Merge pull request 'Release v1.14.1 — ansible certs-dir fix + Robokassa go-live' (#239) from development into master

The Ansible base-directory loop created /opt/scrabble/certs at mode 0750
(deploy:deploy), like config/dumps/images. The gateway (and backend) run as
the distroless nonroot UID 65532 — not the deploy user — so the container
cannot traverse a 0750 certs dir and fails at startup with
"mtls: load server keypair: ... permission denied", crash-looping.

This is latent: a long-running container holds the keypair in memory and
never re-reads the file, so the misconfig only bites when a container
restarts (a host reboot / redeploy). A hoster maintenance reboot exposed it
on prod — the gateway came back crash-looping while the deploy could not SSH
in mid-reboot.

Split certs out of the 0750 loop and create it 0755 (traversable). The keys
stay 0644 by design (the gateway compose relies on it); the host is
single-tenant + SSH-access-controlled, so a traversable certs dir adds no
meaningful exposure. The live prod host was already chmod-fixed by hand; this
keeps the next provisioning run from re-tightening it.

.gitea/workflows/prod-deploy.yaml

@@ -99,6 +99,14 @@ jobs:
       GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
       TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
       GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
+      # Robokassa direct-rail (backend BACKEND_ROBOKASSA_*): the prod shop login + the pass phrases
+      # that sign the launch request / verify the Result callback, and the test-mode flag — a var so
+      # go-live is a flag flip, not a secret redeploy ("1" runs test payments against the test
+      # passwords; empty/"0" is live). An empty login leaves the direct rail disabled.
+      ROBOKASSA_MERCHANT_LOGIN: ${{ secrets.PROD_BACKEND_ROBOKASSA_MERCHANT_LOGIN }}
+      ROBOKASSA_PASSWORD1: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD1 }}
+      ROBOKASSA_PASSWORD2: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD2 }}
+      ROBOKASSA_TEST: ${{ vars.PROD_BACKEND_ROBOKASSA_TEST }}
       # VK ID web login: the "Web" app id (the gateway reuses it as GATEWAY_VK_ID_APP_ID at
       # runtime) + the app's protected key. Both shared across contours. The redirect URL is
       # derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.

.gitea/workflows/prod-rollback.yaml

@@ -61,6 +61,12 @@ jobs:
       # the SAME env.sh (email / VK login / Grafana alerts survive a rollback). TELEGRAM_MINIAPP_URL
       # and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
       GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
+      # Robokassa direct-rail: the rollback re-renders the same runtime env (write-prod-env.sh), so
+      # it must carry the same credentials or the direct rail goes dark after a rollback.
+      ROBOKASSA_MERCHANT_LOGIN: ${{ secrets.PROD_BACKEND_ROBOKASSA_MERCHANT_LOGIN }}
+      ROBOKASSA_PASSWORD1: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD1 }}
+      ROBOKASSA_PASSWORD2: ${{ secrets.PROD_BACKEND_ROBOKASSA_PASSWORD2 }}
+      ROBOKASSA_TEST: ${{ vars.PROD_BACKEND_ROBOKASSA_TEST }}
       VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
       GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
       GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}

PLAN.md

@@ -36,8 +36,8 @@ status — without re-deriving decisions.
 | E4 | Durability (PITR) | 2 | DONE |
 | E5 | Payment intake | 2 | DONE |
 | E6 | Ads | 2 | DONE |
-| E7 | Admin, reports & catalog | 2 | TODO |
+| E7 | Admin, reports & catalog | 2 | DONE |
-| E8 | Guest limits | — | TODO |
+| E8 | Guest limits | — | DONE |
 | E9 | Tournament fee | future | TODO |
 
 **Release 1** = full mechanics with no real money, exercised via `admin_grant` (E0→E1→E2→E3).
@@ -695,7 +695,7 @@ it tunes without a store release.
 
 ## E7 — Admin, reports & catalog
 
-**Status:** TODO · **Release 2** · depends on: E2 (ledger/grant/spend), E5 (payments/refunds),
+**Status:** DONE · **Release 2** · depends on: E2 (ledger/grant/spend), E5 (payments/refunds),
 E6 (D31 retired the legacy `hint_balance`/`paid_account`) · mechanics: PAYMENTS §11, §12, D32.
 
 **Delivery & baked decisions (this planning round).** A linear PR stack into `development`.
@@ -763,15 +763,16 @@ ledger export — plus the **configurable product catalog editor** (D32).
 products + prices and delete only never-transacted ones; grant concrete values raw or by-product
 (origin-picked, never chips/tournament); refund an order in full; export the ledger.
 
-**PR stack (linear into `development`).**
+**PR stack (linear into `development`, all merged).**
 
-1. **Per-user financial panel** (read-only ledger/segments/benefits on the user card; retires the
+1. ~~**Per-user financial panel**~~ (#230) — read-only ledger/segments/benefits on the user card;
-   `PaidAccount`/`HintBalance` display).
+   retired the `PaidAccount`/`HintBalance` display.
-2. **Catalog editor** (product/atom/price CRUD + archive/unarchive + delete-if-clean + shape
+2. ~~**Catalog editor**~~ (#231) — product/atom/price CRUD + archive/unarchive + delete-if-clean +
-   validation).
+   shape validation.
-3. **Admin grant** (raw + by-product, refuse chips/tournament, origin-picked, `admin_grant` +
+3. ~~**Admin grant**~~ (#232, + the D31 hint-wallet wire cleanup that surfaced there) — raw +
-   snapshot).
+   by-product, refuse chips/tournament, origin-picked, `admin_grant` + snapshot.
-4. **Manual refund** (full order via E5 `Refund`) + **ledger export** (CSV/JSON).
+4. ~~**Manual refund** (full order via E5 `Refund`) + **ledger CSV export**~~ — `RefundOrderFull`
+   (idempotent, floor-0 revoke) on each fund row; `/_gm/ledger.csv`.
 
 **Notes/risks.** High-blast-radius (money, ledger — append-only, trigger-enforced). No mixed-in
 refactors. The catalog editor becomes the source of truth for products; the contour SQL seeds
@@ -781,38 +782,88 @@ become bootstrap-only.
 
 ## E8 — Guest limits
 
-**Status:** TODO · **standalone** (game-behaviour change; can run in parallel) · depends on:
+**Status:** DONE · **standalone** (game-behaviour change) · depends on: none · mechanics: PAYMENTS §6.
-none · mechanics: PAYMENTS §6.
 
-**Goal.** A registration funnel: cap what a guest can do, enforced **server-side** (today the
+**Goal.** A registration funnel: cap what a guest can do, enforced **server-side** (today UI-only),
-gating is UI-only).
+with configurable per-tier × per-kind limits so the pressure tunes without a release.
 
-**Finding (verified).** The friend/invitation paths do **not** check `is_guest` on the
+**Finding (verified).** Two gaps. (a) The friend/invitation paths do **not** check `is_guest` on the
-server — only the UI hides them: `social/friends.go:50` `SendFriendRequest`,
+server — only the UI hides them: `social/friends.go`, `robotfriends.go`, `friendcodes.go`,
-`robotfriends.go:41` `RequestInGame`, `friendcodes.go:67` `RedeemFriendCode`,
+`lobby/invitations.go`. A guest with a valid `X-User-ID` can call them. (b) A **pre-existing** flat
-`lobby/invitations.go:208` `CreateInvitation`. A guest with a valid `X-User-ID` can call them
+cap already existed: `game.MaxActiveQuickGames`=10 — a **combined** cap on `active`+`open` quick
-in the UI's stead.
+games (vs_ai+random together, friend games excluded), counted by `CountActiveQuickGames`, enforced at
+the handler (`ensureUnderGameLimit`) with **409 `game_limit_reached`**, surfaced as `at_game_limit`.
+E8's per-tier × per-kind config **subsumes and replaces** it (decided: option A).
+
+**Delivery & baked decisions (this planning round).** A linear PR stack; E8 is game-behaviour, no
+payments mixed in.
+
+- **`games.game_kind smallint DEFAULT 0`** (0=unknown — pre-E8 games, never gated; 1=vs_ai; 2=random;
+  3=friends), set on creation (`StartVsAI`=1, `Enqueue`=2, a friend invitation=3). Existing games
+  stay 0 and fall outside the gate.
+- **Limits are per-tier × per-kind**, in a **new single-row `backend.config`** table:
+  `guest_{vs_ai,random,friends}_limit` + `durable_{vs_ai,random,friends}_limit` (smallint,
+  **`-1`=unlimited**), seeded `(1,1,0, 10,10,10)`. A guest is capped at 1 vs_ai + 1 random (friends
+  is moot — the guest gate blocks friend games); a durable account is **10 per kind** — the old flat
+  MaxActiveQuickGames=10, now split per kind. Editable in the admin.
+- **The old flat cap is removed** (option A, owner-agreed): `MaxActiveQuickGames`,
+  `CountActiveQuickGames`, `atGameLimit` deleted; the per-tier/kind config is the single mechanism,
+  enforced at the **same handler gate** (`ensureUnderGameLimit(kind)` for `enqueue`
+  random/vs_ai) plus the durable **friends cap** inside `CreateInvitation`. The gate stays out of the
+  game domain — `game.Service.AtGameLimit(account, kind)` only resolves tier + counts.
+- **A hot in-memory cache** fronts the config (read once on start, invalidated on the admin edit —
+  mirrors the payments read-cache) so a login / game-create never queries it.
+- **"Active" = `open` + `active`** (an open, unmatched random game holds a slot); the limit is on
+  **creation** — an existing game is grandfathered, never interrupted.
+- **Limits ride the wire (forward-compat, no double break):** `Profile.game_limits`
+  (`GameLimits{vs_ai, random, friends}` — the caller's tier resolved server-side) + `GameView.kind`,
+  so the client counts active games **per kind** from its lobby and locks the right start button. On
+  a guest → durable upgrade (register / link) the client **re-fetches the profile** so the new
+  (durable) limits apply. The client picks the lock's message by tier: a **guest** → the login funnel;
+  a **durable** account at its cap → a plain "finish a current game first" notice.
 
 **Work.**
 
-- **Server guest gate** on friend-request / redeem-code / invitation-create: refuse when the
+- ~~**PR1 — backend + admin (server-side)** — DONE.~~ The migration (`game_kind` + `backend.config`,
-  caller `is_guest` (add an `ErrGuestForbidden`-style guard, as `feedback` already has).
+  seeded `1,1,0 / 10,10,10` + jetgen); `game_kind` set on creation and projected onto `game.Game`;
-- **Active-game limits** for guests: at most **1 random-opponent game + 1 vs_ai** concurrently
+  the **guest gate** (`ErrGuestForbidden`, mapped to **403 `guest_forbidden`**) on friend-request /
-  (enforce on game/invitation creation in `lobby`/`game`; today no such limit exists).
+  redeem-code / befriend-in-game / invitation-create; the **active-limit enforce** — the old flat
-- Keep the existing UI gating; this adds the server as the source of truth.
+  `MaxActiveQuickGames` mechanism removed and replaced by `ensureUnderGameLimit(kind)` on `enqueue`
+  (random/vs_ai) plus the durable friends cap in `CreateInvitation`, keyed off
+  `game.Service.AtGameLimit`; the **`internal/gamelimits` config + hot cache** (loaded at boot,
+  invalidated on edit); the admin **kind column** in both game lists (`/_gm/games` + the user card)
+  and a **config editor** (`/_gm/limits`) for the six limits.
+- ~~**PR2 — wire + client** — DONE.~~ `Profile.game_limits` (the caller's tier) + `GameView.kind` (FBS
+  + gateway transcode + client codec, committed regen); the client counts active games per kind from
+  the lobby cache (`gamelimits.ts`) and locks a capped new-game start — an **outline 🔒** button that
+  opens `GameLimitModal` instead of a game, native (Telegram `showPopup`) or the in-app `Modal`
+  elsewhere, with two messages by tier: a **guest** sign-in funnel ("Войдите или создайте учётную
+  запись…", Отмена / Вход→`/settings`) and, for a **durable** account at its cap, a plain notice
+  ("Вы достигли лимита одновременных игр, сначала завершите текущие", ОК). The lock lifts via the
+  existing profile re-fetch after a guest→durable upgrade.
+  - **Decision (owner-agreed): the lobby's old `at_game_limit` New-Game tab-disable + notice is
+    removed.** The `at_game_limit` flag (now the random-kind cap) conflicted with the per-kind lock —
+    it hid the New-Game screen where the lock lives, and wrongly blocked starting an unfulfilled kind.
+    The tab is always enabled; the per-kind lock on the start button is the only gate. The wire field
+    `GameList.at_game_limit` stays (unused by the client) for a later cleanup.
 
