+// signature is not re-verified here; the claim is only a fallback for a response that
+// omits an explicit user_id.
+func subjectFromIDToken(idToken string) string {
+	parts := strings.Split(idToken, ".")
+	if len(parts) != 3 {
+		return ""
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return ""
+	}
+	var claims struct {
+		Sub numericID `json:"sub"`
+	}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return ""
+	}
+	if s := string(claims.Sub); s != "0" {
+		return s
+	}
+	return ""
+}

gateway/internal/vkid/vkid_test.go

@@ -0,0 +1,131 @@
+package vkid
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+// testExchanger builds an Exchanger pointed at a test server.
+func testExchanger(endpoint string) *Exchanger {
+	return &Exchanger{
+		appID:        "app-1",
+		clientSecret: "secret-1",
+		redirectURI:  "https://example.test/app/",
+		endpoint:     endpoint,
+		httpClient:   &http.Client{},
+	}
+}
+
+func TestExchangeSuccessSendsConfidentialPKCE(t *testing.T) {
+	var gotForm url.Values
+	var gotContentType string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotContentType = r.Header.Get("Content-Type")
+		body, _ := io.ReadAll(r.Body)
+		gotForm, _ = url.ParseQuery(string(body))
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"user_id":"12345","access_token":"a","id_token":"h.e.s"}`)
+	}))
+	defer srv.Close()
+
+	id, err := testExchanger(srv.URL).Exchange(context.Background(), "the-code", "dev-9", "verifier-xyz")
+	if err != nil {
+		t.Fatalf("Exchange: %v", err)
+	}
+	if id.ExternalID != "12345" {
+		t.Fatalf("ExternalID = %q, want 12345", id.ExternalID)
+	}
+	if gotContentType != "application/x-www-form-urlencoded" {
+		t.Errorf("Content-Type = %q", gotContentType)
+	}
+	// The confidential exchange must carry the PKCE inputs and the app credentials.
+	want := map[string]string{
+		"grant_type":    "authorization_code",
+		"code":          "the-code",
+		"code_verifier": "verifier-xyz",
+		"device_id":     "dev-9",
+		"client_id":     "app-1",
+		"client_secret": "secret-1",
+		"redirect_uri":  "https://example.test/app/",
+	}
+	for k, v := range want {
+		if gotForm.Get(k) != v {
+			t.Errorf("form[%s] = %q, want %q", k, gotForm.Get(k), v)
+		}
+	}
+}
+
+func TestExchangeAcceptsNumericUserID(t *testing.T) {
+	// VK returns user_id as a bare JSON number in some responses; it must parse too.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, `{"user_id":1234567890,"access_token":"a"}`)
+	}))
+	defer srv.Close()
+
+	id, err := testExchanger(srv.URL).Exchange(context.Background(), "c", "d", "v")
+	if err != nil {
+		t.Fatalf("Exchange: %v", err)
+	}
+	if id.ExternalID != "1234567890" {
+		t.Fatalf("ExternalID = %q, want 1234567890", id.ExternalID)
+	}
+}
+
+func TestExchangeFallsBackToIDTokenSub(t *testing.T) {
+	sub := "987654321"
+	payload := base64.RawURLEncoding.EncodeToString([]byte(`{"sub":"` + sub + `"}`))
+	idToken := "header." + payload + ".sig"
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, `{"access_token":"a","id_token":"`+idToken+`"}`)
+	}))
+	defer srv.Close()
+
+	id, err := testExchanger(srv.URL).Exchange(context.Background(), "c", "d", "v")
+	if err != nil {
+		t.Fatalf("Exchange: %v", err)
+	}
+	if id.ExternalID != sub {
+		t.Fatalf("ExternalID = %q, want %q (from id_token sub)", id.ExternalID, sub)
+	}
+}
+
+func TestExchangeRejectedIsErrInvalid(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = io.WriteString(w, `{"error":"invalid_grant","error_description":"code expired"}`)
+	}))
+	defer srv.Close()
+
+	_, err := testExchanger(srv.URL).Exchange(context.Background(), "c", "d", "v")
+	if !errors.Is(err, ErrInvalid) {
+		t.Fatalf("err = %v, want ErrInvalid", err)
+	}
+}
+
+func TestExchangeEmptyInputsFailFast(t *testing.T) {
+	// Missing PKCE inputs are rejected without any network call.
+	ex := testExchanger("http://127.0.0.1:0/never")
+	for _, args := range [][3]string{{"", "d", "v"}, {"c", "", "v"}, {"c", "d", ""}} {
+		if _, err := ex.Exchange(context.Background(), args[0], args[1], args[2]); !errors.Is(err, ErrInvalid) {
+			t.Errorf("Exchange%v err = %v, want ErrInvalid", args, err)
+		}
+	}
+}
+
+func TestExchangeTransportErrorIsNotErrInvalid(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	srv.Close() // closed listener → connection refused
+	_, err := testExchanger(srv.URL).Exchange(context.Background(), "c", "d", "v")
+	if err == nil {
+		t.Fatal("want a transport error")
+	}
+	if errors.Is(err, ErrInvalid) {
+		t.Fatalf("transport error must not be ErrInvalid: %v", err)
+	}
+}

gateway/internal/webui/webui.go

@@ -17,6 +17,7 @@ package webui
 import (
 	"embed"
 	"io/fs"
+	"mime"
 	"net/http"
 	"path"
 	"strings"
@@ -35,13 +36,25 @@ func distFS() fs.FS {
 	return sub
 }
 
-// Handler serves the embedded UI. An existing file is served directly (hash-named assets get
-// an immutable cache); every other path falls back to indexName (the SPA shell) so a
-// client-side deep link still loads. When stripPrefix is non-empty it is removed from the
-// request path before lookup, so the same build serves under a sub-path (e.g. "/app/" or
-// "/telegram/").
+// init registers the MIME type for .webmanifest, which Go's built-in table lacks and the
+// distroless runtime image has no /etc/mime.types to supply. Without it the PWA Web App Manifest
+// served under /app/ would be content-sniffed to text/plain, which some browsers reject.
+func init() {
+	_ = mime.AddExtensionType(".webmanifest", "application/manifest+json")
+}
+
+// Handler serves the compile-time embedded UI build over the public edge — the game SPA under
+// /app/, /telegram/ and /vk/. It delegates to handlerFor over the embedded dist/.
 func Handler(stripPrefix, indexName string) http.Handler {
-	content := distFS()
+	return handlerFor(distFS(), stripPrefix, indexName)
+}
+
+// handlerFor serves content as the UI: an existing file is served directly (hash-named assets get
+// an immutable cache); every other path falls back to indexName (the SPA shell) so a client-side
+// deep link still loads. When stripPrefix is non-empty it is removed from the request path before
+// lookup, so the same build serves under a sub-path (e.g. "/app/" or "/telegram/"). Split from
+// Handler so it can be exercised over an in-memory fs.FS in tests.
+func handlerFor(content fs.FS, stripPrefix, indexName string) http.Handler {
 	files := http.FileServer(http.FS(content))
 	h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		name := strings.TrimPrefix(path.Clean("/"+r.URL.Path), "/")

gateway/internal/webui/webui_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"testing/fstest"
 )
 
 // get drives the handler with a GET for the given path and returns the response.
@@ -55,3 +56,56 @@ func TestAppMountServesShellStripsPrefixAndCachesAssets(t *testing.T) {
 		}
 	}
 }
+
+// testFS mirrors what Vite emits into dist/: the SPA shell, the PWA manifest + service worker at
+// the root (copied from ui/public), and a hash-named asset. The compile-time embedded dist/ holds
+// only a placeholder shell, so the manifest/sw.js serving is exercised over this in-memory FS.
+func testFS() fstest.MapFS {
+	return fstest.MapFS{
+		"index.html":           {Data: []byte("<!doctype html><title>shell</title>")},
+		"manifest.webmanifest": {Data: []byte(`{"name":"Эрудит"}`)},
+		"sw.js":                {Data: []byte("self.addEventListener('fetch', () => {});")},
+		"assets/app-abc123.js": {Data: []byte("export const x = 1;")},
+	}
+}
+
+// TestHandlerServesManifestWithManifestType: the PWA manifest is served with the manifest MIME
+// type (registered in init, since the distroless image has no /etc/mime.types), not sniffed to
+// text/plain, which some browsers reject.
+func TestHandlerServesManifestWithManifestType(t *testing.T) {
+	h := handlerFor(testFS(), "/app/", "index.html")
+	resp := get(t, h, "/app/manifest.webmanifest")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "application/manifest+json") {
+		t.Errorf("Content-Type = %q, want application/manifest+json", ct)
+	}
+}
+
+// TestHandlerServesServiceWorkerAsJavaScript: sw.js is served as JavaScript from the root, so its
+// registration (scope /app/) succeeds.
+func TestHandlerServesServiceWorkerAsJavaScript(t *testing.T) {
+	h := handlerFor(testFS(), "/app/", "index.html")
+	resp := get(t, h, "/app/sw.js")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "text/javascript") {
+		t.Errorf("Content-Type = %q, want text/javascript", ct)
+	}
+}
+
+// TestHandlerFallsBackToShellForUnknownManifestPath guards the trap: a manifest/sw path NOT emitted
+// into dist/ falls back to the SPA shell as text/html, on which SW registration would fail. The two
+// tests above pin that the real files are served instead of the shell.
+func TestHandlerFallsBackToShellForUnknownManifestPath(t *testing.T) {
+	h := handlerFor(testFS(), "/app/", "index.html")
+	resp := get(t, h, "/app/not-emitted.webmanifest")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "text/html") {
+		t.Errorf("Content-Type = %q, want text/html (SPA shell fallback)", ct)
+	}
+}

pkg/fbs/scrabble.fbs

@@ -138,6 +138,11 @@ table EmailRequestRequest {
   email:string;
   browser_tz:string;
   language:string;
+  // Set when the request originates from an installed PWA (standalone display mode): the
+  // backend then omits the one-tap confirm link from the login email so the code is typed in
+  // the same window, avoiding a link that opens in a separate browser (a different storage
+  // context) where the minted session could not reach the PWA.
+  pwa:bool;
 }
 
 // EmailLoginRequest logs in to the account owning email (provisioned at the
@@ -180,10 +185,20 @@ table Ack {
 // BannerCampaign is one campaign in the rotation feed: a GCD-reduced show weight
 // (the client runs a smooth weighted round-robin over campaigns by this weight)
 // and its messages in display order, each already resolved to the viewer's bot
-// language (the stored en/ru pair is picked server-side).
+// language (the stored en/ru pair is picked server-side). The override_* colours
+// are an optional per-campaign palette: override_bg/fg/link paint the strip on
+// every theme, and the *_dark trio further overrides the dark theme (the client
+// resolves dark ← dark ?? all ?? token, light ← all ?? token). Empty means the
+// campaign keeps the neutral theme tokens (all added trailing — backward-compatible).
 table BannerCampaign {
   weight:int;
   messages:[string];
+  override_bg:string;
+  override_fg:string;
+  override_link:string;
+  override_bg_dark:string;
+  override_fg_dark:string;
+  override_link_dark:string;
 }
 