 **Tests.**
 
-- integration: guest is refused friend/redeem/invitation server-side; guest blocked from a
+- integration (PR1, done): `game_kind` persisted per path; guest refused friend/redeem/invitation
-  2nd random / 2nd vs_ai; durable account unaffected.
+  (domain + HTTP 403); guest blocked from a 2nd vs_ai / 2nd random (+ `at_game_limit`); durable on the
-- UI: guest sees the funnel (existing hides + any new messaging).
+  higher tier; the durable friends cap + config cache reflecting an admin edit; accept stays exempt.
+- unit (PR1, done): the per-tier/kind limit resolution (`Cap`, `LimitsFor`).
+- unit + UI (PR2, done): the client lock logic (`gamelimits.ts` — count/cap/lock), the codec kind +
+  game_limits roundtrip, the gateway transcode game_limits encode, the popup builders, and a mock e2e
+  (`gamelimit.spec.ts`) — a capped start shows 🔒, opens the modal without navigating, and the lock
+  clears when the profile refetch lifts the cap.
 
-**Done-criteria.** Guests are server-limited to 1 random + 1 vs_ai and cannot friend/invite;
+**Done-criteria.** A guest is server-capped (default 1 vs_ai + 1 random, configurable) and cannot
-durable accounts unchanged; regression that this does not break existing durable flows.
+friend/invite; a durable account is capped at 10 per kind (configurable); the client shows the lock +
+the tier-appropriate modal and the cap lifts on registration; durable flows otherwise unchanged.
 
-**Notes/risks.** This changes existing game behaviour — its own tests, its own PR, no
+**Notes/risks.** Game-behaviour change — own PRs, own tests, no payments mixed in. The limit is on
-mixed-in payments changes. Decide whether a guest may finish an already-started game (limit
+creation (existing games grandfathered). The config cache is single-instance (matching the deploy).
-on creation, not mid-game) at implementation and record it here.
 
 ---
 

backend/README.md

@@ -33,11 +33,16 @@ real game seating the caller with an **empty opponent seat** (status `open`) or,
 another player already waits for the same variant and per-turn word rule, seats the
 caller into that open game and starts it — and
 friend-game invitations (invite → accept, starting a 2–4 player game once every
-invitee accepts). A **simultaneous-game cap** (`game.MaxActiveQuickGames` = 10) limits a
+invitee accepts). **Per-tier, per-kind active-game caps** limit a player's simultaneous
-player's active quick games — status `active`/`open`, excluding invitation-linked friend
+unfinished games by kind — `vs_ai`, `random` (quick auto-match), `friends` — with separate
-games (`game.Service.CountActiveQuickGames`); the server refuses `lobby/enqueue` and
+guest and durable-account tiers held in the single-row `backend.config` table (a `-1` means
-`invitations` creation with **409 `game_limit_reached`** at the cap (accepting an invitation
+unlimited), read through an in-memory cache (`internal/gamelimits`) and tuned live in the admin
-is exempt), and the `games.list` response carries an `at_game_limit` flag for the lobby.
+(`/_gm/limits`, no redeploy). Each game is tagged with its `games.game_kind` on creation;
+`game.Service.AtGameLimit` counts the account's `active`/`open` games of a kind against the
+tier's cap. The server refuses `lobby/enqueue` (random/vs_ai) with **409 `game_limit_reached`**
+at the cap, and the `invitations` (friends) path enforces the durable friends cap and refuses a
+**guest** outright (guests cannot use friends); accepting an invitation is exempt. The
+`games.list` response carries an `at_game_limit` flag (the random-kind cap) for the lobby.
 `internal/social` owns the friend graph (request/accept),
 per-user blocks, and per-game chat with nudges folded in as a message kind; chat
 messages are length-capped, content-filtered (no links/emails/phone numbers,
@@ -146,7 +151,15 @@ funding segment, benefits per origin, the recorded refund risk, and the append-o
 (`/_gm/catalog`, `handlers_admin_catalog.go`) is the source of truth for products (D32): create /
 edit / archive-unarchive (the `product.active` flag) products, their atoms and per-rail prices, and
 hard-delete only a **never-transacted** product (an order/ledger reference forces archive-only,
-backed by the FK); a `tournament`-bearing product is composable but not sellable yet. The shared wire
+backed by the FK); a `tournament`-bearing product is composable but not sellable yet. The user card
+also carries an admin **grant** panel: grant raw benefit atoms (hints / no-ads days / forever) or a
+defined **value product** (a reward bundle, including an archived one), origin-picked; both write an
+`admin_grant` ledger row via `payments.Grant` / `GrantProduct` and **refuse** a chips or `tournament`
+atom (never grant currency; no tournament target yet). Each fund row in the panel carries a **Refund**
+action (`payments.RefundOrderFull`): a full-order refund the operator records after refunding on the
+rail — a `refund` ledger row + a floor-0 chip revoke, idempotent. A **ledger CSV export**
+(`/_gm/ledger.csv`, `payments.LedgerExport`) dumps the whole append-only ledger for tax +
+reconciliation. The shared wire
 contracts live in the sibling [`../pkg`](../pkg) module.
 
 **Account linking & merge** (`/api/v1/user/link/*`). `internal/link`

backend/cmd/backend/main.go

@@ -28,6 +28,7 @@ import (
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/feedback"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/link"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/notify"
@@ -156,6 +157,17 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	logger.Info("active dictionary version", zap.String("version", games.ActiveVersion()))
 	games.SetNotifier(hub)
 	games.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/game"))
+
+	// Active-game limit config: the per-tier, per-kind caps in backend.config, read once into an
+	// in-memory cache at boot and refreshed when the admin edits them. A boot-time load fails fast if
+	// the single config row is missing; the game domain reads the cache on every new-game gate.
+	gameLimits := gamelimits.NewService(gamelimits.NewStore(db))
+	if err := gameLimits.Load(ctx); err != nil {
+		return fmt.Errorf("load game-limit config: %w", err)
+	}
+	games.SetGameLimits(gameLimits)
+	logger.Info("game-limit config loaded")
+
 	go games.RunSweeper(ctx, cfg.Game.TimeoutSweepInterval)
 	logger.Info("game turn-timeout sweeper started",
 		zap.Duration("interval", cfg.Game.TimeoutSweepInterval))
@@ -305,6 +317,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		BanView:       banView,
 		Ads:           adsSvc,
 		Payments:      paymentsSvc,
+		GameLimits:    gameLimits,
 		Notifier:      hub,
 		ExportSignKey: cfg.ExportSignKey,
 		Renderer:      renderer,

backend/internal/adminconsole/templates/layout.gohtml

@@ -15,6 +15,7 @@
     <a href="/_gm/"{{if eq .ActiveNav "dashboard"}} class="active"{{end}}>Dashboard</a>
     <a href="/_gm/users"{{if eq .ActiveNav "users"}} class="active"{{end}}>Users</a>
     <a href="/_gm/games"{{if eq .ActiveNav "games"}} class="active"{{end}}>Games</a>
+    <a href="/_gm/limits"{{if eq .ActiveNav "limits"}} class="active"{{end}}>Limits</a>
     <a href="/_gm/complaints"{{if eq .ActiveNav "complaints"}} class="active"{{end}}>Complaints</a>
     <a href="/_gm/feedback"{{if eq .ActiveNav "feedback"}} class="active"{{end}}>Feedback</a>
     <a href="/_gm/messages"{{if eq .ActiveNav "messages"}} class="active"{{end}}>Messages</a>

backend/internal/adminconsole/templates/pages/games.gohtml

@@ -8,11 +8,11 @@
 <a href="/_gm/games?status=finished"{{if eq .Status "finished"}} class="active"{{end}}>finished</a>
 </nav>
 <table class="list">
-<thead><tr><th>Game</th><th>Variant</th><th>Status</th><th>🤖</th><th class="num">Players</th><th>Updated</th></tr></thead>
+<thead><tr><th>Game</th><th>Variant</th><th>Kind</th><th>Status</th><th>🤖</th><th class="num">Players</th><th>Updated</th></tr></thead>
 <tbody>
 {{range .Items}}
-<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Status}}</td><td>{{if .VsAI}}🤖{{end}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
+<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Kind}}</td><td>{{.Status}}</td><td>{{if .VsAI}}🤖{{end}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
-{{else}}<tr><td colspan="6"><span class="note">no games</span></td></tr>{{end}}
+{{else}}<tr><td colspan="7"><span class="note">no games</span></td></tr>{{end}}
 </tbody>
 </table>
 <nav class="pager">

backend/internal/adminconsole/templates/pages/limits.gohtml

@@ -0,0 +1,19 @@
+{{define "content" -}}
+<h1>Active-game limits</h1>
+{{with .Data}}
+<p class="note">Per-tier, per-kind caps on a player's simultaneous unfinished games. <strong>-1</strong> = unlimited, <strong>0</strong> = the kind is blocked, a positive number caps concurrent games of that kind. Guests are additionally blocked from friend games outright. Changes apply immediately (no redeploy); games already in progress are never affected.</p>
+<section class="panel">
+<form class="form col" method="post" action="/_gm/limits">
+<h2>Guest</h2>
+<label>vs AI <input type="number" name="guest_vs_ai" min="-1" value="{{.GuestVsAI}}" required></label>
+<label>Random <input type="number" name="guest_random" min="-1" value="{{.GuestRandom}}" required></label>
+<label>Friends <input type="number" name="guest_friends" min="-1" value="{{.GuestFriends}}" required></label>
+<h2>Durable account</h2>
+<label>vs AI <input type="number" name="durable_vs_ai" min="-1" value="{{.DurableVsAI}}" required></label>
+<label>Random <input type="number" name="durable_random" min="-1" value="{{.DurableRandom}}" required></label>
+<label>Friends <input type="number" name="durable_friends" min="-1" value="{{.DurableFriends}}" required></label>
+<div><button type="submit">Save</button></div>
+</form>
+</section>
+{{end}}
+{{- end}}

backend/internal/adminconsole/templates/pages/user_detail.gohtml

@@ -73,18 +73,41 @@
 </ul>
 {{else}}<p class="note">no balances or benefits</p>{{end}}
 <h3>Ledger</h3>
+{{$uid := .ID}}
 {{if .Finance.Ledger}}
 <table class="list">
-<thead><tr><th>Time</th><th>Kind</th><th>Source</th><th>Origin</th><th>Chips</th><th>Order</th><th>Provider</th><th>Detail</th></tr></thead>
+<thead><tr><th>Time</th><th>Kind</th><th>Source</th><th>Origin</th><th>Chips</th><th>Order</th><th>Provider</th><th>Detail</th><th></th></tr></thead>
 <tbody>
 {{range .Finance.Ledger}}
-<tr><td>{{.At}}</td><td>{{.Kind}}</td><td>{{.Source}}</td><td>{{.Origin}}</td><td>{{.ChipsDelta}}</td><td>{{if .Order}}<code>{{.Order}}</code>{{end}}</td><td>{{.Provider}}</td><td>{{if .Snapshot}}<code>{{.Snapshot}}</code>{{end}}</td></tr>
+<tr><td>{{.At}}</td><td>{{.Kind}}</td><td>{{.Source}}</td><td>{{.Origin}}</td><td>{{.ChipsDelta}}</td><td>{{if .Order}}<code>{{.Order}}</code>{{end}}</td><td>{{.Provider}}</td><td>{{if .Snapshot}}<code>{{.Snapshot}}</code>{{end}}</td>
+<td>{{if and (eq .Kind "fund") .Order}}<form class="form" method="post" action="/_gm/users/{{$uid}}/refund" onsubmit="return confirm('Refund this order in full? Record the money refund on the rail first; this revokes the chips (floored at 0).')"><input type="hidden" name="order_id" value="{{.Order}}"><button type="submit">Refund</button></form>{{end}}</td></tr>
 {{end}}
 </tbody>
 </table>
+<p class="note"><a href="/_gm/ledger.csv">Export the full ledger (CSV)</a> — all accounts, for tax + reconciliation.</p>
 {{else}}<p class="note">no ledger entries</p>{{end}}
 {{else}}<p class="note">payments not enabled</p>{{end}}
 </section>
+<section class="panel"><h2>Grant benefits</h2>
+{{if .Grant.Present}}
+<p class="note">A zero-price admin sale of a value — <strong>never chips</strong>. The origin is your compliance choice. The by-product grant applies a defined bundle, including an archived reward product.</p>
+<form class="form col" method="post" action="/_gm/users/{{.ID}}/grant">
+<label>Origin <select name="origin">{{range .Grant.Origins}}<option value="{{.}}">{{.}}</option>{{end}}</select></label>
+<label>Hints <input type="number" name="hints" min="0" value="0"></label>
+<label>No-ads days <input type="number" name="noads" min="0" value="0"></label>
+<label><input type="checkbox" name="forever" value="true"> No-ads forever</label>
+<div><button type="submit">Grant</button></div>
+</form>
+{{if .Grant.Products}}
+<h3>Grant a product</h3>
+<form class="form col" method="post" action="/_gm/users/{{.ID}}/grant-product">
+<label>Origin <select name="origin">{{range .Grant.Origins}}<option value="{{.}}">{{.}}</option>{{end}}</select></label>
+<label>Product <select name="product_id">{{range .Grant.Products}}<option value="{{.ID}}">{{.Title}} ({{.Summary}}){{if .Archived}} — archived{{end}}</option>{{end}}</select></label>
+<div><button type="submit">Grant product</button></div>
+</form>
+{{else}}<p class="note">no grantable products — create a value product in the <a href="/_gm/catalog">catalog</a></p>{{end}}
+{{else}}<p class="note">payments not enabled</p>{{end}}
+</section>
 <section class="panel"><h2>Roles</h2>
 {{$id := .ID}}
 {{if .Roles}}
@@ -188,11 +211,11 @@
 {{end}}
 <section class="panel"><h2>Games</h2>
 <table class="list">
-<thead><tr><th>Game</th><th>Variant</th><th>Status</th><th class="num">Players</th><th>Updated</th></tr></thead>
+<thead><tr><th>Game</th><th>Variant</th><th>Kind</th><th>Status</th><th class="num">Players</th><th>Updated</th></tr></thead>
 <tbody>
 {{range .Games}}
-<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Status}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
+<tr><td><a href="/_gm/games/{{.ID}}">{{.ID}}</a></td><td>{{.Variant}}</td><td>{{.Kind}}</td><td>{{.Status}}</td><td class="num">{{.Players}}</td><td>{{.UpdatedAt}}</td></tr>
-{{else}}<tr><td colspan="5"><span class="note">no games</span></td></tr>{{end}}
+{{else}}<tr><td colspan="6"><span class="note">no games</span></td></tr>{{end}}
 </tbody>
 </table>
 </section>

backend/internal/adminconsole/views.go

@@ -198,6 +198,9 @@ type UserDetailView struct {
 	// Finance is the account's payments picture (balances, benefits, refund risk, ledger). Present
 	// is false when the payments domain is unwired.
 	Finance FinanceView
+	// Grant is the admin-grant panel (origin picker + grantable products). Present is false when the
+	// payments domain is unwired.
+	Grant GrantFormView
 }
 
 // FinanceView is the account's payments picture on the user card: chip balances per funding
@@ -309,6 +312,8 @@ type GameRow struct {
 	UpdatedAt string
 	// VsAI marks an honest-AI game (rendered as 🤖 in the list's AI column).
 	VsAI bool
+	// Kind is the game's origin tag label: vs_ai / random / friends / unknown.
+	Kind string
 }
 
 // GamesView is the paginated games list, optionally filtered by status.
@@ -318,6 +323,17 @@ type GamesView struct {
 	Pager  Pager
 }
 
+// GameLimitsView is the per-tier, per-kind active-game limit form: each field is a cap where -1
+// is unlimited, 0 blocks the kind, and a positive value caps concurrent games of that kind.
+type GameLimitsView struct {
+	GuestVsAI      int
+	GuestRandom    int
+	GuestFriends   int
+	DurableVsAI    int
+	DurableRandom  int
+	DurableFriends int
+}
+
 // GameDetailView is one game with its seats.
 type GameDetailView struct {
 	ID          string
@@ -701,3 +717,21 @@ type ProductFormView struct {
 	PriceChip  int64
 	Transacted bool
 }
+
+// GrantFormView is the admin-grant panel on the user card: the origin picker and the grantable
+// products (value bundles — hints / no-ads days — including archived ones; chips and tournament
+// products are excluded). Present is false when the payments domain is unwired.
+type GrantFormView struct {
+	Present  bool
+	Origins  []string
+	Products []GrantProductOption
+}
+
+// GrantProductOption is one grantable product in the by-product picker: its id, title, an atom
+// summary, and whether it is archived (the common case for a non-public reward bundle).
+type GrantProductOption struct {
+	ID       string
+	Title    string
+	Summary  string
+	Archived bool
+}

backend/internal/game/eventwire.go

@@ -52,6 +52,7 @@ func gameSummary(g Game, names []string) notify.GameSummary {
 		TurnTimeoutSecs:      int(g.TurnTimeout.Seconds()),
 		MultipleWordsPerTurn: g.MultipleWordsPerTurn,
 		VsAI:                 g.VsAI,
+		Kind:                 int(g.Kind),
 		MoveCount:            g.MoveCount,
 		EndReason:            g.EndReason,
 		Seats:                seats,
@@ -74,7 +75,6 @@ func playerState(v StateView, names []string, includeAlphabet bool) (notify.Play
 		Rack:           rack,
 		BagLen:         v.BagLen,
 		HintsRemaining: v.HintsRemaining,
-		WalletBalance:  v.WalletBalance,
 	}
 	if includeAlphabet {
 		tab, err := engine.AlphabetTable(v.Game.Variant)

backend/internal/game/helpers_test.go

@@ -55,16 +55,16 @@ func TestPayloadExchangeRoundTrip(t *testing.T) {
 }
 
 func TestHintsRemaining(t *testing.T) {
-	cases := []struct{ allowance, used, wallet, want int }{
+	cases := []struct{ allowance, used, want int }{
-		{1, 0, 3, 4},
+		{1, 0, 1},
-		{1, 1, 3, 3},
+		{1, 1, 0},
-		{1, 2, 3, 3}, // used past allowance clamps to 0
+		{1, 2, 0}, // used past allowance clamps to 0
-		{0, 0, 5, 5},
+		{3, 1, 2},
-		{2, 1, 0, 1},
+		{0, 0, 0},
 	}
 	for _, c := range cases {
-		if got := hintsRemaining(c.allowance, c.used, c.wallet); got != c.want {
+		if got := hintsRemaining(c.allowance, c.used); got != c.want {
-			t.Errorf("hintsRemaining(%d,%d,%d) = %d, want %d", c.allowance, c.used, c.wallet, got, c.want)
+			t.Errorf("hintsRemaining(%d,%d) = %d, want %d", c.allowance, c.used, got, c.want)
 		}
 	}
 }

backend/internal/game/service.go

@@ -17,6 +17,7 @@ import (
 
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
+	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/notify"
 	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/session"
@@ -57,6 +58,9 @@ type Service struct {
 	// nil, only the free per-game allowance is served (no purchased hints). vs_ai hints are
 	// wallet-free and never touch it.
 	hintWallet HintWallet
+	// limits is the per-tier active-game cap config (cached). Set by SetGameLimits during wiring;
+	// when nil, no active-game limit is enforced (a game is always creatable).
+	limits *gamelimits.Service
 	// clearNudges, when set, marks the actor's pending nudges in a game read once they
 	// have committed a move (a nudge answered by moving stops counting as unread). It is
 	// best-effort and kept as a func so the game package never imports the social package.
@@ -126,6 +130,37 @@ func (svc *Service) SetHintWallet(w HintWallet) {
 	svc.hintWallet = w
 }
 
+// SetGameLimits installs the active-game limit config (cached), enabling the per-tier caps. When
+// unset (nil), a game is always creatable.
+func (svc *Service) SetGameLimits(l *gamelimits.Service) {
+	svc.limits = l
+}
+
+// AtGameLimit reports whether accountID has reached its tier's active-game cap for kind — the
+// per-tier, per-kind limits held in backend.config, read from the in-memory cache. It resolves
+// the caller's tier (guest vs durable) from the account, then counts its open+active games of that
+// kind. It reports false (not at the limit) when the limits config is not wired, the account is nil,
+// or the resolved cap is gamelimits.Unlimited. It backs the new-game gate (the handler aborts 409
+// game_limit_reached) and the lobby's at-limit flag.
+func (svc *Service) AtGameLimit(ctx context.Context, accountID uuid.UUID, kind gamelimits.Kind) (bool, error) {
+	if svc.limits == nil || accountID == uuid.Nil {
+		return false, nil
+	}
+	acc, err := svc.accounts.GetByID(ctx, accountID)
+	if err != nil {
+		return false, err
+	}
+	limit := svc.limits.LimitsFor(acc.IsGuest).Cap(kind)
+	if limit == gamelimits.Unlimited {
+		return false, nil
+	}
+	n, err := svc.store.CountActiveByKind(ctx, accountID, kind)
+	if err != nil {
+		return false, err
+	}
+	return n >= limit, nil
+}
+
 // walletContext resolves the payments gate inputs for an account on the current request: the
 // trusted execution context (from the session platform carried on ctx; absent ⇒ untrusted) and
 // the account's present identity sources (which chip/benefit segments are awake, §6).
@@ -338,6 +373,7 @@ func (svc *Service) Create(ctx context.Context, params CreateParams) (Game, erro
 		dropoutTiles:         params.DropoutTiles.String(),
 		multipleWordsPerTurn: params.MultipleWordsPerTurn,
 		vsAI:                 params.VsAI,
+		kind:                 params.Kind,
 	}
 	if err := svc.store.CreateGame(ctx, ins, seats, seeding.draws); err != nil {
 		return Game{}, err
@@ -401,6 +437,7 @@ func (svc *Service) OpenOrJoin(ctx context.Context, accountID uuid.UUID, params
 		multipleWordsPerTurn: params.MultipleWordsPerTurn,
 		status:               StatusOpen,
 		openDeadline:         &deadline,
+		kind:                 gamelimits.KindRandom,
 	}
 	// Decide the first move now by the official draw, with the not-yet-arrived opponent as a
 	// synthetic placeholder (uuid.Nil): the draw fixes who sits at seat 0 — and so moves
@@ -1207,7 +1244,7 @@ func (svc *Service) Hint(ctx context.Context, gameID, accountID uuid.UUID) (Hint
 		return HintResult{}, err
 	}
 	used++
-	return HintResult{Move: move, HintsRemaining: hintsRemaining(pre.HintsPerPlayer, used, walletAfter), WalletBalance: walletAfter}, nil
+	return HintResult{Move: move, HintsRemaining: hintsRemaining(pre.HintsPerPlayer, used), WalletBalance: walletAfter}, nil
 }
 