 // BannerInfo is the advertising-banner block of an eligible viewer's profile: the
@@ -501,6 +516,17 @@ table LinkTelegramRequest {
   data:string;
 }
 
+// LinkVKRequest carries a VK ID web authorization for attaching a VK identity to the
+// current account. The fields are the PKCE code-exchange inputs the frontend obtains
+// from the VK ID SDK (One Tap): the authorization code, the device id issued with it,
+// and the PKCE code verifier. The gateway completes the confidential code exchange
+// server-side (under the app's protected key) to obtain the trusted vk user id.
+table LinkVKRequest {
+  code:string;
+  device_id:string;
+  code_verifier:string;
+}
+
 // LinkUnlinkRequest detaches a platform identity (kind = "telegram" | "vk") from the
 // caller's account; email is never unlinked (it is changed).
 table LinkUnlinkRequest {

pkg/fbs/scrabblefb/BannerCampaign.go

@@ -70,8 +70,56 @@ func (rcv *BannerCampaign) MessagesLength() int {
 	return 0
 }
 
+func (rcv *BannerCampaign) OverrideBg() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(8))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideFg() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(10))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideLink() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(12))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideBgDark() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(14))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideFgDark() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(16))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideLinkDark() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(18))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
 func BannerCampaignStart(builder *flatbuffers.Builder) {
-	builder.StartObject(2)
+	builder.StartObject(8)
 }
 func BannerCampaignAddWeight(builder *flatbuffers.Builder, weight int32) {
 	builder.PrependInt32Slot(0, weight, 0)
@@ -82,6 +130,24 @@ func BannerCampaignAddMessages(builder *flatbuffers.Builder, messages flatbuffer
 func BannerCampaignStartMessagesVector(builder *flatbuffers.Builder, numElems int) flatbuffers.UOffsetT {
 	return builder.StartVector(4, numElems, 4)
 }
+func BannerCampaignAddOverrideBg(builder *flatbuffers.Builder, overrideBg flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(2, flatbuffers.UOffsetT(overrideBg), 0)
+}
+func BannerCampaignAddOverrideFg(builder *flatbuffers.Builder, overrideFg flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(3, flatbuffers.UOffsetT(overrideFg), 0)
+}
+func BannerCampaignAddOverrideLink(builder *flatbuffers.Builder, overrideLink flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(4, flatbuffers.UOffsetT(overrideLink), 0)
+}
+func BannerCampaignAddOverrideBgDark(builder *flatbuffers.Builder, overrideBgDark flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(5, flatbuffers.UOffsetT(overrideBgDark), 0)
+}
+func BannerCampaignAddOverrideFgDark(builder *flatbuffers.Builder, overrideFgDark flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(6, flatbuffers.UOffsetT(overrideFgDark), 0)
+}
+func BannerCampaignAddOverrideLinkDark(builder *flatbuffers.Builder, overrideLinkDark flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(7, flatbuffers.UOffsetT(overrideLinkDark), 0)
+}
 func BannerCampaignEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

pkg/fbs/scrabblefb/EmailRequestRequest.go

@@ -65,8 +65,20 @@ func (rcv *EmailRequestRequest) Language() []byte {
 	return nil
 }
 
+func (rcv *EmailRequestRequest) Pwa() bool {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(10))
+	if o != 0 {
+		return rcv._tab.GetBool(o + rcv._tab.Pos)
+	}
+	return false
+}
+
+func (rcv *EmailRequestRequest) MutatePwa(n bool) bool {
+	return rcv._tab.MutateBoolSlot(10, n)
+}
+
 func EmailRequestRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(3)
+	builder.StartObject(4)
 }
 func EmailRequestRequestAddEmail(builder *flatbuffers.Builder, email flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(email), 0)
@@ -77,6 +89,9 @@ func EmailRequestRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz fla
 func EmailRequestRequestAddLanguage(builder *flatbuffers.Builder, language flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(2, flatbuffers.UOffsetT(language), 0)
 }
+func EmailRequestRequestAddPwa(builder *flatbuffers.Builder, pwa bool) {
+	builder.PrependBoolSlot(3, pwa, false)
+}
 func EmailRequestRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

pkg/fbs/scrabblefb/LinkVKRequest.go

@@ -0,0 +1,82 @@
+// Code generated by the FlatBuffers compiler. DO NOT EDIT.
+
+package scrabblefb
+
+import (
+	flatbuffers "github.com/google/flatbuffers/go"
+)
+
+type LinkVKRequest struct {
+	_tab flatbuffers.Table
+}
+
+func GetRootAsLinkVKRequest(buf []byte, offset flatbuffers.UOffsetT) *LinkVKRequest {
+	n := flatbuffers.GetUOffsetT(buf[offset:])
+	x := &LinkVKRequest{}
+	x.Init(buf, n+offset)
+	return x
+}
+
+func FinishLinkVKRequestBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.Finish(offset)
+}
+
+func GetSizePrefixedRootAsLinkVKRequest(buf []byte, offset flatbuffers.UOffsetT) *LinkVKRequest {
+	n := flatbuffers.GetUOffsetT(buf[offset+flatbuffers.SizeUint32:])
+	x := &LinkVKRequest{}
+	x.Init(buf, n+offset+flatbuffers.SizeUint32)
+	return x
+}
+
+func FinishSizePrefixedLinkVKRequestBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.FinishSizePrefixed(offset)
+}
+
+func (rcv *LinkVKRequest) Init(buf []byte, i flatbuffers.UOffsetT) {
+	rcv._tab.Bytes = buf
+	rcv._tab.Pos = i
+}
+
+func (rcv *LinkVKRequest) Table() flatbuffers.Table {
+	return rcv._tab
+}
+
+func (rcv *LinkVKRequest) Code() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(4))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *LinkVKRequest) DeviceId() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *LinkVKRequest) CodeVerifier() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(8))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func LinkVKRequestStart(builder *flatbuffers.Builder) {
+	builder.StartObject(3)
+}
+func LinkVKRequestAddCode(builder *flatbuffers.Builder, code flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(code), 0)
+}
+func LinkVKRequestAddDeviceId(builder *flatbuffers.Builder, deviceId flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(deviceId), 0)
+}
+func LinkVKRequestAddCodeVerifier(builder *flatbuffers.Builder, codeVerifier flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(2, flatbuffers.UOffsetT(codeVerifier), 0)
+}
+func LinkVKRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
+	return builder.EndObject()
+}

ui/e2e/install.spec.ts

@@ -0,0 +1,59 @@
+import { expect, test } from './fixtures';
+
+// The install CTA (components/InstallApp.svelte) is platform-adaptive: a one-tap button where the
+// browser offers a beforeinstallprompt (Chromium), a manual instructions modal on iOS Safari, and
+// nothing elsewhere / once installed / inside a Mini App. The native OS install dialog is
+// browser-level and not drivable from Playwright, so these assert the CTA's presence and branch.
+
+const IPHONE_SAFARI =
+  'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1';
+
+test('web: a captured install prompt shows the one-tap CTA and clicking it prompts', async ({ page }) => {
+  await page.goto('/');
+  // The web login screen is shown (an ordinary browser tab, not a Mini App).
+  await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
+
+  // Hidden until the browser offers installation (Playwright never fires beforeinstallprompt).
+  await expect(page.getByRole('button', { name: /Install the app/i })).toHaveCount(0);
+
+  // Simulate Chromium offering the install: dispatch a beforeinstallprompt the app can capture.
+  await page.evaluate(() => {
+    const e = new Event('beforeinstallprompt') as Event & {
+      prompt?: () => Promise<void>;
+      userChoice?: Promise<unknown>;
+    };
+    (window as unknown as { __promptCalled: boolean }).__promptCalled = false;
+    e.prompt = () => {
+      (window as unknown as { __promptCalled: boolean }).__promptCalled = true;
+      return Promise.resolve();
+    };
+    e.userChoice = Promise.resolve({ outcome: 'accepted', platform: '' });
+    window.dispatchEvent(e);
+  });
+
+  const cta = page.getByRole('button', { name: /Install the app/i });
+  await expect(cta).toBeVisible();
+  await cta.click();
+  // Clicking calls the captured prompt (the native dialog itself is not observable here).
+  await expect
+    .poll(() => page.evaluate(() => (window as unknown as { __promptCalled: boolean }).__promptCalled))
+    .toBe(true);
+});
+
+test.describe('iOS Safari', () => {
+  test.use({ userAgent: IPHONE_SAFARI });
+
+  test('shows manual Add-to-Home-Screen instructions (no programmatic install)', async ({ page }) => {
+    await page.goto('/');
+    await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
+
+    // On iOS Safari the CTA shows at once (no beforeinstallprompt is ever fired there).
+    const cta = page.getByRole('button', { name: /Install the app/i });
+    await expect(cta).toBeVisible();
+    await cta.click();
+
+    // It opens the app's own instructions modal (not a native / Telegram popup).
+    await expect(page.getByRole('heading', { name: 'Add to Home Screen' })).toBeVisible();
+    await expect(page.getByText(/Tap the Share button/)).toBeVisible();
+  });
+});

ui/e2e/landing.spec.ts

@@ -46,3 +46,15 @@ test('the landing is a normal scrolling document (the SPA document-pin does not
   expect(state.shell).toBe(false);
   expect(state.bodyPosition).not.toBe('fixed');
 });
+
+// The web-version entry (/app/) is always present, alongside the build-var-gated Telegram/VK ones
+// (absent here, since e2e sets no VITE_* vars), each with a caption.
+test('the landing shows a web-version entry linking /app/, with a caption', async ({ page }) => {
+  await page.goto('/landing.html');
+  await expect(page.getByText(/Играй в «Эрудита»/)).toBeVisible(); // Russian by default
+
+  const web = page.getByRole('link', { name: 'Играть в браузере' });
+  await expect(web).toBeVisible();
+  expect(await web.getAttribute('href')).toContain('/app/');
+  await expect(page.getByText('Веб-версия')).toBeVisible();
+});

ui/e2e/maintenance.spec.ts

@@ -0,0 +1,38 @@
+import { expect, test } from './fixtures';
+
+// The maintenance overlay is raised in prod by the edge 503 marker (X-Scrabble-Maintenance);
+// the mock transport never produces one, so — like the offline indicator — the e2e drives it
+// through the window.__maint hook (gateway.ts, mock-only). It is app-global (mounted outside
+// the route blocks in App.svelte), so it shows without a session.
+test('maintenance overlay covers the app and lifts on recovery', async ({ page }) => {
+  await page.goto('/');
+  await expect(page.getByRole('alertdialog')).toHaveCount(0);
+
+  // A planned deploy window begins: a non-dismissable dimmed overlay covers the app.
+  await page.evaluate(() => (window as unknown as { __maint: { on(): void } }).__maint.on());
+  const overlay = page.getByRole('alertdialog');
+  await expect(overlay).toBeVisible();
+  // The retry button is present (EN "Try again" / RU "Повторить" depending on locale).
+  await expect(overlay.getByRole('button', { name: /again|Повторить/i })).toBeVisible();
+
+  // The window ends — in prod the store's poll lifts it on the first successful read; the mock
+  // has no probe, so it clears explicitly. The overlay disappears with no page reload.
+  await page.evaluate(() => (window as unknown as { __maint: { off(): void } }).__maint.off());
+  await expect(page.getByRole('alertdialog')).toHaveCount(0);
+});
+
+test('recovery reloads the SPA to pick up the fresh client', async ({ page }) => {
+  await page.goto('/');
+  await page.evaluate(() => (window as unknown as { __maint: { on(): void } }).__maint.on());
+  await expect(page.getByRole('alertdialog')).toBeVisible();
+
+  // Real recovery reloads the page (the deploy may have shipped an incompatible client, and the
+  // running bundle is the old one). Wait for the forced navigation, then confirm the app
+  // re-bootstrapped: the overlay is gone (the store reset by the reload) and the login is back.
+  await Promise.all([
+    page.waitForEvent('load'),
+    page.evaluate(() => (window as unknown as { __maint: { recover(): void } }).__maint.recover()),
+  ]);
+  await expect(page.getByRole('alertdialog')).toHaveCount(0);
+  await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
+});

ui/e2e/social.spec.ts

@@ -327,6 +327,36 @@ test('change email: a free address replaces the current one', async ({ page }) =
   await expect(page.getByText('you@example.com')).toHaveCount(0);
 });
 