 // Candidates returns the to-move player's legal plays for a seated player on
@@ -1290,11 +1327,9 @@ func (svc *Service) GameState(ctx context.Context, gameID, accountID uuid.UUID)
 		Seat:   seat,
 		Rack:   g.Hand(seat),
 		BagLen: g.BagLen(),
-		// The hint wallet moved to payments (svc.hintWallet); the deprecated accounts.hint_balance
+		// HintsRemaining is the per-seat allowance only; the purchasable wallet lives on the profile
-		// is no longer read, so the wire wallet is 0 and HintsRemaining is the per-seat allowance.
+		// (payments) and the client adds it (lib/hints.hintsLeft).
-		// The client adds the profile's payments hint balance on top (lib/hints.hintsLeft).
+		HintsRemaining: hintsRemaining(pre.HintsPerPlayer, pre.Seats[seat].HintsUsed),
-		HintsRemaining: hintsRemaining(pre.HintsPerPlayer, pre.Seats[seat].HintsUsed, 0),
-		WalletBalance:  0,
 		// vs_ai idle-hint gate (seconds left; 0 for a human game / first move / not your turn).
 		HintUnlockLeftSeconds: hintUnlockLeftSeconds(pre, seat, svc.clock()),
 	}, nil
@@ -1388,14 +1423,6 @@ func (svc *Service) ListForLobby(ctx context.Context, accountID uuid.UUID) ([]Ga
 	return kept, nil
 }
 
-// CountActiveQuickGames reports how many in-progress quick games the account holds —
-// the count the simultaneous-game limit (MaxActiveQuickGames) is checked against. It
-// counts active and still-open quick games (including honest-AI ones) and excludes
-// friend games created by invitation and finished games. See Store.CountActiveQuickGames.
-func (svc *Service) CountActiveQuickGames(ctx context.Context, accountID uuid.UUID) (int, error) {
-	return svc.store.CountActiveQuickGames(ctx, accountID)
-}
-
 // HideGame hides a finished game from accountID's own lobby (it stays visible to the other
 // players); it is irreversible by design. Only a player of a finished game may hide it
 // (ErrNotAPlayer / ErrGameActive otherwise); hiding an already-hidden game is a no-op.
@@ -1775,10 +1802,10 @@ func (svc *Service) DictBytes(variant engine.Variant, version string) ([]byte, e
 	return svc.registry.DictBytes(variant, version)
 }
 
-// hintsRemaining is a player's remaining hint budget: the unspent per-game
+// hintsRemaining is the unspent per-game hint allowance. The purchasable wallet is separate,
-// allowance plus the profile wallet.
+// carried on the profile (payments), and the client adds it (lib/hints.hintsLeft).
-func hintsRemaining(allowance, used, wallet int) int {
+func hintsRemaining(allowance, used int) int {
-	return max(0, allowance-used) + wallet
+	return max(0, allowance-used)
 }
 
 // allowedTimeout reports whether d is one of the offered move clocks.

backend/internal/game/store.go

@@ -15,6 +15,7 @@ import (
 
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
+	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/postgres/jet/backend/model"
 	"scrabble/backend/internal/postgres/jet/backend/table"
 )
@@ -45,6 +46,8 @@ type gameInsert struct {
 	multipleWordsPerTurn bool
 	// vsAI marks an honest-AI game (games.vs_ai).
 	vsAI bool
+	// kind tags the game's origin (games.game_kind) for the active-game limits.
+	kind gamelimits.Kind
 	// status is the lifecycle state to create the game in: StatusActive for a normal
 	// seated game, StatusOpen for an auto-match game still awaiting an opponent. An
 	// empty string defaults to StatusActive.
@@ -138,6 +141,20 @@ func (s *Store) CreateGame(ctx context.Context, ins gameInsert, seats []seatInse
 	})
 }
 
+// CountActiveByKind counts the account's active (open or in-progress) games of the given kind — the
+// per-tier active-game limit is checked against it before a new game of that kind is created.
+func (s *Store) CountActiveByKind(ctx context.Context, accountID uuid.UUID, kind gamelimits.Kind) (int, error) {
+	var n int
+	if err := s.db.QueryRowContext(ctx,
+		`SELECT count(*) FROM backend.games g
+		   JOIN backend.game_players p ON p.game_id = g.game_id
+		  WHERE p.account_id = $1 AND g.game_kind = $2 AND g.status IN ('open', 'active')`,
+		accountID, int16(kind)).Scan(&n); err != nil {
+		return 0, fmt.Errorf("game: count active by kind %s: %w", accountID, err)
+	}
+	return n, nil
+}
+
 // insertGameTx inserts the games row and one game_players row per seat (seat 0
 // first) on tx, stamping each seat's display-name snapshot. A seat whose account id is
 // uuid.Nil is written with a NULL account_id (and an empty snapshot) — the still-empty
@@ -155,9 +172,9 @@ func insertGameTx(ctx context.Context, tx *sql.Tx, ins gameInsert, seats []seatI
 		table.Games.GameID, table.Games.Variant, table.Games.DictVersion, table.Games.Seed,
 		table.Games.Status, table.Games.Players, table.Games.TurnTimeoutSecs,
 		table.Games.HintsAllowed, table.Games.HintsPerPlayer, table.Games.OpenDeadlineAt,
-		table.Games.DropoutTiles, table.Games.MultipleWordsPerTurn, table.Games.VsAi,
+		table.Games.DropoutTiles, table.Games.MultipleWordsPerTurn, table.Games.VsAi, table.Games.GameKind,
 	).VALUES(ins.id, ins.variant, ins.dictVersion, ins.seed, status, ins.players,
-		ins.turnTimeoutSecs, ins.hintsAllowed, ins.hintsPerPlayer, deadline, ins.dropoutTiles, ins.multipleWordsPerTurn, ins.vsAI)
+		ins.turnTimeoutSecs, ins.hintsAllowed, ins.hintsPerPlayer, deadline, ins.dropoutTiles, ins.multipleWordsPerTurn, ins.vsAI, int16(ins.kind))
 	if _, err := gi.ExecContext(ctx, tx); err != nil {
 		return fmt.Errorf("insert game: %w", err)
 	}
@@ -501,28 +518,6 @@ func (s *Store) ListGamesForAccount(ctx context.Context, accountID uuid.UUID) ([
 	return out, nil
 }
 
-// CountActiveQuickGames counts the account's in-progress quick games — the ones the
-// simultaneous-game limit (MaxActiveQuickGames) is checked against. It includes both
-// active and still-open (awaiting-opponent) games, the honest-AI ones among them, and
-// excludes friend games (those linked to a game_invitations row) and finished games.
-// A hidden game still occupies a slot, so this is a dedicated count rather than a
-// filter over ListGamesForAccount (which drops hidden games). Joining on the account's
-// own seat counts each game once (an open game's empty opponent seat has no account).
-func (s *Store) CountActiveQuickGames(ctx context.Context, accountID uuid.UUID) (int, error) {
-	// The status literals are game.StatusActive / game.StatusOpen, matching the
-	// games.status CHECK in the baseline migration.
-	const q = `
-SELECT COUNT(*) FROM backend.games g
-JOIN backend.game_players gp ON gp.game_id = g.game_id
-LEFT JOIN backend.game_invitations gi ON gi.game_id = g.game_id
-WHERE gp.account_id = $1 AND g.status IN ('active', 'open') AND gi.game_id IS NULL`
-	var n int
-	if err := s.db.QueryRowContext(ctx, q, accountID).Scan(&n); err != nil {
-		return 0, fmt.Errorf("game: count active quick games: %w", err)
-	}
-	return n, nil
-}
-
 // HideGame hides a game from the account's own lobby list (idempotent). The caller validates the
 // game is finished and the account is a player.
 func (s *Store) HideGame(ctx context.Context, accountID, gameID uuid.UUID) error {
@@ -1361,6 +1356,7 @@ func projectGame(g model.Games, seats []model.GamePlayers) (Game, error) {
 	}
 	out.MultipleWordsPerTurn = g.MultipleWordsPerTurn
 	out.VsAI = g.VsAi
+	out.Kind = gamelimits.Kind(g.GameKind)
 	if g.EndReason != nil {
 		out.EndReason = *g.EndReason
 	}

backend/internal/game/types.go

@@ -7,6 +7,7 @@ import (
 	"github.com/google/uuid"
 
 	"scrabble/backend/internal/engine"
+	"scrabble/backend/internal/gamelimits"
 )
 
 // Status values persisted in the games.status column.
@@ -94,15 +95,6 @@ const DefaultTurnTimeout = 24 * time.Hour
 // one of AllowedTurnTimeouts (never offered in the creation UI).
 const AIInactivityTimeout = 7 * 24 * time.Hour
 
-// MaxActiveQuickGames is the cap on a player's simultaneous quick games (human
-// auto-match and honest-AI), counting both in-progress (StatusActive) and
-// still-open, awaiting-opponent (StatusOpen) games. Friend games created by
-// invitation are not counted. At the cap the backend refuses to create a new game
-// of any kind — quick or by invitation — and the lobby disables "New Game";
-// accepting an incoming invitation is always allowed. See
-// Store.CountActiveQuickGames.
-const MaxActiveQuickGames = 10
-
 // aiPlayerName labels the robot seat in an honest-AI game's GCG export, so a downloaded
 // game file shows a clean "AI" rather than the robot's human-like pool name (the in-app
 // UI shows 🤖 from the game's vs_ai flag).
@@ -125,6 +117,10 @@ type CreateParams struct {
 	// robot is seated at once, the move clock is AIInactivityTimeout, and chat/nudge
 	// and finish-time statistics are suppressed. Set by the lobby's AI-match path.
 	VsAI bool
+	// Kind tags the game's origin (games.game_kind) for the active-game limits: vs_ai / random /
+	// friends. The lobby sets it; a zero (unknown) kind is never gated. The active-game limit itself
+	// is enforced at the new-game handler (Server.ensureUnderGameLimit), not here.
+	Kind gamelimits.Kind
 }
 
 // Game is the persisted state of a match: the games row joined with its seats.
@@ -151,6 +147,9 @@ type Game struct {
 	// VsAI is true for an honest-AI game (games.vs_ai): the opponent is a robot the
 	// player knowingly chose, shown as 🤖, with chat/nudge disabled and no statistics.
 	VsAI bool
+	// Kind is the game's origin tag (games.game_kind) for the active-game limits: vs_ai / random /
+	// friends, or unknown for an untagged game. Read-only projection; set once on creation.
+	Kind gamelimits.Kind
 }
 
 // Seat is one player's standing in a game.
@@ -211,10 +210,9 @@ type MoveResult struct {
 	BagLen int
 }
 