+// The add-email confirmation can complete out of band: the recipient taps the one-tap link in the
+// email, which confirms in another browser/session. A backgrounded Mini App misses the live
+// 'profile' event (the stream is single-shot, no replay), so the open code form falls back to
+// polling the profile until the address lands. The mock attaches the email WITHOUT emitting an
+// event, so only the poll can surface it.
+test('add email: an out-of-band confirmation surfaces on the open form via polling', async ({ page }) => {
+  await loginLobby(page);
+  await openProfile(page);
+
+  // Drop the seeded email so the sign-in section offers the add-email flow.
+  await page.evaluate(() => (window as unknown as { __mock: { clearEmail(): void } }).__mock.clearEmail());
+  const emailInput = page.locator('.accounts input[type="email"]');
+  await expect(emailInput).toBeVisible();
+
+  await emailInput.fill('linked@example.com');
+  await page.getByRole('button', { name: 'Send code' }).click();
+  await expect(page.locator('.accounts .codein')).toBeVisible();
+
+  // Confirmed elsewhere via the one-tap link, with no live event delivered: only the poll surfaces it.
+  await page.evaluate(() =>
+    (
+      window as unknown as { __mock: { confirmEmailOutOfBand(email: string): void } }
+    ).__mock.confirmEmailOutOfBand('linked@example.com'),
+  );
+
+  // The confirmed address surfaces as the email row, and the code form is gone.
+  await expect(page.locator('.acctrow').filter({ hasText: 'linked@example.com' })).toBeVisible({ timeout: 10000 });
+  await expect(page.locator('.accounts .codein')).toHaveCount(0);
+});
+
 test('link then unlink Telegram from the sign-in methods', async ({ page }) => {
   await loginLobby(page);
   await openProfile(page);

ui/index.html

@@ -2,6 +2,240 @@
 <html lang="ru">
   <head>
     <meta charset="UTF-8" />
+    <!-- Boot capability guard. Runs before the deferred ES module, in plain ES5 so it survives even
+         on an engine too old to parse the bundle. Three jobs, as early as possible:
+           1. Hard gate — if an UNPOLYFILLABLE essential is missing (BigInt for the 64-bit
+              FlatBuffers wire decode, Proxy for Svelte 5 runes) the app cannot run at all: show the
+              unsupported-engine screen (an old Android System WebView, e.g. Chromium 66, is the case
+              this guards) instead of a white screen.
+           2. Soft gate — if only polyfillable es2020+ globals are missing (globalThis,
+              structuredClone, Array.at, …) pull core-js (emitted as polyfills.js) BEFORE the module
+              runs. document.write is deliberate: the only way to inject a parser-blocking <script>
+              guaranteed to run ahead of a deferred module; its argument is a static literal, so no
+              injection surface.
+           3. Reactive net — record any uncaught error/rejection during boot; if the app has not
+              signalled window.__booted within a grace period AND an error fired, show the same
+              screen with the captured cause (covers a bundle that fails to parse, or an unforeseen
+              incompatibility). __booted is set in App.svelte once bootstrap resolves.
+         The screen has a "Diagnostic information" view (engine + feature table + reason + version)
+         with a Copy button. On a capable engine nothing here renders, so neither the bundle-size
+         budget nor the mock e2e is affected. -->
+    <script>
+      (function () {
+        'use strict';
+        var nav = navigator;
+        var ua = nav.userAgent || '';
+        var VERSION = '__BOOT_VERSION__'; // replaced at build (vite.config injectBootVersion)
+        var RU = (nav.language || '').toLowerCase().indexOf('ru') === 0;
+        var MINIAPP = /\/(?:telegram|vk)\//.test(location.pathname);
+        var WEBURL = location.protocol + '//' + location.host + '/app/';
+
+        // [label, test, Chrome version it landed in, hard?] — hard = required and unpolyfillable.
+        function has(fn) {
+          try {
+            return !!fn();
+          } catch (e) {
+            return false;
+          }
+        }
+        var probes = [
+          ['BigInt', function () { return typeof BigInt !== 'undefined'; }, 67, true],
+          ['Proxy', function () { return typeof Proxy !== 'undefined'; }, 49, true],
+          ['globalThis', function () { return typeof globalThis !== 'undefined'; }, 71, false],
+          ['structuredClone', function () { return typeof structuredClone === 'function'; }, 98, false],
+          ['Array.prototype.at', function () { return typeof [].at === 'function'; }, 92, false],
+          ['Array.prototype.findLast', function () { return typeof [].findLast === 'function'; }, 97, false],
+          ['Object.hasOwn', function () { return typeof Object.hasOwn === 'function'; }, 93, false],
+          ['Object.fromEntries', function () { return typeof Object.fromEntries === 'function'; }, 73, false],
+          ['Promise.allSettled', function () { return !!Promise.allSettled; }, 76, false],
+          ['Promise.any', function () { return !!Promise.any; }, 85, false],
+          ['WeakRef', function () { return typeof WeakRef !== 'undefined'; }, 84, false],
+          ['queueMicrotask', function () { return typeof queueMicrotask === 'function'; }, 71, false]
+        ];
+        var results = [];
+        var hardMissing = [];
+        var softMissing = false;
+        for (var i = 0; i < probes.length; i++) {
+          var ok = has(probes[i][1]);
+          results.push({ name: probes[i][0], ok: ok, chrome: probes[i][2], hard: probes[i][3] });
+          if (!ok) {
+            if (probes[i][3]) hardMissing.push(probes[i][0]);
+            else softMissing = true;
+          }
+        }
+
+        // The diagnostic report (built on demand, behind the button).
+        function diag(reason) {
+          var cm = /Chrom(?:e|ium)\/(\d+)/.exec(ua);
+          var wv = /;\s*wv\)/.test(ua) || /\bwv\b/.test(ua);
+          var out = [];
+          out.push('reason    : ' + reason);
+          out.push('app       : ' + VERSION);
+          out.push('chromium  : ' + (cm ? cm[1] : 'n/a') + (wv ? ' (Android WebView)' : ''));
+          out.push('userAgent : ' + ua);
+          out.push('url       : ' + location.href);
+          out.push('viewport  : ' + window.innerWidth + 'x' + window.innerHeight + ' @' + (window.devicePixelRatio || 1));
+          out.push('lang      : ' + (nav.language || '?') + '   online: ' + nav.onLine);
+          out.push('');
+          out.push('features:');
+          for (var k = 0; k < results.length; k++) {
+            var r = results[k];
+            out.push('  ' + (r.ok ? 'OK' : 'NO') + '  ' + r.name + '  (' + (r.hard ? 'required' : 'polyfilled') + ', Chrome ' + r.chrome + ')');
+          }
+          return out.join('\n');
+        }
+
+        function el(tag, style, text) {
+          var e = document.createElement(tag);
+          if (style) e.setAttribute('style', style);
+          if (text != null) e.appendChild(document.createTextNode(text));
+          return e;
+        }
+        function btn(bg, fg) {
+          return 'display:inline-block;margin:0 10px 10px 0;padding:11px 18px;border:0;border-radius:8px;' +
+            'font:600 15px/1 inherit;cursor:pointer;color:' + fg + ';background:' + bg + ';';
+        }
+
+        var shown = false;
+        // Fire-and-forget beacon so the gateway can count who hits this screen (Grafana). Deduped
+        // in localStorage by app version + reason + Chromium, so a user reopening the app ten times
+        // is one report. sendBeacon (Chrome 39+, present on the engines that reach here) with a
+        // fetch fallback; both are best-effort and never block or throw.
+        function beacon(code) {
+          try {
+            var cm = /Chrom(?:e|ium)\/(\d+)/.exec(ua);
+            var chromium = cm ? cm[1] : '';
+            var sig = VERSION + '|' + code + '|' + chromium;
+            try {
+              if (localStorage.getItem('scrabble_unsupp') === sig) return;
+            } catch (e) {}
+            var payload = JSON.stringify({ reason: code, chromium: chromium, version: VERSION, ua: ua });
+            var sent = false;
+            try {
+              if (nav.sendBeacon) sent = nav.sendBeacon('/telemetry/unsupported', new Blob([payload], { type: 'application/json' }));
+            } catch (e) {}
+            if (!sent && typeof fetch === 'function') {
+              try {
+                fetch('/telemetry/unsupported', { method: 'POST', body: payload, headers: { 'Content-Type': 'application/json' }, keepalive: true }).catch(function () {});
+                sent = true;
+              } catch (e) {}
+            }
+            if (sent) {
+              try {
+                localStorage.setItem('scrabble_unsupp', sig);
+              } catch (e) {}
+            }
+          } catch (e) {}
+        }
+        function show(reason, code) {
+          if (shown) return;
+          shown = true;
+          beacon(code);
+          var root = el('div', 'position:fixed;left:0;top:0;right:0;bottom:0;z-index:2147483647;overflow:auto;' +
+            '-webkit-overflow-scrolling:touch;background:#0f1115;color:#e8eaed;box-sizing:border-box;padding:24px;' +
+            'font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Arial,sans-serif;');
+          var wrap = el('div', 'max-width:520px;margin:0 auto;');
+          root.appendChild(wrap);
+
+          var msg = el('div', null);
+          msg.appendChild(el('div', 'font-size:22px;font-weight:700;margin-bottom:14px;', 'Эрудит'));
+          msg.appendChild(el('p', 'margin:0 0 14px;', RU
+            ? 'На вашей версии операционной системы или браузера приложение не сможет работать.'
+            : "This app can't run on your device's operating system or browser version."));
+          if (MINIAPP) {
+            msg.appendChild(el('p', 'margin:0 0 6px;', RU
+              ? 'Откройте веб-версию в обычном браузере (Chrome, Firefox):'
+              : 'Open the web version in a regular browser (Chrome, Firefox):'));
+            var a = el('a', 'color:#8ab4ff;word-break:break-all;', WEBURL);
+            a.setAttribute('href', WEBURL);
+            a.setAttribute('target', '_blank');
+            a.setAttribute('rel', 'noopener');
+            var lp = el('p', 'margin:0 0 18px;');
+            lp.appendChild(a);
+            msg.appendChild(lp);
+          }
+          var infoBtn = el('button', btn('#2a2f3a', '#e8eaed'), RU ? 'Диагностическая информация' : 'Diagnostic information');
+          msg.appendChild(infoBtn);
+          wrap.appendChild(msg);
+
+          var dv = el('div', 'display:none;');
+          var pre = el('pre', 'white-space:pre-wrap;word-break:break-word;background:#0b0d11;border-radius:8px;padding:12px;' +
+            'font:12.5px/1.45 ui-monospace,Menlo,Consolas,monospace;overflow:auto;', diag(reason));
+          dv.appendChild(pre);
+          var copyBtn = el('button', btn('#8ab4ff', '#0b0d11'), RU ? 'Копировать' : 'Copy');
+          var backBtn = el('button', btn('#2a2f3a', '#e8eaed'), RU ? 'Назад' : 'Back');
+          var row = el('div', 'margin-top:12px;');
+          row.appendChild(copyBtn);
+          row.appendChild(backBtn);
+          dv.appendChild(row);
+          wrap.appendChild(dv);
+
+          infoBtn.onclick = function () {
+            msg.style.display = 'none';
+            dv.style.display = 'block';
+          };
+          backBtn.onclick = function () {
+            dv.style.display = 'none';
+            msg.style.display = 'block';
+          };
+          copyBtn.onclick = function () {
+            var txt = diag(reason);
+            try {
+              if (nav.clipboard && nav.clipboard.writeText) {
+                nav.clipboard.writeText(txt);
+                copyBtn.firstChild.nodeValue = RU ? 'Скопировано' : 'Copied';
+                return;
+              }
+            } catch (e) {}
+            try {
+              var ta = document.createElement('textarea');
+              ta.value = txt;
+              ta.setAttribute('style', 'position:fixed;left:-9999px;top:0;');
+              document.body.appendChild(ta);
+              ta.select();
+              document.execCommand('copy');
+              document.body.removeChild(ta);
+              copyBtn.firstChild.nodeValue = RU ? 'Скопировано' : 'Copied';
+            } catch (e2) {
+              copyBtn.firstChild.nodeValue = RU ? 'Выделите и скопируйте текст' : 'Select and copy the text';
+            }
+          };
+
+          function mount() {
+            document.body.insertBefore(root, document.body.firstChild);
+          }
+          if (document.body) mount();
+          else document.addEventListener('DOMContentLoaded', mount);
+        }
+
+        // 1 + 2: the gate.
+        if (hardMissing.length) {
+          show((RU ? 'нет: ' : 'missing: ') + hardMissing.join(', '), hardMissing.indexOf('BigInt') >= 0 ? 'no_bigint' : 'no_proxy');
+        } else if (softMissing) {
+          document.write('<script src="polyfills.js"><\/script>');
+        }
+
+        // 3: the reactive net for an unforeseen boot failure.
+        var bootErr = null;
+        function note(m) {
+          if (!bootErr) bootErr = m;
+        }
+        window.onerror = function (m, s, l, c, e) {
+          note(String(m) + (e && e.stack ? '\n' + e.stack : s ? ' @ ' + s + ':' + l : ''));
+          return false;
+        };
+        window.addEventListener('error', function (e) {
+          if (e && e.message) note(e.message + (e.filename ? ' @ ' + e.filename + ':' + e.lineno : ''));
+        }, true);
+        window.addEventListener('unhandledrejection', function (e) {
+          var r = e && e.reason;
+          note(r && (r.stack || r.message) ? r.stack || r.message : String(r));
+        });
+        setTimeout(function () {
+          if (!window.__booted && bootErr && !shown) show((RU ? 'ошибка запуска: ' : 'boot error: ') + bootErr, 'boot_error');
+        }, 8000);
+      })();
+    </script>
     <!-- The SPA shell is an empty client-rendered document behind the public landing — keep it
          out of search indexes (robots.txt deliberately does NOT disallow /app/, so crawlers can
          reach this tag). -->
@@ -22,6 +256,18 @@
     <link rel="icon" href="favicon.ico" sizes="32x32" />
     <link rel="icon" type="image/svg+xml" href="favicon.svg" />
     <link rel="apple-touch-icon" href="apple-touch-icon.png" />
+    <!-- PWA installability (web /app/ only): the manifest + a service worker (registered from
+         lib/pwa, web-only) let the app be added to the home screen / desktop. The relative href
+         resolves per serving path; these tags are inert inside the Telegram/VK Mini App webviews,
+         which manage their own chrome. theme-color mirrors the light/dark --bg tokens (app.css). -->
+    <link rel="manifest" href="manifest.webmanifest" />
+    <meta name="theme-color" content="#f3f4f6" media="(prefers-color-scheme: light)" />
+    <meta name="theme-color" content="#0f1115" media="(prefers-color-scheme: dark)" />
+    <meta name="mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="default" />
+    <meta name="apple-mobile-web-app-title" content="Эрудит" />
+    <meta name="application-name" content="Эрудит" />
   </head>
   <body>
     <div id="app"></div>