-// HintResult is a revealed hint and the requesting player's remaining hint
+// HintResult is a revealed hint with the per-seat allowance remaining (HintsRemaining) and the
-// budget (per-seat allowance plus profile wallet) after spending one. WalletBalance is
+// purchasable hint wallet after spending one (WalletBalance, from payments). The client adopts
-// the global wallet alone, so the client can keep its live wallet authoritative and
+// WalletBalance into the profile so the badge stays live across games (lib/hints).
-// re-derive the per-game allowance (HintsRemaining - WalletBalance).
 type HintResult struct {
 	Move           engine.MoveRecord
 	HintsRemaining int
@@ -241,9 +239,6 @@ type StateView struct {
 	Rack           []string
 	BagLen         int
 	HintsRemaining int
-	// WalletBalance is the player's global hint-wallet balance alone (HintsRemaining folds
-	// it in with the per-game allowance), so the client keeps the wallet live across games.
-	WalletBalance int
 	// HintUnlockLeftSeconds is, for a vs_ai game on the requesting player's turn, the seconds left
 	// until the idle hint unlocks (the robot's last move plus the idle window, from the server clock);
 	// 0 for the human's first move, when it is not their turn, or a non-vs_ai game. The vs_ai hint is

backend/internal/gamelimits/gamelimits.go

@@ -0,0 +1,149 @@
+// Package gamelimits holds the per-tier, per-kind active-game caps (a guest funnel) with a hot
+// in-memory cache over the single-row backend.config, so a login or a game-create never queries it.
+package gamelimits
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"sync"
+
+	"github.com/go-jet/jet/v2/postgres"
+
+	"scrabble/backend/internal/postgres/jet/backend/model"
+	"scrabble/backend/internal/postgres/jet/backend/table"
+)
+
+// Kind is a game's kind, mirroring backend.games.game_kind. 0 (unknown) is an untagged game, never gated.
+type Kind int16
+
+const (
+	KindUnknown Kind = 0
+	KindVsAI    Kind = 1
+	KindRandom  Kind = 2
+	KindFriends Kind = 3
+)
+
+// String returns the kind's label for admin game lists and logs.
+func (k Kind) String() string {
+	switch k {
+	case KindVsAI:
+		return "vs_ai"
+	case KindRandom:
+		return "random"
+	case KindFriends:
+		return "friends"
+	default:
+		return "unknown"
+	}
+}
+
+// Unlimited is the limit sentinel meaning no cap.
+const Unlimited = -1
+
+// Limits is a tier's active-game caps per kind (-1 = unlimited).
+type Limits struct {
+	VsAI    int
+	Random  int
+	Friends int
+}
+
+// Cap returns the limit for kind; the unknown kind is never capped.
+func (l Limits) Cap(kind Kind) int {
+	switch kind {
+	case KindVsAI:
+		return l.VsAI
+	case KindRandom:
+		return l.Random
+	case KindFriends:
+		return l.Friends
+	default:
+		return Unlimited
+	}
+}
+
+// Config is the per-tier limit config (the single backend.config row).
+type Config struct {
+	Guest   Limits
+	Durable Limits
+}
+
+// Store reads and writes the single-row backend.config.
+type Store struct{ db *sql.DB }
+
+// NewStore constructs a Store over db.
+func NewStore(db *sql.DB) *Store { return &Store{db: db} }
+
+func (s *Store) load(ctx context.Context) (Config, error) {
+	var c model.Config
+	if err := postgres.SELECT(table.Config.AllColumns).FROM(table.Config).LIMIT(1).
+		QueryContext(ctx, s.db, &c); err != nil {
+		return Config{}, fmt.Errorf("gamelimits: load config: %w", err)
+	}
+	return Config{
+		Guest:   Limits{VsAI: int(c.GuestVsAiLimit), Random: int(c.GuestRandomLimit), Friends: int(c.GuestFriendsLimit)},
+		Durable: Limits{VsAI: int(c.DurableVsAiLimit), Random: int(c.DurableRandomLimit), Friends: int(c.DurableFriendsLimit)},
+	}, nil
+}
+
+func (s *Store) save(ctx context.Context, c Config) error {
+	if _, err := s.db.ExecContext(ctx,
+		`UPDATE backend.config SET guest_vs_ai_limit=$1, guest_random_limit=$2, guest_friends_limit=$3,
+		   durable_vs_ai_limit=$4, durable_random_limit=$5, durable_friends_limit=$6 WHERE only_row`,
+		c.Guest.VsAI, c.Guest.Random, c.Guest.Friends, c.Durable.VsAI, c.Durable.Random, c.Durable.Friends); err != nil {
+		return fmt.Errorf("gamelimits: save config: %w", err)
+	}
+	return nil
+}
+
+// Service fronts the config with an in-memory cache (single-instance, matching the deploy). Load
+// once at startup; Update after an admin edit refreshes it in place.
+type Service struct {
+	store *Store
+	mu    sync.RWMutex
+	cfg   Config
+}
+
+// NewService constructs a Service over store. Call Load before serving.
+func NewService(store *Store) *Service { return &Service{store: store} }
+
+// Load reads the config into the cache. Call once at startup.
+func (s *Service) Load(ctx context.Context) error {
+	c, err := s.store.load(ctx)
+	if err != nil {
+		return err
+	}
+	s.set(c)
+	return nil
+}
+
+func (s *Service) set(c Config) {
+	s.mu.Lock()
+	s.cfg = c
+	s.mu.Unlock()
+}
+
+// Get returns the cached config.
+func (s *Service) Get() Config {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.cfg
+}
+
+// LimitsFor returns the cached limits for the account tier (guest or durable).
+func (s *Service) LimitsFor(isGuest bool) Limits {
+	c := s.Get()
+	if isGuest {
+		return c.Guest
+	}
+	return c.Durable
+}
+
+// Update saves the config and refreshes the cache in place (the admin edit).
+func (s *Service) Update(ctx context.Context, c Config) error {
+	if err := s.store.save(ctx, c); err != nil {
+		return err
+	}
+	s.set(c)
+	return nil
+}

backend/internal/gamelimits/gamelimits_test.go

@@ -0,0 +1,44 @@
+package gamelimits
+
+import "testing"
+
+// TestLimitsCap checks Cap maps each kind to its field and leaves the unknown kind uncapped, so a
+// untagged game (game_kind 0) is never gated.
+func TestLimitsCap(t *testing.T) {
+	l := Limits{VsAI: 1, Random: 2, Friends: 3}
+	for _, tc := range []struct {
+		kind Kind
+		want int
+	}{
+		{KindVsAI, 1},
+		{KindRandom, 2},
+		{KindFriends, 3},
+		{KindUnknown, Unlimited},
+		{Kind(99), Unlimited},
+	} {
+		if got := l.Cap(tc.kind); got != tc.want {
+			t.Errorf("Cap(%d) = %d, want %d", tc.kind, got, tc.want)
+		}
+	}
+}
+
+// TestServiceLimitsForTier checks LimitsFor selects the guest or durable tier from the cached config.
+func TestServiceLimitsForTier(t *testing.T) {
+	svc := NewService(nil)
+	svc.set(Config{
+		Guest:   Limits{VsAI: 1, Random: 1, Friends: 0},
+		Durable: Limits{VsAI: 10, Random: 10, Friends: 10},
+	})
+
+	if got := svc.LimitsFor(true); got != (Limits{VsAI: 1, Random: 1, Friends: 0}) {
+		t.Errorf("guest limits = %+v, want {1 1 0}", got)
+	}
+	if got := svc.LimitsFor(false); got != (Limits{VsAI: 10, Random: 10, Friends: 10}) {
+		t.Errorf("durable limits = %+v, want {10 10 10}", got)
+	}
+	// The unlimited sentinel resolves through the tier too.
+	svc.set(Config{Durable: Limits{VsAI: Unlimited, Random: Unlimited, Friends: Unlimited}})
+	if got := svc.LimitsFor(false).Cap(KindVsAI); got != Unlimited {
+		t.Errorf("durable vs_ai cap = %d, want unlimited (-1)", got)
+	}
+}

backend/internal/inttest/admin_grant_test.go

@@ -0,0 +1,79 @@
+//go:build integration
+
+package inttest
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"scrabble/backend/internal/payments"
+)
+
+// benefitFor returns the account's benefit on the given origin from its statement.
+func benefitFor(t *testing.T, pay *payments.Service, id uuid.UUID, origin payments.Source) payments.OriginBenefit {
+	t.Helper()
+	stmt, err := pay.AccountStatement(context.Background(), id)
+	if err != nil {
+		t.Fatalf("statement: %v", err)
+	}
+	for _, b := range stmt.Benefits {
+		if b.Origin == origin {
+			return b
+		}
+	}
+	return payments.OriginBenefit{}
+}
+
+// TestConsoleAdminGrant drives the admin grant: a raw benefit grant, a by-product grant of a reward
+// bundle, and a refusal to grant a chips pack; the create is CSRF-guarded.
+func TestConsoleAdminGrant(t *testing.T) {
+	ctx := context.Background()
+	srv, _, pay := bannerServer(t)
+	h := srv.Handler()
+	id := provisionAccount(t)
+	const origin = "http://admin.test"
+	base := "http://admin.test/_gm/users/" + id.String()
+
+	// CSRF: a grant without the origin header is refused.
+	if code, _ := consoleDo(h, http.MethodPost, base+"/grant", "origin=direct&hints=1", ""); code != http.StatusForbidden {
+		t.Fatalf("grant without origin = %d, want 403", code)
+	}
+
+	// Raw grant: 5 hints + 30 no-ads days to the direct origin.
+	if code, body := consoleDo(h, http.MethodPost, base+"/grant", "origin=direct&hints=5&noads=30", origin); code != http.StatusOK || !strings.Contains(body, "Granted") {
+		t.Fatalf("raw grant = %d, has 'Granted' = %v", code, strings.Contains(body, "Granted"))
+	}
+	if b := benefitFor(t, pay, id, payments.SourceDirect); b.Hints != 5 || b.AdsPaidUntil.IsZero() {
+		t.Fatalf("after raw grant: hints=%d adsUntil-zero=%v, want 5 hints + a no-ads term", b.Hints, b.AdsPaidUntil.IsZero())
+	}
+
+	// By-product grant: an archived reward bundle (3 hints) to vk.
+	reward, err := pay.CreateProduct(ctx, payments.ProductInput{
+		Title: "reward-3-hints", Atoms: []payments.AtomLine{{Atom: "hints", Quantity: 3}},
+	}, false)
+	if err != nil {
+		t.Fatalf("create reward: %v", err)
+	}
+	if code, body := consoleDo(h, http.MethodPost, base+"/grant-product", "origin=vk&product_id="+reward.String(), origin); code != http.StatusOK || !strings.Contains(body, "Granted") {
+		t.Fatalf("product grant = %d, has 'Granted' = %v", code, strings.Contains(body, "Granted"))
+	}
+	if b := benefitFor(t, pay, id, payments.SourceVK); b.Hints != 3 {
+		t.Fatalf("after product grant: vk hints=%d, want 3", b.Hints)
+	}
+
+	// A chips pack cannot be granted.
+	pack, err := pay.CreateProduct(ctx, payments.ProductInput{
+		Title: "grant-pack", Atoms: []payments.AtomLine{{Atom: "chips", Quantity: 100}},
+		Prices: []payments.PriceLine{{Method: "direct", Currency: payments.CurrencyRUB, Amount: 14900}},
+	}, true)
+	if err != nil {
+		t.Fatalf("create pack: %v", err)
+	}
+	if code, body := consoleDo(h, http.MethodPost, base+"/grant-product", "origin=direct&product_id="+pack.String(), origin); code != http.StatusOK || !strings.Contains(body, "cannot grant chips") {
+		t.Fatalf("chips grant = %d, has 'cannot grant chips' = %v", code, strings.Contains(body, "cannot grant chips"))
+	}
+}