ui/package.json

@@ -27,6 +27,7 @@
     "@playwright/test": "^1.49.0",
     "@sveltejs/vite-plugin-svelte": "^5.0.0",
     "@types/node": "^22.10.0",
+    "core-js-bundle": "^3.49.0",
     "svelte": "^5.15.0",
     "svelte-check": "^4.1.0",
     "typescript": "^5.7.0",

ui/pnpm-lock.yaml

@@ -36,6 +36,9 @@ importers:
       '@types/node':
         specifier: ^22.10.0
         version: 22.19.19
+      core-js-bundle:
+        specifier: ^3.49.0
+        version: 3.49.0
       svelte:
         specifier: ^5.15.0
         version: 5.56.0
@@ -508,6 +511,9 @@ packages:
     resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
     engines: {node: '>=6'}
 
+  core-js-bundle@3.49.0:
+    resolution: {integrity: sha512-WXc7oOsePN3aKFOJVG5zQdi+h/Jm2W0WIPYvRc4IG3vkNcbC2w6LlSzTmnhOl6N1xmOJEzCSNieX3mwF+3zBGw==}
+
   debug@4.4.3:
     resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
     engines: {node: '>=6.0'}
@@ -1132,6 +1138,8 @@ snapshots:
 
   clsx@2.1.1: {}
 
+  core-js-bundle@3.49.0: {}
+
   debug@4.4.3:
     dependencies:
       ms: 2.1.3

ui/pnpm-workspace.yaml

@@ -1,4 +1,8 @@
 # pnpm 11 records build-script approval here. esbuild's postinstall materialises
 # its CLI shim; the platform binary itself ships as an optional dependency.
+# core-js-bundle ships a prebuilt minified.js (we only read that file at build time,
+# via vite.config emitPolyfills) and its install script is just a funding banner, so
+# it is denied — nothing to build.
 allowBuilds:
+  core-js-bundle: false
   esbuild: true

ui/public/manifest.webmanifest

@@ -0,0 +1,17 @@
+{
+  "name": "Эрудит (Скрэббл)",
+  "short_name": "Эрудит",
+  "description": "Игра в слова «Эрудит» (Скрэббл): играйте с друзьями, случайным соперником или ИИ-роботом.",
+  "lang": "ru",
+  "dir": "ltr",
+  "start_url": ".",
+  "scope": ".",
+  "display": "standalone",
+  "background_color": "#f3f4f6",
+  "theme_color": "#f3f4f6",
+  "icons": [
+    { "src": "icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
+    { "src": "icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
+    { "src": "icon-maskable-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
+  ]
+}

ui/public/sw.js

@@ -0,0 +1,53 @@
+// Install-only service worker.
+//
+// Its sole job today is to satisfy Chromium's PWA installability requirement (a registered
+// service worker with a fetch handler) so the web app can be installed to the home screen /
+// desktop — notably on Android, where the manifest alone is not enough. It deliberately does
+// NOT cache assets or the Connect-RPC stream: only top-level navigations are handled,
+// network-first with a cached-shell fallback, so the live app, its immutable hashed assets and
+// the live event stream are never served stale.
+//
+// This is the single designated growth point for the planned offline mode (a Settings toggle,
+// default online — see docs/ARCHITECTURE.md). Extend the fetch router here; keep the same
+// /app/ scope; gate any real caching behind the toggle and coordinate updates with the boot
+// version guard.
+const SHELL = 'scrabble-shell-v1'; // bump only when the SW strategy itself changes.
+
+self.addEventListener('install', () => {
+  // No cached content to migrate carefully, so activate the new worker immediately.
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(
+    (async () => {
+      const keys = await caches.keys();
+      await Promise.all(keys.filter((k) => k !== SHELL).map((k) => caches.delete(k)));
+      await self.clients.claim();
+    })(),
+  );
+});
+
+self.addEventListener('fetch', (event) => {
+  const req = event.request;
+  // Only top-level navigations are handled. Hashed assets and the Connect-RPC requests are
+  // left untouched (no respondWith -> the browser performs its default fetch), so the worker
+  // can never break the live stream or serve a stale immutable asset.
+  if (req.mode !== 'navigate') return;
+  event.respondWith(
+    (async () => {
+      try {
+        const res = await fetch(req);
+        const cache = await caches.open(SHELL);
+        // One shell entry regardless of the deep-link path: the hash router resolves the route
+        // client-side, so any offline navigation can be served the same cached shell.
+        cache.put('shell', res.clone());
+        return res;
+      } catch {
+        const cache = await caches.open(SHELL);
+        const cached = await cache.match('shell');
+        return cached ?? Response.error();
+      }
+    })(),
+  );
+});

ui/scripts/bundle-size.mjs

@@ -19,10 +19,11 @@ import { join } from 'node:path';
 
 const DIST = 'dist';
 
-// Per-chunk gzip budgets in KB. The app entry was raised to 110 when the local
-// move-preview wiring landed (the heavy dict subsystem stays in lazy chunks; this
-// covers the small in-entry game/debug wiring it needs).
-const BUDGET = { app: 110, shared: 30, landing: 5 };
+// Per-chunk gzip budgets in KB. The app entry was raised to 110 for the local move-preview
+// wiring, then to 112 for the PWA install feature (the install CTA + the pwa detection /
+// service-worker registration live in the app entry; the heavy dict subsystem stays in lazy
+// chunks). Its scoped CSS lands in the CSS chunk, not this JS budget.
+const BUDGET = { app: 112, shared: 30, landing: 5 };
 
 // gzipped returns the gzipped byte size of a built asset, or 0 when the reference is not a
 // local file (e.g. the Telegram SDK loaded from a CDN) or is missing.