backend/internal/inttest/admin_refund_test.go

@@ -0,0 +1,77 @@
+//go:build integration
+
+package inttest
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+
+	"scrabble/backend/internal/payments"
+)
+
+// TestConsoleRefundAndExport drives the manual refund and the ledger CSV export: a funded order is
+// refunded in full (chips revoked, a refund row), the refund is idempotent, and the export carries
+// the fund + refund rows; the refund POST is CSRF-guarded.
+func TestConsoleRefundAndExport(t *testing.T) {
+	ctx := context.Background()
+	srv, _, pay := bannerServer(t)
+	h := srv.Handler()
+	id := provisionAccount(t)
+	const origin = "http://admin.test"
+	base := "http://admin.test/_gm/users/" + id.String()
+
+	// Fund a pack: 100 chips + a fund ledger row.
+	prod := seedPackProduct(t, 100, methodPrice{method: "direct", currency: "RUB", amount: 14900})
+	res, err := pay.CreateOrder(ctx, id, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod, "robokassa")
+	if err != nil {
+		t.Fatalf("order: %v", err)
+	}
+	paid, _ := payments.MoneyFromMinor(14900, payments.CurrencyRUB)
+	if _, err := pay.Fund(ctx, res.OrderID, "robokassa", res.OrderID.String(), paid); err != nil {
+		t.Fatalf("fund: %v", err)
+	}
+
+	// CSRF: a refund without the origin header is refused.
+	if code, _ := consoleDo(h, http.MethodPost, base+"/refund", "order_id="+res.OrderID.String(), ""); code != http.StatusForbidden {
+		t.Fatalf("refund without origin = %d, want 403", code)
+	}
+
+	// Refund the order in full → 100 chips revoked (none spent).
+	if code, body := consoleDo(h, http.MethodPost, base+"/refund", "order_id="+res.OrderID.String(), origin); code != http.StatusOK || !strings.Contains(body, "revoked 100 chips") {
+		t.Fatalf("refund = %d, has 'revoked 100 chips' = %v", code, strings.Contains(body, "revoked 100 chips"))
+	}
+	stmt, err := pay.AccountStatement(ctx, id)
+	if err != nil {
+		t.Fatalf("statement: %v", err)
+	}
+	for _, sg := range stmt.Segments {
+		if sg.Source == payments.SourceDirect && sg.Chips != 0 {
+			t.Errorf("after refund: direct chips = %d, want 0", sg.Chips)
+		}
+	}
+	kinds := map[string]int{}
+	for _, e := range stmt.Ledger {
+		kinds[e.Kind]++
+	}
+	if kinds["fund"] != 1 || kinds["refund"] != 1 {
+		t.Errorf("ledger kinds = %v, want one fund + one refund", kinds)
+	}
+
+	// A second refund of the same order is idempotent.
+	if code, body := consoleDo(h, http.MethodPost, base+"/refund", "order_id="+res.OrderID.String(), origin); code != http.StatusOK || !strings.Contains(body, "Already refunded") {
+		t.Fatalf("second refund = %d, has 'Already refunded' = %v", code, strings.Contains(body, "Already refunded"))
+	}
+
+	// Export the whole ledger as CSV: the header, this account, and its fund + refund rows.
+	code, body := consoleDo(h, http.MethodGet, "http://admin.test/_gm/ledger.csv", "", "")
+	if code != http.StatusOK {
+		t.Fatalf("export = %d, want 200", code)
+	}
+	for _, want := range []string{"created_at,account_id,kind", id.String(), ",fund,", ",refund,"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("ledger CSV missing %q", want)
+		}
+	}
+}

backend/internal/inttest/game_limit_test.go

@@ -5,6 +5,7 @@ package inttest
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -18,59 +19,119 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
+	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/server"
+	"scrabble/backend/internal/social"
 )
 
-// The game-limit suite covers the simultaneous quick-game cap (game.MaxActiveQuickGames):
+// The game-limit suite covers the per-tier, per-kind active-game caps (backend.config): the
-// the counting rule (Store/Service.CountActiveQuickGames) and the HTTP gate that refuses a
+// game_kind tag persisted per creation path, the tier resolution + counting rule
-// new game once the cap is reached, while accepting an incoming invitation stays allowed.
+// (game.Service.AtGameLimit), the HTTP gate + lobby at_game_limit flag, the guest gate on friend
+// actions, and the config hot-cache reflecting an admin edit. Accepting an invitation stays exempt.
 
-// TestCountActiveQuickGames checks the count includes active and open quick games (the
+// newGameLimits builds a gamelimits service over the shared pool and loads the seeded config
-// honest-AI ones among them) and excludes finished games, friend games (created by
+// (guest 1/1/0, durable 10/10/10).
-// invitation) and games the account is not seated in.
+func newGameLimits(t *testing.T) *gamelimits.Service {
-func TestCountActiveQuickGames(t *testing.T) {
+	t.Helper()
+	gl := gamelimits.NewService(gamelimits.NewStore(testDB))
+	if err := gl.Load(context.Background()); err != nil {
+		t.Fatalf("load game limits: %v", err)
+	}
+	return gl
+}
+
+// restoreDefaultLimits resets the single config row to the migration seed on cleanup, so a test that
+// edited it never leaks its values into another (the row is a shared singleton).
+func restoreDefaultLimits(t *testing.T, gl *gamelimits.Service) {
+	t.Helper()
+	t.Cleanup(func() {
+		_ = gl.Update(context.Background(), gamelimits.Config{
+			Guest:   gamelimits.Limits{VsAI: 1, Random: 1, Friends: 0},
+			Durable: gamelimits.Limits{VsAI: 10, Random: 10, Friends: 10},
+		})
+	})
+}
+
+// gameKind reads a game's persisted game_kind tag.
+func gameKind(t *testing.T, gameID uuid.UUID) int16 {
+	t.Helper()
+	var k int16
+	if err := testDB.QueryRowContext(context.Background(),
+		`SELECT game_kind FROM backend.games WHERE game_id=$1`, gameID).Scan(&k); err != nil {
+		t.Fatalf("read game_kind: %v", err)
+	}
+	return k
+}
+
+// mustCreateKind creates an active game seating the accounts, tagged with kind, and returns its id.
+func mustCreateKind(t *testing.T, games *game.Service, seats []uuid.UUID, kind gamelimits.Kind) uuid.UUID {
+	t.Helper()
+	g, err := games.Create(context.Background(), game.CreateParams{
+		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Kind: kind,
+	})
+	if err != nil {
+		t.Fatalf("create game (kind=%d): %v", kind, err)
+	}
+	return g.ID
+}
+
+// startFriendGameID has inviter invite invitee to a friend game and the invitee accept, returning
+// the started game's id.
+func startFriendGameID(t *testing.T, inv *lobby.InvitationService, inviter, invitee uuid.UUID) uuid.UUID {
+	t.Helper()
+	ctx := context.Background()
+	invitation, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{invitee}, englishInvite())
+	if err != nil {
+		t.Fatalf("create invitation: %v", err)
+	}
+	got, err := inv.RespondInvitation(ctx, invitation.ID, invitee, true)
+	if err != nil {
+		t.Fatalf("accept invitation: %v", err)
+	}
+	if got.GameID == nil {
+		t.Fatal("accepted invitation has no game id")
+	}
+	return *got.GameID
+}
+
+// TestGameKindPersisted checks each creation path stamps the right game_kind: random (auto-match)
+// =2, vs_ai =1, friend (by invitation) =3.
+func TestGameKindPersisted(t *testing.T) {
 	ctx := context.Background()
 	clearOpenGames(t)
 	games := newGameService()
-	human := provisionAccount(t)
+	inv := newInvitationService()
-	opp := provisionAccount(t)
+	human, opp := provisionAccount(t), provisionAccount(t)
 
-	if n := mustCount(t, games, human); n != 0 {
+	rnd, _, err := games.OpenOrJoin(ctx, human, game.CreateParams{Variant: engine.VariantEnglish, TurnTimeout: 24 * time.Hour}, time.Now().Add(time.Minute), nil)
-		t.Fatalf("fresh account count = %d, want 0", n)
+	if err != nil {
+		t.Fatalf("open random game: %v", err)
+	}
+	if k := gameKind(t, rnd.ID); k != int16(gamelimits.KindRandom) {
+		t.Errorf("random game_kind = %d, want %d", k, gamelimits.KindRandom)
 	}
 
-	// An open (awaiting-opponent) quick game counts.
+	ai := mustCreateKind(t, games, []uuid.UUID{human, opp}, gamelimits.KindVsAI)
-	if _, _, err := games.OpenOrJoin(ctx, human, game.CreateParams{
+	if k := gameKind(t, ai); k != int16(gamelimits.KindVsAI) {
-		Variant: engine.VariantEnglish, TurnTimeout: 24 * time.Hour,
+		t.Errorf("vs_ai game_kind = %d, want %d", k, gamelimits.KindVsAI)
-	}, time.Now().Add(time.Minute), nil); err != nil {
-		t.Fatalf("open quick game: %v", err)
 	}
-	// An active quick game and an honest-AI quick game both count (neither has an invitation row).
-	mustCreateQuick(t, games, []uuid.UUID{human, opp}, false, 1)
-	mustCreateQuick(t, games, []uuid.UUID{human, opp}, true, 2)
 
-	// A finished quick game does NOT count.
+	friend := startFriendGameID(t, inv, human, opp)
-	fin := mustCreateQuick(t, games, []uuid.UUID{human, opp}, false, 3)
+	if k := gameKind(t, friend); k != int16(gamelimits.KindFriends) {
-	if _, err := testDB.ExecContext(ctx, `UPDATE backend.games SET status='finished' WHERE game_id=$1`, fin); err != nil {
+		t.Errorf("friend game_kind = %d, want %d", k, gamelimits.KindFriends)
-		t.Fatalf("finish game: %v", err)
-	}
-	// A game the human is not seated in does NOT count.
-	mustCreateQuick(t, games, []uuid.UUID{opp, provisionAccount(t)}, false, 4)
-	// A friend game (created by invitation) does NOT count, even though it is active.
-	startFriendGame(t, human)
-
-	if n := mustCount(t, games, human); n != 3 {
-		t.Fatalf("active quick count = %d, want 3 (active + AI + open)", n)
 	}
 }
 
-// TestGameLimitGate drives the cap through the assembled HTTP server: under the cap the lobby
+// TestGuestActiveGameLimitHTTP drives the guest random cap through the assembled server: the first
-// reports at_game_limit false; at the cap it flips to true and both new-game endpoints (quick
+// auto-match opens a game, the lobby then flags at_game_limit, and a second enqueue is refused 409
-// enqueue and invitation creation) are refused with 409 game_limit_reached, while accepting an
+// game_limit_reached. It also checks the guest vs_ai and friends caps resolve at the domain level.
-// incoming invitation is still allowed.
+func TestGuestActiveGameLimitHTTP(t *testing.T) {
-func TestGameLimitGate(t *testing.T) {
 	ctx := context.Background()
+	clearOpenGames(t)
+	gl := newGameLimits(t)
 	games := newGameService()
+	games.SetGameLimits(gl)
 	srv := server.New(":0", server.Deps{
 		Logger:      zaptest.NewLogger(t),
 		DB:          testDB,
@@ -78,88 +139,110 @@ func TestGameLimitGate(t *testing.T) {
 		Games:       games,
 		Matchmaker:  newMatchmaker(t, newRobotService(t, newGameService()), time.Minute, 0),
 		Invitations: newInvitationService(),
+		GameLimits:  gl,
 	})
 
-	human := provisionAccount(t)
+	guest := provisionGuest(t)
+	if gamesListAtLimit(t, srv, guest) {
+		t.Fatal("a fresh guest must be under the random game limit")
+	}
+	// The first auto-match opens a random game (guest random cap = 1).
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", guest, `{"variant":"erudit_ru"}`); rec.Code != http.StatusOK {
+		t.Fatalf("first enqueue = %d (%s), want 200", rec.Code, rec.Body.String())
+	}
+	// At the cap: the lobby flags it and a second enqueue is refused with the stable code.
+	if !gamesListAtLimit(t, srv, guest) {
+		t.Fatal("after one random game the guest must be at the limit")
+	}
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", guest, `{"variant":"erudit_ru"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
+		t.Fatalf("second enqueue = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
+	}
+
+	// A guest is refused the friends flow outright at the HTTP edge (403 guest_forbidden).
 	opp := provisionAccount(t)
-
-	// Under the cap: the lobby reports the player is not limited.
-	if gamesListAtLimit(t, srv, human) {
-		t.Fatal("a fresh account must be under the game limit")
-	}
-
-	// Reach the cap with active quick games seating the human (no invitation row → quick).
-	for i := 0; i < game.MaxActiveQuickGames; i++ {
-		mustCreateQuick(t, games, []uuid.UUID{human, opp}, false, int64(i+1))
-	}
-
-	// At the cap: the lobby flags it and both create paths are refused with the stable code.
-	if !gamesListAtLimit(t, srv, human) {
-		t.Fatalf("at %d games at_game_limit must be true", game.MaxActiveQuickGames)
-	}
-	// erudit_ru is in the default variant preferences, so the variant gate passes and the
-	// game-limit gate is what fires here.
-	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"erudit_ru"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
-		t.Fatalf("enqueue at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
-	}
 	invBody := fmt.Sprintf(`{"variant":"erudit_ru","invitee_ids":[%q]}`, opp.String())
-	if rec := userPost(t, srv, "/api/v1/user/invitations", human, invBody); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
+	if rec := userPost(t, srv, "/api/v1/user/invitations", guest, invBody); rec.Code != http.StatusForbidden || errorCode(t, rec) != "guest_forbidden" {
-		t.Fatalf("invitation at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
+		t.Fatalf("guest invitation = (%d, %q), want (403, guest_forbidden)", rec.Code, errorCode(t, rec))
 	}
 