ui/src/App.svelte

@@ -9,6 +9,7 @@
   import StaleInviteModal from './components/StaleInviteModal.svelte';
   import WelcomeRedeemModal from './components/WelcomeRedeemModal.svelte';
   import Coachmark from './components/Coachmark.svelte';
+  import MaintenanceOverlay from './components/MaintenanceOverlay.svelte';
   import DebugPanel from './components/DebugPanel.svelte';
   import Login from './screens/Login.svelte';
   import Lobby from './screens/Lobby.svelte';
@@ -25,7 +26,12 @@
   import TelegramLaunchError from './screens/TelegramLaunchError.svelte';
 
   onMount(() => {
-    void bootstrap();
+    // Tell the index.html boot guard that startup completed, so its reactive net does not raise the
+    // unsupported-engine screen on a healthy boot — it only fires when an uncaught error occurred
+    // AND this flag never sets (a bundle that failed to parse, or an unforeseen incompatibility).
+    void bootstrap().then(() => {
+      (window as unknown as { __booted?: boolean }).__booted = true;
+    });
   });
 
   // The lobby is the cold-start landing (an empty hash and Telegram launch params both parse
@@ -128,6 +134,7 @@
 <StaleInviteModal />
 <WelcomeRedeemModal />
 <Coachmark />
+<MaintenanceOverlay />
 
 {#if routeIsLobby && !app.splashDone && !app.blocked && !app.bootError && !app.launchError}
   <Splash />

ui/src/Landing.svelte

@@ -80,20 +80,26 @@
   <section class="hero">
     <h1>{about.title}</h1>
     <p class="tagline">{t('landing.tagline')}</p>
-    {#if tgLink || vkLink}
-      <div class="entries">
-        {#if tgLink}
-          <a class="entry" href={tgLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playTelegram')}>
-            <img src="telegram-logo.svg" alt="" width="64" height="64" />
-          </a>
-        {/if}
-        {#if vkLink}
-          <a class="entry" href={vkLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playVK')}>
-            <img src="vk-logo.svg" alt="" width="64" height="64" />
-          </a>
-        {/if}
-      </div>
-    {/if}
+    <!-- Platform entries: Telegram/VK are gated by their build vars; the web version (/app/) is
+         always available. A caption under each clarifies what it opens. -->
+    <div class="entries">
+      {#if tgLink}
+        <a class="entry" href={tgLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playTelegram')}>
+          <img src="telegram-logo.svg" alt="" width="64" height="64" />
+          <span class="caption">{t('landing.captionTelegram')}</span>
+        </a>
+      {/if}
+      {#if vkLink}
+        <a class="entry" href={vkLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playVK')}>
+          <img src="vk-logo.svg" alt="" width="64" height="64" />
+          <span class="caption">{t('landing.captionVK')}</span>
+        </a>
+      {/if}
+      <a class="entry" href="/app/" aria-label={t('landing.playWeb')}>
+        <img src="favicon.svg" alt="" width="64" height="64" />
+        <span class="caption">{t('landing.captionWeb')}</span>
+      </a>
+    </div>
   </section>
 
   <section class="info">
@@ -207,8 +213,8 @@
     color: var(--text-muted);
     font-size: 1.05rem;
   }
-  /* The platform entries are just the bigger logos in a row (no button chrome, no captions);
-     each link keeps an aria-label for assistive tech. */
+  /* The platform entries are the bigger logos in a row, each with a short caption below; the
+     link keeps an aria-label for assistive tech. */
   .entries {
     align-self: center;
     display: flex;
@@ -217,6 +223,11 @@
   }
   .entry {
     display: inline-flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 8px;
+    text-decoration: none;
+    color: var(--text);
   }
   .entry img {
     display: block;
@@ -225,6 +236,10 @@
   .entry:hover img {
     transform: scale(1.06);
   }
+  .caption {
+    font-size: 0.9rem;
+    color: var(--text-muted);
+  }
   .info {
     background: var(--surface-2);
     border-radius: var(--radius-sm);

ui/src/components/AdBanner.svelte

@@ -3,12 +3,14 @@
   import {
     attachBannerHost,
     bannerCurrent,
+    bannerCurrentColors,
     configureBanner,
     detachBannerHost,
     remeasureBanner,
   } from '../lib/bannerEngine';
   import { defaultBannerTimings, linkify, type BannerHost } from '../lib/banner';
-  import type { BannerCampaign, BannerTimings } from '../lib/model';
+  import { resolveBannerColors, type ThemeMode } from '../lib/bannerColors';
+  import type { BannerCampaign, BannerColors, BannerTimings } from '../lib/model';
   import { onExternalLinkClick } from '../lib/links';
 
   let {
@@ -21,12 +23,33 @@
   // current message and is visible at once (no fade — see inFade), so a screen change does not
   // replay the fade. Empty on the very first mount (engine not yet started).
   let current = $state(bannerCurrent());
+  let currentColors = $state<BannerColors>(bannerCurrentColors());
   let visible = $state(bannerCurrent() !== '');
   let tx = $state(0);
   let txDur = $state(0);
   let track = $state<HTMLElement>();
   let viewport = $state<HTMLElement>();
 
+  // The rendered theme (light/dark), tracked so a campaign's colour override resolves against the
+  // theme actually on screen and re-resolves live when the operator/OS flips it. It follows the
+  // [data-theme] attribute (theme.ts), or the OS preference when unset ('auto').
+  let themeMode = $state<ThemeMode>(resolveThemeMode());
+  function resolveThemeMode(): ThemeMode {
+    if (typeof document === 'undefined') return 'light';
+    const attr = document.documentElement.getAttribute('data-theme');
+    if (attr === 'dark' || attr === 'light') return attr;
+    return window.matchMedia?.('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+  }
+
+  // The strip's colours for the current campaign + theme (null = the neutral tokens). Applied as
+  // inline CSS variables scoped to .ad, so an override never leaks to the rest of the page.
+  const adColors = $derived(resolveBannerColors(currentColors, themeMode));
+  const adStyle = $derived(
+    adColors
+      ? `--ad-bg:${adColors.bg};--text-muted:${adColors.fg};--accent:${adColors.link};--ad-border:${adColors.border}`
+      : '',
+  );
+
   // The first appearance after mounting onto an already-running cycle is instant; every later
   // message change fades. (Consumed by the first in:fade.)
   let instantOnce = bannerCurrent() !== '';
@@ -50,8 +73,9 @@
   // The DOM host the engine drives. The fade lives on the {#if} layer (transition:fade), the scroll
   // on the inner track's transform, so a long message's scroll never blocks its fade in/out.
   const host: BannerHost = {
-    show(md) {
+    show(md, colors) {
       current = md;
+      currentColors = colors;
       tx = 0;
       txDur = 0;
       visible = true;
@@ -93,6 +117,20 @@
   $effect(() => {
     configureBanner(campaigns, eff);
   });
+  // Track the rendered theme so a colour override re-resolves when the theme flips: watch the
+  // [data-theme] attribute (Settings toggle / Telegram) and, for 'auto', the OS colour scheme.
+  $effect(() => {
+    const update = () => (themeMode = resolveThemeMode());
+    update();
+    const obs = new MutationObserver(update);
+    obs.observe(document.documentElement, { attributes: true, attributeFilter: ['data-theme'] });
+    const mq = window.matchMedia?.('(prefers-color-scheme: dark)');
+    mq?.addEventListener('change', update);
+    return () => {
+      obs.disconnect();
+      mq?.removeEventListener('change', update);
+    };
+  });
   // Re-measure on a viewport size change (e.g. a portrait↔landscape rotation): a message that fit
   // may now overflow, or vice versa, so the scroll must be re-evaluated. Debounced.
   $effect(() => {
@@ -116,7 +154,7 @@
      confirmation, the VK away-redirect keeps the Android WebView on the game. -->
 <!-- svelte-ignore a11y_no_static_element_interactions -->
 <!-- svelte-ignore a11y_click_events_have_key_events -->
-<div class="ad" bind:this={viewport} onclick={onExternalLinkClick}>
+<div class="ad" bind:this={viewport} style={adStyle} onclick={onExternalLinkClick}>
   <!-- An always-present, invisible spacer reserves exactly one line of height, so the strip never
        collapses while the message layer is absent during the fade gap (the message is overlaid
        absolutely, so its presence/absence does not change the strip height). -->
@@ -145,8 +183,8 @@
     font-size: 0.85rem;
     line-height: 1.2;
     box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.18);
-    border-top: 1px solid var(--border);
-    border-bottom: 1px solid var(--border);
+    border-top: 1px solid var(--ad-border, var(--border));
+    border-bottom: 1px solid var(--ad-border, var(--border));
     user-select: none;
   }
   /* Reserves one line of height inside the padding so .ad keeps a constant height even during the

ui/src/components/InstallApp.svelte

@@ -0,0 +1,85 @@
+<script lang="ts">
+  import { t } from '../lib/i18n/index.svelte';
+  import { installMode, promptInstall } from '../lib/pwa.svelte';
+  import Modal from './Modal.svelte';
+
+  // Platform-adaptive: 'oneTap' fires the native Chromium install dialog; 'iosInstructions' opens
+  // the manual Share -> Add-to-Home-Screen guide (iOS Safari has no programmatic install); 'hidden'
+  // renders nothing (already installed, inside a Telegram/VK Mini App, or an unsupported browser).
+  const mode = $derived(installMode());
+  let showIos = $state(false);
+
+  function onClick(): void {
+    // promptInstall must run synchronously from this gesture — the deferred prompt is gated on it.
+    if (mode === 'oneTap') void promptInstall();
+    else if (mode === 'iosInstructions') showIos = true;
+  }
+</script>
+
+{#if mode !== 'hidden'}
+  <button type="button" class="install" onclick={onClick}>
+    <img src="favicon.svg" alt="" width="40" height="40" />
+    <span class="text">
+      <span class="title">{t('install.title')}</span>
+      <span class="subtitle">{t('install.subtitle')}</span>
+    </span>
+  </button>
+{/if}
+
+{#if showIos}
+  <Modal title={t('install.iosTitle')} onclose={() => (showIos = false)}>
+    <ol class="steps">
+      <li>{t('install.iosStep1')}</li>
+      <li>{t('install.iosStep2')}</li>
+      <li>{t('install.iosStep3')}</li>
+    </ol>
+    <button type="button" class="ok" onclick={() => (showIos = false)}>{t('common.ok')}</button>
+  </Modal>
+{/if}
+
+<style>
+  .install {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    width: 100%;
+    text-align: left;
+    padding: 12px;
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+    background: var(--surface);
+    color: var(--text);
+    cursor: pointer;
+  }
+  .install img {
+    flex: none;
+    border-radius: 8px;
+  }
+  .text {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    min-width: 0;
+  }
+  .title {
+    font-weight: 600;
+  }
+  .subtitle {
+    font-size: 0.85rem;
+    color: var(--text-muted);
+    line-height: 1.35;
+  }
+  .steps {
+    margin: 0 0 16px;
+    padding-left: 1.25rem;
+    line-height: 1.6;
+  }
+  .ok {
+    width: 100%;
+    padding: 10px 12px;
+    border: 1px solid var(--accent);
+    background: var(--accent);
+    color: var(--accent-text);
+    border-radius: var(--radius-sm);
+  }
+</style>

ui/src/components/MaintenanceOverlay.svelte

@@ -0,0 +1,83 @@
+<script lang="ts">
+  // Non-dismissable maintenance cover. Shown while the edge is in a planned deploy window
+  // (maintenance.svelte.ts, raised from a caddy 503 carrying X-Scrabble-Maintenance). It has
+  // no close affordance — an in-session user cannot dismiss it — but the store's poll lifts
+  // it automatically the moment the gateway answers again; the "retry" button just forces an
+  // immediate re-check. Mirrors the static caddy maintenance page (deploy/caddy/maintenance.html)
+  // so a fresh load and an in-session user see the same thing.
+  import { maintenance, retryNow } from '../lib/maintenance.svelte';
+  import { t } from '../lib/i18n/index.svelte';
+</script>
+
+{#if maintenance.active}
+  <div class="scrim" role="alertdialog" aria-modal="true" aria-labelledby="maint-title" aria-describedby="maint-body">
+    <div class="card">
+      <div class="tile" aria-hidden="true">Э</div>
+      <h1 id="maint-title">{t('maintenance.title')}</h1>
+      <p id="maint-body">{t('maintenance.body')}</p>
+      <button type="button" onclick={retryNow}>{t('maintenance.retry')}</button>
+    </div>
+  </div>
+{/if}
+
+<style>
+  .scrim {
+    position: fixed;
+    inset: 0;
+    /* Above the game (z 60) and toasts (z 50) — a planned window covers everything the user
+       could otherwise interact with; below the dev DebugPanel (z 10000). */
+    z-index: 100;
+    background: rgba(0, 0, 0, 0.55);
+    display: grid;
+    place-items: center;
+    padding: 24px;
+    box-sizing: border-box;
+  }
+  .card {
+    max-width: 22rem;
+    text-align: center;
+    background: var(--surface);
+    color: var(--text);
+    border-radius: var(--radius);
+    box-shadow: var(--shadow);
+    padding: 2rem 1.5rem;
+  }
+  /* Mirrors a placed board tile (as Splash.svelte / the caddy page do). */
+  .tile {
+    display: inline-grid;
+    place-items: center;
+    width: 3.5rem;
+    height: 3.5rem;
+    font-size: 2rem;
+    font-weight: 700;
+    border-radius: 4px;
+    background: var(--tile-bg);
+    color: var(--tile-text);
+    box-shadow:
+      inset 0 -2px 0 var(--tile-edge),
+      2px 0 3px -1px rgba(0, 0, 0, 0.4);
+    margin-bottom: 1.25rem;
+  }
+  h1 {
+    font-size: 1.25rem;
+    margin: 0 0 0.5rem;
+  }
+  p {
+    margin: 0 0 1.5rem;
+    color: var(--text-muted);
+    line-height: 1.5;
+  }
+  button {
+    font: inherit;
+    padding: 0.55rem 1.4rem;
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    background: transparent;
+    color: var(--text);
+    cursor: pointer;
+  }
+  button:hover {
+    border-color: var(--accent);
+    color: var(--accent);
+  }
+</style>

ui/src/components/Toast.svelte

@@ -3,8 +3,9 @@
   import { app, dismissToast } from '../lib/app.svelte';
 
   const dur = $derived(app.reduceMotion ? 0 : 260);
-  // An info bubble owns its whole 2s life through a CSS rise-and-fade animation, so it takes
-  // no Svelte enter/leave transition; an error keeps the fly-in / fade-out dwell behaviour.
+  // An info bubble owns its whole 3s life through a CSS animation — appear, a ~1s hold at rest,
+  // then rise-and-fade — so it takes no Svelte enter/leave transition; an error keeps the fly-in /
+  // fade-out dwell behaviour.
   const isInfo = $derived(app.toast?.kind !== 'error');
 </script>
 
@@ -50,17 +51,19 @@
     border-color: var(--danger);
     color: var(--danger);
   }
-  /* An info bubble fades in, then drifts up by roughly the tab-bar height while fading out,
-     all within 2s; the X centring is preserved across the rise. */
+  /* An info bubble fades in, holds for ~1s at rest, then drifts up by roughly the tab-bar height
+     while fading out, all within 3s; the X centring is preserved across the rise. The 8%/41%
+     stops are the appear (~240ms) and the end of the ~1s hold. */
   .toast.rise {
-    animation: toast-rise 2s ease-out forwards;
+    animation: toast-rise 3s ease-out forwards;
   }
   @keyframes toast-rise {
     0% {
       opacity: 0;
       transform: translateX(-50%) translateY(8px);
     }
-    12% {
+    8%,
+    41% {
       opacity: 1;
       transform: translateX(-50%) translateY(0);
     }
@@ -69,16 +72,16 @@
       transform: translateX(-50%) translateY(-56px);
     }
   }
-  /* Reduced motion: the same 2s life, fade only — no upward travel. */
+  /* Reduced motion: the same 3s life (appear, ~1s hold, fade), fade only — no upward travel. */
   .toast.rise-reduced {
-    animation: toast-rise-reduced 2s ease-out forwards;
+    animation: toast-rise-reduced 3s ease-out forwards;
   }
   @keyframes toast-rise-reduced {
     0% {
       opacity: 0;
     }
-    12%,
-    70% {
+    8%,
+    41% {
       opacity: 1;
     }
     100% {

ui/src/game/Board.svelte

@@ -479,6 +479,11 @@
     position: absolute;
     top: 5%;
     left: 8%;
+    /* Chrome < 105 has no container-query units: a dropped `cqw` would inherit the .cell
+       `font-size: 0` and the glyph would vanish. Fall back to a viewport-relative size that tracks
+       the board (≈ the viewport-fitted query container) and the zoom (--z), so old Android System
+       WebViews still draw the tile glyphs. Chrome 105+ takes the exact `cqw` line below. */
+    font-size: calc(4.2vmin * var(--z, 1));
     font-size: 4.2cqw;
     font-weight: 700;
     line-height: 1;
@@ -487,12 +492,14 @@
     position: absolute;
     right: 5%;
     bottom: 3%;
+    font-size: calc(2.4vmin * var(--z, 1)); /* cqw fallback for Chrome < 105 — see .letter */
     font-size: 2.4cqw;
     font-weight: 600;
   }
   /* A placed Erudit blank ("звёздочка") shows its star where the (absent) point value sits,
      its ink centred on the same line as a neighbouring tile's value digit. */
   .blankmark {
+    font-size: calc(2.8vmin * var(--z, 1)); /* cqw fallback for Chrome < 105 — see .letter */
     font-size: 2.8cqw;
     bottom: 0;
   }
@@ -501,6 +508,7 @@
     inset: 0;
     display: grid;
     place-items: center;
+    font-size: calc(3.6vmin * var(--z, 1)); /* cqw fallback for Chrome < 105 — see .letter */
     font-size: 3.6cqw;
     opacity: 0.7;
   }
@@ -509,6 +517,7 @@
     inset: 0;
     display: grid;
     place-items: center;
+    font-size: calc(2.7vmin * var(--z, 1)); /* cqw fallback for Chrome < 105 — see .letter */
     font-size: 2.7cqw;
     font-weight: 600;
     opacity: 0.9;
@@ -526,10 +535,12 @@
     padding: 0 1px;
   }
   .bt {
+    font-size: calc(1.7vmin * var(--z, 1)); /* cqw fallback for Chrome < 105 — see .letter */
     font-size: 1.7cqw;
     font-weight: 600;
   }
   .bb {
+    font-size: calc(1.9vmin * var(--z, 1)); /* cqw fallback for Chrome < 105 — see .letter */
     font-size: 1.9cqw;
     font-weight: 700;
     white-space: nowrap;

ui/src/gen/fbs/scrabblefb.ts

@@ -54,6 +54,7 @@ export { LinkEmailRequest } from './scrabblefb/link-email-request.js';
 export { LinkResult } from './scrabblefb/link-result.js';
 export { LinkTelegramRequest } from './scrabblefb/link-telegram-request.js';
 export { LinkUnlinkRequest } from './scrabblefb/link-unlink-request.js';
+export { LinkVKRequest } from './scrabblefb/link-vkrequest.js';
 export { MatchFoundEvent } from './scrabblefb/match-found-event.js';
 export { MatchResult } from './scrabblefb/match-result.js';
 export { MoveRecord } from './scrabblefb/move-record.js';

ui/src/gen/fbs/scrabblefb/banner-campaign.ts

@@ -37,8 +37,50 @@ messagesLength():number {
   return offset ? this.bb!.__vector_len(this.bb_pos + offset) : 0;
 }
 
+overrideBg():string|null
+overrideBg(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideBg(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideFg():string|null
+overrideFg(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideFg(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideLink():string|null
+overrideLink(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideLink(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 12);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideBgDark():string|null
+overrideBgDark(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideBgDark(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 14);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideFgDark():string|null
+overrideFgDark(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideFgDark(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 16);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideLinkDark():string|null
+overrideLinkDark(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideLinkDark(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 18);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startBannerCampaign(builder:flatbuffers.Builder) {
-  builder.startObject(2);
+  builder.startObject(8);
 }
 
 static addWeight(builder:flatbuffers.Builder, weight:number) {
@@ -61,15 +103,45 @@ static startMessagesVector(builder:flatbuffers.Builder, numElems:number) {
   builder.startVector(4, numElems, 4);
 }
 
+static addOverrideBg(builder:flatbuffers.Builder, overrideBgOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(2, overrideBgOffset, 0);
+}
+
+static addOverrideFg(builder:flatbuffers.Builder, overrideFgOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(3, overrideFgOffset, 0);
+}
+
+static addOverrideLink(builder:flatbuffers.Builder, overrideLinkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(4, overrideLinkOffset, 0);
+}
+
+static addOverrideBgDark(builder:flatbuffers.Builder, overrideBgDarkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(5, overrideBgDarkOffset, 0);
+}
+
+static addOverrideFgDark(builder:flatbuffers.Builder, overrideFgDarkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(6, overrideFgDarkOffset, 0);
+}
+
+static addOverrideLinkDark(builder:flatbuffers.Builder, overrideLinkDarkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(7, overrideLinkDarkOffset, 0);
+}
+
 static endBannerCampaign(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createBannerCampaign(builder:flatbuffers.Builder, weight:number, messagesOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createBannerCampaign(builder:flatbuffers.Builder, weight:number, messagesOffset:flatbuffers.Offset, overrideBgOffset:flatbuffers.Offset, overrideFgOffset:flatbuffers.Offset, overrideLinkOffset:flatbuffers.Offset, overrideBgDarkOffset:flatbuffers.Offset, overrideFgDarkOffset:flatbuffers.Offset, overrideLinkDarkOffset:flatbuffers.Offset):flatbuffers.Offset {
   BannerCampaign.startBannerCampaign(builder);
   BannerCampaign.addWeight(builder, weight);
   BannerCampaign.addMessages(builder, messagesOffset);
+  BannerCampaign.addOverrideBg(builder, overrideBgOffset);
+  BannerCampaign.addOverrideFg(builder, overrideFgOffset);
+  BannerCampaign.addOverrideLink(builder, overrideLinkOffset);
+  BannerCampaign.addOverrideBgDark(builder, overrideBgDarkOffset);
+  BannerCampaign.addOverrideFgDark(builder, overrideFgDarkOffset);
+  BannerCampaign.addOverrideLinkDark(builder, overrideLinkDarkOffset);
   return BannerCampaign.endBannerCampaign(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/email-request-request.ts