-	// Accepting an incoming invitation is never blocked, even at the cap: another player invites
+	// The guest vs_ai cap is 1: one vs_ai game puts the guest at the vs_ai limit.
-	// the capped human, who accepts over HTTP and the game starts (friend games do not count).
+	mustCreateKind(t, games, []uuid.UUID{guest, opp}, gamelimits.KindVsAI)
-	inviter := provisionAccount(t)
+	if at, err := games.AtGameLimit(ctx, guest, gamelimits.KindVsAI); err != nil || !at {
-	inv := newInvitationService()
+		t.Fatalf("guest vs_ai at-limit = (%v, %v), want (true, nil)", at, err)
-	invitation, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{human}, englishInvite())
-	if err != nil {
-		t.Fatalf("create invitation: %v", err)
 	}
-	if rec := userPost(t, srv, "/api/v1/user/invitations/"+invitation.ID.String()+"/accept", human, ""); rec.Code != http.StatusOK {
+	// The guest friends cap is 0: a guest is always at the friends limit (the 403 gate blocks first).
-		t.Fatalf("accept at limit = %d (%s), want 200 — accept must bypass the cap", rec.Code, rec.Body.String())
+	if at, err := games.AtGameLimit(ctx, guest, gamelimits.KindFriends); err != nil || !at {
+		t.Fatalf("guest friends at-limit = (%v, %v), want (true, nil)", at, err)
 	}
 }
 
-// mustCount returns the account's active-quick-game count, failing on error.
+// TestDurableTierHigherLimit checks a durable account resolves the durable tier, not the guest one:
-func mustCount(t *testing.T, games *game.Service, id uuid.UUID) int {
+// one random game leaves it well under the durable cap (10).
-	t.Helper()
+func TestDurableTierHigherLimit(t *testing.T) {
-	n, err := games.CountActiveQuickGames(context.Background(), id)
-	if err != nil {
-		t.Fatalf("count active quick games: %v", err)
-	}
-	return n
-}
-
-// mustCreateQuick creates an active quick game (no invitation) seating the given accounts and
-// returns its id; vsAI flags an honest-AI game (the service then applies the 7-day clock).
-func mustCreateQuick(t *testing.T, games *game.Service, seats []uuid.UUID, vsAI bool, seed int64) uuid.UUID {
-	t.Helper()
-	p := game.CreateParams{Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Seed: seed}
-	if vsAI {
-		p.VsAI = true
-		p.TurnTimeout = 0 // the service applies the 7-day AI inactivity clock for vs_ai games
-	}
-	g, err := games.Create(context.Background(), p)
-	if err != nil {
-		t.Fatalf("create quick game (vsAI=%v): %v", vsAI, err)
-	}
-	return g.ID
-}
-
-// startFriendGame has a fresh inviter invite the given account to a friend game and the invitee
-// accept it, so the (active) friend game exists with its game_invitations row.
-func startFriendGame(t *testing.T, invitee uuid.UUID) {
-	t.Helper()
 	ctx := context.Background()
+	gl := newGameLimits(t)
+	games := newGameService()
+	games.SetGameLimits(gl)
+	durable, opp := provisionAccount(t), provisionAccount(t)
+
+	mustCreateKind(t, games, []uuid.UUID{durable, opp}, gamelimits.KindRandom)
+	if at, err := games.AtGameLimit(ctx, durable, gamelimits.KindRandom); err != nil || at {
+		t.Fatalf("durable random at-limit after one game = (%v, %v), want (false, nil)", at, err)
+	}
+}
+
+// TestGuestForbiddenFriendActions checks a guest is refused every friend action server-side (the UI
+// hides them; this is the source of truth): creating an invitation, sending a friend request, and
+// redeeming a friend code.
+func TestGuestForbiddenFriendActions(t *testing.T) {
+	ctx := context.Background()
+	guest := provisionGuest(t)
+	other := provisionAccount(t)
+
 	inv := newInvitationService()
+	if _, err := inv.CreateInvitation(ctx, guest, []uuid.UUID{other}, englishInvite()); !errors.Is(err, lobby.ErrGuestForbidden) {
+		t.Fatalf("guest CreateInvitation err = %v, want ErrGuestForbidden", err)
+	}
+
+	soc := newSocialService()
+	if err := soc.SendFriendRequest(ctx, guest, other); !errors.Is(err, social.ErrGuestForbidden) {
+		t.Fatalf("guest SendFriendRequest err = %v, want ErrGuestForbidden", err)
+	}
+	if _, err := soc.RedeemFriendCode(ctx, guest, "000000"); !errors.Is(err, social.ErrGuestForbidden) {
+		t.Fatalf("guest RedeemFriendCode err = %v, want ErrGuestForbidden", err)
+	}
+}
+
+// TestDurableFriendsCapAndConfigCache lowers the durable friends cap to 1 through the service (the
+// admin-edit path), checks a durable inviter is refused a second friend game with 409, and that
+// accepting an incoming invitation is still exempt from the cap.
+func TestDurableFriendsCapAndConfigCache(t *testing.T) {
+	ctx := context.Background()
+	gl := newGameLimits(t)
+	restoreDefaultLimits(t, gl)
+	cfg := gl.Get()
+	cfg.Durable.Friends = 1
+	if err := gl.Update(ctx, cfg); err != nil {
+		t.Fatalf("update durable friends cap: %v", err)
+	}
+	games := newGameService()
+	games.SetGameLimits(gl)
+	inv := lobby.NewInvitationService(lobby.NewStore(testDB), games, account.NewStore(testDB), newSocialService())
+
 	inviter := provisionAccount(t)
-	invitation, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{invitee}, englishInvite())
+	d2, d3 := provisionAccount(t), provisionAccount(t)
-	if err != nil {
+
-		t.Fatalf("create invitation: %v", err)
+	// The inviter's first friend game reaches the (lowered) cap of 1.
+	startFriendGameID(t, inv, inviter, d2)
+	if at, err := games.AtGameLimit(ctx, inviter, gamelimits.KindFriends); err != nil || !at {
+		t.Fatalf("inviter friends at-limit = (%v, %v), want (true, nil)", at, err)
 	}
-	if _, err := inv.RespondInvitation(ctx, invitation.ID, invitee, true); err != nil {
+	// A second invitation is refused: the cache reflects the edit.
-		t.Fatalf("accept invitation: %v", err)
+	if _, err := inv.CreateInvitation(ctx, inviter, []uuid.UUID{d3}, englishInvite()); !errors.Is(err, game.ErrGameLimitReached) {
+		t.Fatalf("second invitation err = %v, want ErrGameLimitReached", err)
 	}
+	// Accept stays exempt: someone else invites the capped inviter, who accepts and the game starts.
+	startFriendGameID(t, inv, d3, inviter)
 }
 
 // gamesListAtLimit fetches /api/v1/user/games and returns its at_game_limit flag.

backend/internal/inttest/game_test.go

@@ -424,13 +424,13 @@ func TestHintPolicy(t *testing.T) {
 		t.Fatalf("first hint: %v", err)
 	}
 	// The allowance is spent before the wallet: with an empty wallet, the state now reports no
-	// hints left and a zero wallet, so the per-game allowance (HintsRemaining-WalletBalance) is 0.
+	// per-game allowance left (HintsRemaining is the allowance alone; the wallet lives on the profile).
 	st, err := svc.GameState(ctx, g.ID, seats[0])
 	if err != nil {
 		t.Fatalf("state: %v", err)
 	}
-	if st.HintsRemaining != 0 || st.WalletBalance != 0 {
+	if st.HintsRemaining != 0 {
-		t.Errorf("after allowance hint: hints=%d wallet=%d, want 0/0", st.HintsRemaining, st.WalletBalance)
+		t.Errorf("after allowance hint: hints=%d, want 0", st.HintsRemaining)
 	}
 	if _, err := svc.Hint(ctx, g.ID, seats[0]); !errors.Is(err, game.ErrNoHintsLeft) {
 		t.Fatalf("second hint = %v, want ErrNoHintsLeft", err)
@@ -444,9 +444,10 @@ func TestHintPolicy(t *testing.T) {
 	if err != nil {
 		t.Fatalf("wallet hint: %v", err)
 	}
-	// The allowance stays exhausted; the wallet dropped 2->1, and WalletBalance carries it alone.
+	// The allowance stays exhausted (HintsRemaining is the allowance alone, so 0); the wallet dropped
-	if res.HintsRemaining != 1 || res.WalletBalance != 1 {
+	// 2->1 and WalletBalance carries it (the client adopts it into the profile).
-		t.Errorf("wallet hint: hints=%d wallet=%d, want 1/1", res.HintsRemaining, res.WalletBalance)
+	if res.HintsRemaining != 0 || res.WalletBalance != 1 {
+		t.Errorf("wallet hint: hints=%d wallet=%d, want 0/1", res.HintsRemaining, res.WalletBalance)
 	}
 	// game_players.hints_used counts BOTH hints (1 allowance + 1 wallet) — the per-game total
 	// that feeds the player's lifetime hint statistics, not just the allowance.

backend/internal/lobby/invitations.go

@@ -15,6 +15,7 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/notify"
 	"scrabble/backend/internal/postgres/jet/backend/model"
 	"scrabble/backend/internal/postgres/jet/backend/table"
@@ -218,6 +219,20 @@ func (svc *InvitationService) CreateInvitation(ctx context.Context, inviterID uu
 	if !slices.Contains(game.AllowedTurnTimeouts, settings.TurnTimeout) {
 		return Invitation{}, fmt.Errorf("%w: turn timeout %s not allowed", ErrInvalidInvitation, settings.TurnTimeout)
 	}
+	// A guest cannot invite: friend games are a durable-account feature. The UI hides the flow;
+	// this is the server source of truth.
+	if acc, err := svc.accounts.GetByID(ctx, inviterID); err != nil {
+		return Invitation{}, err
+	} else if acc.IsGuest {
+		return Invitation{}, ErrGuestForbidden
+	}
+	// A durable inviter is still capped: refuse a new friend game once the per-tier friends limit is
+	// reached. The guest branch above short-circuits before here, so this is the durable cap.
+	if atLimit, err := svc.games.AtGameLimit(ctx, inviterID, gamelimits.KindFriends); err != nil {
+		return Invitation{}, err
+	} else if atLimit {
+		return Invitation{}, game.ErrGameLimitReached
+	}
 	seen := map[uuid.UUID]bool{inviterID: true}
 	// suppressed collects invitees who have blocked the inviter: the invitation is still
 	// created and persisted for them, but they are never notified and never see it (their
@@ -336,6 +351,7 @@ func (svc *InvitationService) startGame(ctx context.Context, invitationID uuid.U
 		HintsPerPlayer:       inv.Settings.HintsPerPlayer,
 		DropoutTiles:         inv.Settings.DropoutTiles,
 		MultipleWordsPerTurn: inv.Settings.MultipleWordsPerTurn,
+		Kind:                 gamelimits.KindFriends,
 	})
 	if err != nil {
 		return err

backend/internal/lobby/lobby.go

@@ -15,17 +15,22 @@ import (
 
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/notify"
 )
 