@@ -41,8 +41,13 @@ language(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+pwa():boolean {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? !!this.bb!.readInt8(this.bb_pos + offset) : false;
+}
+
 static startEmailRequestRequest(builder:flatbuffers.Builder) {
-  builder.startObject(3);
+  builder.startObject(4);
 }
 
 static addEmail(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset) {
@@ -57,16 +62,21 @@ static addLanguage(builder:flatbuffers.Builder, languageOffset:flatbuffers.Offse
   builder.addFieldOffset(2, languageOffset, 0);
 }
 
+static addPwa(builder:flatbuffers.Builder, pwa:boolean) {
+  builder.addFieldInt8(3, +pwa, +false);
+}
+
 static endEmailRequestRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset, languageOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset, languageOffset:flatbuffers.Offset, pwa:boolean):flatbuffers.Offset {
   EmailRequestRequest.startEmailRequestRequest(builder);
   EmailRequestRequest.addEmail(builder, emailOffset);
   EmailRequestRequest.addBrowserTz(builder, browserTzOffset);
   EmailRequestRequest.addLanguage(builder, languageOffset);
+  EmailRequestRequest.addPwa(builder, pwa);
   return EmailRequestRequest.endEmailRequestRequest(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/link-vkrequest.ts

@@ -0,0 +1,72 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+import * as flatbuffers from 'flatbuffers';
+
+export class LinkVKRequest {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):LinkVKRequest {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsLinkVKRequest(bb:flatbuffers.ByteBuffer, obj?:LinkVKRequest):LinkVKRequest {
+  return (obj || new LinkVKRequest()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsLinkVKRequest(bb:flatbuffers.ByteBuffer, obj?:LinkVKRequest):LinkVKRequest {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new LinkVKRequest()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+code():string|null
+code(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+code(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+deviceId():string|null
+deviceId(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+deviceId(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+codeVerifier():string|null
+codeVerifier(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+codeVerifier(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+static startLinkVKRequest(builder:flatbuffers.Builder) {
+  builder.startObject(3);
+}
+
+static addCode(builder:flatbuffers.Builder, codeOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(0, codeOffset, 0);
+}
+
+static addDeviceId(builder:flatbuffers.Builder, deviceIdOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, deviceIdOffset, 0);
+}
+
+static addCodeVerifier(builder:flatbuffers.Builder, codeVerifierOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(2, codeVerifierOffset, 0);
+}
+
+static endLinkVKRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createLinkVKRequest(builder:flatbuffers.Builder, codeOffset:flatbuffers.Offset, deviceIdOffset:flatbuffers.Offset, codeVerifierOffset:flatbuffers.Offset):flatbuffers.Offset {
+  LinkVKRequest.startLinkVKRequest(builder);
+  LinkVKRequest.addCode(builder, codeOffset);
+  LinkVKRequest.addDeviceId(builder, deviceIdOffset);
+  LinkVKRequest.addCodeVerifier(builder, codeVerifierOffset);
+  return LinkVKRequest.endLinkVKRequest(builder);
+}
+}

ui/src/lib/app.svelte.ts

@@ -34,6 +34,9 @@ import {
   telegramCloudSet,
 } from './telegram';
 import { onVKPath, insideVK, vkInit, vkClose, vkDisableSwipeBack, vkLaunchParams, vkUserName, vkStartParam, vkOnScheme, vkOnInsets, vkSetViewSettings, appearanceForBg } from './vk';
+import { pendingVKLink, type VKLinkCallback } from './vkid';
+import { isStandalone } from './pwa';
+import { registerServiceWorker } from './pwa.svelte';
 import { haptic } from './haptics';
 import { CLOUD_PREFS_KEY, decodeClientPrefs, encodeClientPrefs } from './cloudprefs';
 import { parseStartParam } from './deeplink';
@@ -96,6 +99,10 @@ export const app = $state<{
   /** Set once the account has been deleted: App.svelte shows the terminal "account deleted"
    *  screen and all push/poll is stopped. Reopening the app just creates a fresh account. */
   accountDeleted: boolean;
+  /** A VK ID web-link authorization callback captured on boot (see lib/vkid): the browser
+   *  returned from VK with an auth code. Profile consumes it on mount to finish the link or
+   *  merge (a full-page redirect loses the route, so boot routes here). Null on a normal load. */
+  vkLinkPending: VKLinkCallback | null;
   toast: Toast | null;
   lastEvent: PushEvent | null;
   theme: ThemePref;
@@ -145,6 +152,7 @@ export const app = $state<{
   profile: null,
   blocked: null,
   accountDeleted: false,
+  vkLinkPending: null,
   toast: null,
   lastEvent: null,
   theme: 'auto',
@@ -208,9 +216,9 @@ function goForeground(): void {
 export function showToast(text: string, kind: Toast['kind'] = 'info'): void {
   app.toast = { kind, text, seq: ++toastSeq };
   if (toastTimer) clearTimeout(toastTimer);
-  // An info bubble lives exactly as long as its rise-and-fade animation (2s); an error
-  // dwells longer (4s) so it is not missed.
-  toastTimer = setTimeout(() => (app.toast = null), kind === 'error' ? 4000 : 2000);
+  // An info bubble lives exactly as long as its appear + ~1s hold + rise-and-fade animation (3s);
+  // an error dwells longer (4s) so it is not missed.
+  toastTimer = setTimeout(() => (app.toast = null), kind === 'error' ? 4000 : 3000);
 }
 
 /** dismissToast hides the current toast at once — a tap on the bubble dismisses it. */
@@ -777,10 +785,25 @@ export async function bootstrap(): Promise<void> {
     return;
   }
 
+  // On the plain web (both Mini-App branches returned above) register the install-only service
+  // worker so the app is installable — Chromium needs a registered SW, notably on Android. Web-only
+  // and skipped in the mock build; see lib/pwa.svelte.
+  registerServiceWorker();
+
   const saved = await loadSession();
+  // A VK ID web-link callback (?code&device_id&state) rides the URL after the redirect back
+  // from VK; capture and clear it here (it needs the restored session to link against).
+  const vkcb = pendingVKLink();
   if (saved) {
     await adoptSession(saved);
-    if (router.route.name === 'login') navigate('/');
+    if (vkcb) {
+      // The full-page redirect lost the in-app route, so hand the callback to Profile, which
+      // finishes the link or merge on mount.
+      app.vkLinkPending = vkcb;
+      navigate('/profile');
+    } else if (router.route.name === 'login') {
+      navigate('/');
+    }
   } else if (router.route.name !== 'login' && router.route.name !== 'confirm') {
     navigate('/login');
   }
@@ -958,7 +981,7 @@ export async function loginGuest(): Promise<void> {
 
 export async function requestEmailCode(email: string): Promise<boolean> {
   try {
-    await gateway.authEmailRequest(email, app.locale);
+    await gateway.authEmailRequest(email, app.locale, isStandalone());
     return true;
   } catch (err) {
     handleError(err);

ui/src/lib/banner.test.ts

@@ -29,7 +29,7 @@ describe('createScheduler', () => {
       { weight: 7, messages: ['b'] },
     ]);
     expect(sched.total).toBe(2);
-    const cycle = Array.from({ length: 10 }, () => sched.next());
+    const cycle = Array.from({ length: 10 }, () => sched.next().md);
     const a = cycle.filter((m) => m === 'a').length;
     const b = cycle.filter((m) => m === 'b').length;
     expect(a).toBe(3);
@@ -42,7 +42,7 @@ describe('createScheduler', () => {
   it('round-robins messages within a campaign', () => {
     const sched = createScheduler([{ weight: 1, messages: ['m0', 'm1', 'm2'] }]);
     expect(sched.total).toBe(3);
-    expect([sched.next(), sched.next(), sched.next(), sched.next()]).toEqual(['m0', 'm1', 'm2', 'm0']);
+    expect([sched.next().md, sched.next().md, sched.next().md, sched.next().md]).toEqual(['m0', 'm1', 'm2', 'm0']);
   });
 
   it('drops empty and non-positive-weight campaigns', () => {
@@ -52,13 +52,27 @@ describe('createScheduler', () => {
       { weight: 2, messages: ['keep'] },
     ]);
     expect(sched.total).toBe(1);
-    expect(sched.next()).toBe('keep');
+    expect(sched.next().md).toBe('keep');
   });
 
   it('is empty for no campaigns', () => {
     const sched = createScheduler([]);
     expect(sched.total).toBe(0);
-    expect(sched.next()).toBe('');
+    expect(sched.next().md).toBe('');
+  });
+
+  it('carries each campaign colour override with its message', () => {
+    const red = { bg: '#aa0000', fg: '#ffffff', link: '#ffdd00' };
+    const darkRed = { bg: '#330000', fg: '#eeeeee', link: '#ffcc00' };
+    const sched = createScheduler([
+      { weight: 1, messages: ['plain'] },
+      { weight: 1, messages: ['branded'], overrideAll: red, overrideDark: darkRed },
+    ]);
+    const two = [sched.next(), sched.next()];
+    const branded = two.find((it) => it.md === 'branded');
+    const plain = two.find((it) => it.md === 'plain');
+    expect(branded?.colors).toEqual({ all: red, dark: darkRed });
+    expect(plain?.colors).toEqual({ all: null, dark: null });
   });
 });
 

ui/src/lib/banner.ts

@@ -4,7 +4,7 @@
 // unit-testable with fake timers. The campaigns + timings come from the profile's
 // banner block (see lib/model, ARCHITECTURE §10); the host is AdBanner.svelte.
 
-import type { BannerCampaign, BannerTimings } from './model';
+import type { BannerCampaign, BannerColors, BannerTimings } from './model';
 
 /** Fallback display timings, matching the seeded ad_settings defaults. */
 export const defaultBannerTimings: BannerTimings = {
@@ -16,9 +16,15 @@ export const defaultBannerTimings: BannerTimings = {
   fadeInMs: 1_000,
 };
 
+/** BannerItem is one scheduled message plus its campaign's colour override (for the strip). */
+export interface BannerItem {
+  md: string;
+  colors: BannerColors;
+}
+
 /** Scheduler yields the next message to show, fairly across weighted campaigns. */
 export interface Scheduler {
-  next(): string;
+  next(): BannerItem;
   /** Total messages across all (non-empty, positive-weight) campaigns. */
   readonly total: number;
 }
@@ -33,15 +39,17 @@ export interface Scheduler {
  */
 export function createScheduler(campaigns: BannerCampaign[]): Scheduler {
   const cs = campaigns.filter((c) => c.weight > 0 && c.messages.length > 0);
+  const colors: BannerColors[] = cs.map((c) => ({ all: c.overrideAll ?? null, dark: c.overrideDark ?? null }));
   const current = cs.map(() => 0); // SWRR running weights
   const cursor = cs.map(() => 0); // per-campaign round-robin position
   const totalWeight = cs.reduce((sum, c) => sum + c.weight, 0);
   const total = cs.reduce((sum, c) => sum + c.messages.length, 0);
+  const empty: BannerColors = { all: null, dark: null };
 
   return {
     total,
-    next(): string {
-      if (cs.length === 0) return '';
+    next(): BannerItem {
+      if (cs.length === 0) return { md: '', colors: empty };
       let best = 0;
       for (let i = 0; i < cs.length; i++) {
         current[i] += cs[i].weight;
@@ -51,15 +59,16 @@ export function createScheduler(campaigns: BannerCampaign[]): Scheduler {
       const c = cs[best];
       const md = c.messages[cursor[best] % c.messages.length];
       cursor[best]++;
-      return md;
+      return { md, colors: colors[best] };
     },
   };
 }
 
 /** The host the rotator drives; AdBanner.svelte supplies the DOM measurements and effects. */
 export interface BannerHost {
-  /** Render md and fade it in (over fadeInMs), with the scroll reset to the start. */
-  show(md: string): void;
+  /** Render md and fade it in (over fadeInMs), with the scroll reset to the start. colors is the
+   *  source campaign's colour override, applied to the strip (its neutral tokens when unset). */
+  show(md: string, colors: BannerColors): void;
   /** Reset the scroll to the start without re-fading (to loop a long message). */
   resetScroll(): void;
   /** Fade the current message out over durationMs. */
@@ -98,7 +107,7 @@ export function createBannerRotator(
   const sched = createScheduler(campaigns);
   let running = false;
   let cycleStart = 0;
-  let lastShown = ''; // the message currently presented, for restart() (re-measure)
+  let lastShown: BannerItem | null = null; // the item currently presented, for restart() (re-measure)
   const timers: ReturnType<typeof setTimeout>[] = [];
 
   const at = (ms: number, fn: () => void) => {
@@ -109,11 +118,11 @@ export function createBannerRotator(
     timers.length = 0;
   };
 
-  function present(md: string) {
+  function present(item: BannerItem) {
     if (!running) return;
     clear();
-    lastShown = md;
-    host.show(md);
+    lastShown = item;
+    host.show(item.md, item.colors);
     at(config.fadeInMs, measure);
   }
 
@@ -143,7 +152,7 @@ export function createBannerRotator(
           // the same fade as a message change, not a hard jump.
           host.hide(config.fadeOutMs);
           at(config.fadeOutMs + config.gapMs, () => {
-            host.show(lastShown);
+            if (lastShown) host.show(lastShown.md, lastShown.colors);
             at(config.fadeInMs, () => scrollCycle(over));
           });
         }

ui/src/lib/bannerColors.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { derivedBorder, resolveBannerColors } from './bannerColors';
+import type { BannerColors } from './model';
+
+const red = { bg: '#aa0000', fg: '#ffffff', link: '#ffdd00' };
+const darkRed = { bg: '#330000', fg: '#eeeeee', link: '#ffcc00' };
+
+describe('resolveBannerColors', () => {
+  it('returns null when the campaign has no override (neutral tokens)', () => {
+    const none: BannerColors = { all: null, dark: null };
+    expect(resolveBannerColors(none, 'light')).toBeNull();
+    expect(resolveBannerColors(none, 'dark')).toBeNull();
+  });
+
+  it('applies the all-themes set on both themes when no dark override', () => {
+    const c: BannerColors = { all: red, dark: null };
+    expect(resolveBannerColors(c, 'light')).toMatchObject({ bg: red.bg, fg: red.fg, link: red.link });
+    expect(resolveBannerColors(c, 'dark')).toMatchObject({ bg: red.bg, fg: red.fg, link: red.link });
+  });
+
+  it('prefers the dark override on the dark theme, and the all set on light', () => {
+    const c: BannerColors = { all: red, dark: darkRed };
+    expect(resolveBannerColors(c, 'light')).toMatchObject({ bg: red.bg });
+    expect(resolveBannerColors(c, 'dark')).toMatchObject({ bg: darkRed.bg });
+  });
+
+  it('supports a dark-only override (light keeps the neutral tokens)', () => {
+    const c: BannerColors = { all: null, dark: darkRed };
+    expect(resolveBannerColors(c, 'light')).toBeNull();
+    expect(resolveBannerColors(c, 'dark')).toMatchObject({ bg: darkRed.bg });
+  });
+
+  it('derives the border from the resolved background', () => {
+    const c: BannerColors = { all: red, dark: null };
+    expect(resolveBannerColors(c, 'light')?.border).toBe(derivedBorder(red.bg));
+  });
+});
+
+describe('derivedBorder', () => {
+  it('darkens a light background and lightens a dark one', () => {
+    expect(derivedBorder('#ffffff')).toBe('#dbdbdb');
+    expect(derivedBorder('#000000')).toBe('#242424');
+  });
+
+  it('returns a malformed colour unchanged', () => {
+    expect(derivedBorder('nope')).toBe('nope');
+  });
+});

ui/src/lib/bannerColors.ts

@@ -0,0 +1,69 @@
+// Banner colour resolution. A campaign may carry two optional colour sets (see
+// lib/model BannerColors): one for every theme and one that further overrides the
+// dark theme. resolveBannerColors collapses them to the colours the strip paints on
+// the currently-rendered theme, or null when the campaign keeps the neutral
+// --ad-bg / --text-muted / --accent tokens. Pure and DOM-free, so it is unit-tested
+// directly; AdBanner.svelte applies the result as inline CSS variables.
+
+import type { BannerColors } from './model';
+
+export type ThemeMode = 'light' | 'dark';
+
+/** ResolvedBannerColors is the strip's colours for one theme, border already derived. */
+export interface ResolvedBannerColors {
+  bg: string;
+  fg: string;
+  link: string;
+  border: string;
+}
+
+/**
+ * resolveBannerColors picks the colour set for the rendered theme — dark ← dark ?? all,
+ * light ← all — and returns null when there is no override for that theme (the strip then
+ * keeps the neutral tokens). The border is derived from the background so it stays subtle
+ * on any colour.
+ */
+export function resolveBannerColors(colors: BannerColors, mode: ThemeMode): ResolvedBannerColors | null {
+  const set = mode === 'dark' ? (colors.dark ?? colors.all) : colors.all;
+  if (!set) return null;
+  return { bg: set.bg, fg: set.fg, link: set.link, border: derivedBorder(set.bg) };
+}
+
+/**
+ * derivedBorder nudges the background 14% toward black on a light background and toward
+ * white on a dark one — a subtle edge that suits any override colour. It is computed in
+ * JS (no CSS color-mix) so it works on the old Android WebView floor (Chrome 67), and
+ * mirrors the admin console preview (banner_detail.gohtml). A malformed colour is
+ * returned unchanged.
+ */
+export function derivedBorder(bgHex: string): string {
+  const rgb = hexToRgb(bgHex);
+  if (!rgb) return bgHex;
+  const target: RGB = luminance(rgb) > 0.5 ? [0, 0, 0] : [255, 255, 255];
+  return rgbToHex(mix(rgb, target, 0.14));
+}
+
+type RGB = [number, number, number];
+
+function hexToRgb(h: string): RGB | null {
+  const m = /^#([0-9a-fA-F]{6})$/.exec(h.trim());
+  if (!m) return null;
+  const n = m[1];
+  return [parseInt(n.slice(0, 2), 16), parseInt(n.slice(2, 4), 16), parseInt(n.slice(4, 6), 16)];
+}
+
+function mix(a: RGB, b: RGB, t: number): RGB {
+  return [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, a[2] + (b[2] - a[2]) * t];
+}
+
+function luminance(r: RGB): number {
+  return (0.2126 * r[0] + 0.7152 * r[1] + 0.0722 * r[2]) / 255;
+}
+
+function pad(x: number): string {
+  return Math.max(0, Math.min(255, Math.round(x))).toString(16).padStart(2, '0');
+}
+
+function rgbToHex(r: RGB): string {
+  return '#' + pad(r[0]) + pad(r[1]) + pad(r[2]);
+}

ui/src/lib/bannerEngine.ts

@@ -4,11 +4,14 @@
 // independent of route transitions (the cycle is not restarted on navigation).
 
 import { createBannerRotator, type BannerHost, type Rotator } from './banner';
-import type { BannerCampaign, BannerTimings } from './model';
+import type { BannerCampaign, BannerColors, BannerTimings } from './model';
+
+const noColors: BannerColors = { all: null, dark: null };
 
 let rotator: Rotator | null = null;
 let mounted: BannerHost | null = null;
 let current = '';
+let currentColors: BannerColors = noColors;
 let key = '';
 // The in-flight horizontal scroll of the current message, so a view mounted by navigation can
 // resume it from the same offset instead of restarting at the left. Null when not scrolling.
@@ -17,10 +20,11 @@ let activeScroll: { toPx: number; dur: number; start: number } | null = null;
 // proxy is the rotator's host: it records the current message + scroll (so a freshly-mounted view
 // can resume them) and forwards every effect to the currently-attached DOM host, if any.
 const proxy: BannerHost = {
-  show(md) {
+  show(md, colors) {
     current = md;
+    currentColors = colors;
     activeScroll = null;
-    mounted?.show(md);
+    mounted?.show(md, colors);
   },
   resetScroll() {
     activeScroll = null;
@@ -58,6 +62,7 @@ export function configureBanner(campaigns: BannerCampaign[], timings: BannerTimi
   key = k;
   rotator?.stop();
   current = '';
+  currentColors = noColors;
   rotator = createBannerRotator(campaigns, proxy, timings);
   rotator.start();
 }
@@ -71,6 +76,15 @@ export function bannerCurrent(): string {
   return current;
 }
 
+/**
+ * bannerCurrentColors returns the colour override of the campaign whose message is currently
+ * displayed (neutral tokens — both sets null — before the first message). A freshly-mounted view
+ * reads it alongside bannerCurrent so the strip paints the right colours immediately on mount.
+ */
+export function bannerCurrentColors(): BannerColors {
+  return currentColors;
+}
+
 /**
  * attachBannerHost connects a freshly-mounted view as the DOM host. It does NOT re-show the
  * current message (the view renders it itself from bannerCurrent on mount): re-showing here would

ui/src/lib/client.ts

@@ -65,7 +65,7 @@ export interface GatewayClient {
    *  cosmetic seed for a brand-new account). */
   authVK(params: string, displayName: string): Promise<Session>;
   authGuest(locale?: string): Promise<Session>;
-  authEmailRequest(email: string, language: string): Promise<void>;
+  authEmailRequest(email: string, language: string, pwa: boolean): Promise<void>;
   authEmailLogin(email: string, code: string): Promise<Session>;
   /** Confirm a one-tap email deeplink token: a login returns a session to adopt; a
    *  link returns a status ('confirmed' | 'merge_required'). */
@@ -177,6 +177,10 @@ export interface GatewayClient {
   linkEmailMerge(email: string, code: string): Promise<LinkResult>;
   linkTelegram(data: string): Promise<LinkResult>;
   linkTelegramMerge(data: string): Promise<LinkResult>;
+  /** Link a VK identity from the web: the args are the PKCE outputs of the VK ID
+   *  authorization callback, exchanged for the trusted vk id on the gateway. */
+  linkVK(code: string, deviceId: string, codeVerifier: string): Promise<LinkResult>;
+  linkVKMerge(code: string, deviceId: string, codeVerifier: string): Promise<LinkResult>;
   /** Detach a platform identity (kind 'telegram' | 'vk') from the account; email is never
    *  unlinked. Returns the refreshed link result (status 'unlinked'). */
   linkUnlink(kind: string): Promise<LinkResult>;