 // GameCreator is the slice of the game domain the lobby needs: starting a seated
-// game and reading a player's initial view of it. game.Service satisfies it.
+// game, reading a player's initial view of it, and testing a caller's active-game
+// cap. game.Service satisfies it.
 type GameCreator interface {
 	Create(ctx context.Context, params game.CreateParams) (game.Game, error)
 	// InitialState returns a seated player's full initial view of a started game, used
 	// to enrich the game_started event so the client renders the new game without a
 	// follow-up fetch.
 	InitialState(ctx context.Context, gameID, accountID uuid.UUID) (notify.PlayerState, error)
+	// AtGameLimit reports whether accountID has reached its tier's active-game cap for kind. The
+	// invitation path uses it to enforce the friends limit before opening one.
+	AtGameLimit(ctx context.Context, accountID uuid.UUID, kind gamelimits.Kind) (bool, error)
 }
 
 // RobotProvider supplies a robot account to substitute for a missing human in
@@ -62,6 +67,9 @@ var (
 	// ErrInvalidInvitation is returned for a malformed invitation (bad player
 	// count, duplicate or self invitee, or unacceptable settings).
 	ErrInvalidInvitation = errors.New("lobby: invalid invitation")
+	// ErrGuestForbidden is returned when a guest attempts a durable-only action (invite a
+	// friend); the friend flow is gated to durable accounts.
+	ErrGuestForbidden = errors.New("lobby: guests cannot invite")
 	// ErrInvitationBlocked is returned when a block stands between the inviter and
 	// an invitee.
 	ErrInvitationBlocked = errors.New("lobby: invitation blocked between accounts")

backend/internal/lobby/matchmaker.go

@@ -10,6 +10,7 @@ import (
 
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/notify"
 )
 
@@ -141,6 +142,7 @@ func (m *Matchmaker) StartVsAI(ctx context.Context, accountID uuid.UUID, variant
 	if rand.IntN(2) == 1 {
 		params.Seats = []uuid.UUID{robotID, accountID}
 	}
+	params.Kind = gamelimits.KindVsAI
 	g, err := m.games.Create(ctx, params)
 	if err != nil {
 		return EnqueueResult{}, err

backend/internal/notify/encode.go

@@ -37,6 +37,7 @@ func toWireGame(g GameSummary) wire.GameView {
 		TurnTimeoutSecs:      g.TurnTimeoutSecs,
 		MultipleWordsPerTurn: g.MultipleWordsPerTurn,
 		VsAI:                 g.VsAI,
+		Kind:                 g.Kind,
 		MoveCount:            g.MoveCount,
 		EndReason:            g.EndReason,
 		Seats:                seats,
@@ -83,7 +84,6 @@ func buildStateView(b *flatbuffers.Builder, s PlayerState) flatbuffers.UOffsetT
 		Rack:           s.Rack,
 		BagLen:         s.BagLen,
 		HintsRemaining: s.HintsRemaining,
-		WalletBalance:  s.WalletBalance,
 		Alphabet:       alphabet,
 	})
 }

backend/internal/notify/notify_test.go

@@ -115,7 +115,7 @@ func TestGameOverPayloadRoundTrips(t *testing.T) {
 func TestOpponentMovedPayloadRoundTrips(t *testing.T) {
 	uid, gid := uuid.New(), uuid.New()
 	move := engine.MoveRecord{Player: 1, Action: engine.ActionPlay, Words: []string{"STOOL"}, Score: 24, Total: 130}
-	summary := notify.GameSummary{ID: gid.String(), MoveCount: 9, ToMove: 0, Seats: []notify.SeatStanding{{Seat: 1, Score: 130}}}
+	summary := notify.GameSummary{ID: gid.String(), MoveCount: 9, ToMove: 0, Kind: 2, Seats: []notify.SeatStanding{{Seat: 1, Score: 130}}}
 	in := notify.OpponentMoved(uid, gid, move, summary, 42)
 	if in.Kind != notify.KindOpponentMoved {
 		t.Fatalf("kind = %q", in.Kind)
@@ -132,7 +132,7 @@ func TestOpponentMovedPayloadRoundTrips(t *testing.T) {
 	if m == nil || m.Player() != 1 || string(m.Action()) != "play" || m.Total() != 130 {
 		t.Fatalf("move wrong: %+v", m)
 	}
-	if g := ev.Game(nil); g == nil || g.MoveCount() != 9 || g.ToMove() != 0 {
+	if g := ev.Game(nil); g == nil || g.MoveCount() != 9 || g.ToMove() != 0 || g.Kind() != 2 {
 		t.Fatalf("game summary wrong: %+v", ev.Game(nil))
 	}
 }

backend/internal/notify/payload.go

@@ -35,6 +35,9 @@ type GameSummary struct {
 	EndReason        string
 	Seats            []SeatStanding
 	LastActivityUnix int64
+	// Kind is the game's origin for the active-game limits (0 unknown, 1 vs_ai, 2 random, 3 friends);
+	// it rides live events so a lobby patch keeps the per-kind count correct.
+	Kind int
 }
 
 // AlphabetLetter is one variant alphabet entry (a display-only row) embedded in an
@@ -56,7 +59,6 @@ type PlayerState struct {
 	Rack           []int
 	BagLen         int
 	HintsRemaining int
-	WalletBalance  int
 	Alphabet       []AlphabetLetter
 }
 

backend/internal/payments/refund_admin.go

@@ -0,0 +1,41 @@
+package payments
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+// providerAdmin tags an operator-initiated refund in the ledger, distinct from a rail's own refund
+// (robokassa / vk / telegram). The refund idempotency key (providerAdmin, order id) allows exactly
+// one manual full refund per order.
+const providerAdmin = "admin"
+
+// RefundOrderFull refunds a paid order in full at the operator's request: it revokes the funded
+// chips best-effort (floored at 0, never negative — D27), records a refund ledger row, and is
+// idempotent (a second call reports AlreadyRefunded). The operator performs the actual money refund
+// on the rail (Robokassa cabinet / VK support / Telegram refundStarPayment); this records it.
+func (s *Service) RefundOrderFull(ctx context.Context, orderID uuid.UUID) (RefundOutcome, error) {
+	o, err := s.store.orderByID(ctx, orderID)
+	if err != nil {
+		return RefundOutcome{}, err
+	}
+	refunded, err := MoneyFromMinor(o.expectedAmount, Currency(o.currency))
+	if err != nil {
+		return RefundOutcome{}, err
+	}
+	return s.store.refund(ctx, orderID, providerAdmin, orderID.String(), refunded, s.clock())
+}
+
+// LedgerExportRow is one append-only ledger row for the tax / reconciliation export, carrying the
+// account it belongs to alongside the entry fields.
+type LedgerExportRow struct {
+	AccountID string
+	LedgerEntry
+}
+
+// LedgerExport reads the entire append-only ledger (all accounts, newest first) for a CSV/JSON
+// export — tax reporting and future rail reconciliation. Uncached, admin-only.
+func (s *Service) LedgerExport(ctx context.Context) ([]LedgerExportRow, error) {
+	return s.store.allLedger(ctx)
+}

backend/internal/payments/service.go

@@ -156,6 +156,41 @@ func (s *Service) Grant(ctx context.Context, accountID uuid.UUID, origin Source,
 	return s.store.grant(ctx, accountID, origin, d, snapshot, s.clock())
 }
 
+// GrantProduct grants a product's benefit atoms (hints, no-ads days) to an origin as a zero-price
+// admin sale, recording the source product on the ledger row (auditable to it). It refuses a
+// product carrying the chips atom (never granted — D16) or the tournament atom (no credit target
+// yet), and one whose atoms yield no grantable benefit.
+func (s *Service) GrantProduct(ctx context.Context, accountID uuid.UUID, origin Source, productID uuid.UUID) error {
+	if !origin.Valid() {
+		return fmt.Errorf("payments: invalid grant origin %q", origin)
+	}
+	in, err := s.store.productInput(ctx, productID)
+	if err != nil {
+		return err
+	}
+	var d benefitDelta
+	for _, a := range in.Atoms {
+		switch a.Atom {
+		case "hints":
+			d.hintsAdd += a.Quantity
+		case "noads_days":
+			d.noAdsDays += a.Quantity
+		case atomChips:
+			return ErrCannotGrantChips
+		case "tournament":
+			return ErrCannotGrantTournament
+		}
+	}
+	if d.zero() {
+		return ErrNothingToGrant
+	}
+	snapshot, err := marshalGrantProduct(productID, in.Title, d)
+	if err != nil {
+		return err
+	}
+	return s.store.grantProduct(ctx, accountID, origin, productID, d, snapshot, s.clock())
+}
+
 // MergeTx merges the secondary account's segments and benefits into the primary inside the
 // caller's transaction (the account-merge flow). The caller invalidates the affected caches
 // after committing (Invalidate).
@@ -244,3 +279,20 @@ func marshalGrant(d benefitDelta) ([]byte, error) {
 	}
 	return b, nil
 }
+
+// marshalGrantProduct builds the snapshot for an admin grant-by-product: the source product and the
+// benefit atoms it granted (price 0).
+func marshalGrantProduct(productID uuid.UUID, title string, d benefitDelta) ([]byte, error) {
+	atoms := map[string]int{}
+	if d.hintsAdd > 0 {
+		atoms["hints"] = d.hintsAdd
+	}
+	if d.noAdsDays > 0 {
+		atoms["noads_days"] = d.noAdsDays
+	}
+	b, err := json.Marshal(purchaseSnapshot{ProductID: productID.String(), Title: title, Atoms: atoms, PriceChips: 0})
+	if err != nil {
+		return nil, fmt.Errorf("payments: marshal product grant snapshot: %w", err)
+	}
+	return b, nil
+}

backend/internal/payments/store_statement.go

@@ -77,6 +77,36 @@ func (s *Store) accountStatement(ctx context.Context, accountID uuid.UUID) (Stat
 	return out, nil
 }
 
+// allLedger reads the entire append-only ledger (all accounts, newest first) for the admin export.
+func (s *Store) allLedger(ctx context.Context) ([]LedgerExportRow, error) {
+	var rows []model.Ledger
+	if err := postgres.SELECT(table.Ledger.AllColumns).
+		FROM(table.Ledger).
+		ORDER_BY(table.Ledger.CreatedAt.DESC()).
+		QueryContext(ctx, s.db, &rows); err != nil {
+		return nil, fmt.Errorf("payments: export ledger: %w", err)
+	}
+	out := make([]LedgerExportRow, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, LedgerExportRow{
+			AccountID: r.AccountID.String(),
+			LedgerEntry: LedgerEntry{
+				Kind:              r.Kind,
+				Source:            derefStr(r.Source),
+				Origin:            derefStr(r.Origin),
+				ChipsDelta:        int(r.ChipsDelta),
+				ProductID:         derefUUID(r.ProductID),
+				OrderID:           derefUUID(r.OrderID),
+				Provider:          derefStr(r.Provider),
+				ProviderPaymentID: derefStr(r.ProviderPaymentID),
+				Snapshot:          derefStr(r.Snapshot),
+				CreatedAt:         r.CreatedAt,
+			},
+		})
+	}
+	return out, nil
+}
+
 // derefStr returns the pointed-to string, or "" when the pointer is nil (a NULL column).
 func derefStr(p *string) string {
 	if p == nil {

backend/internal/payments/store_wallet.go

@@ -26,6 +26,14 @@ var (
 	// ErrNotAValue means the product has no chip price (it is a chip pack or unpriced), so it
 	// cannot be bought with chips.
 	ErrNotAValue = errors.New("payments: product is not a chip-priced value")
+	// ErrCannotGrantChips means an admin grant targeted a product carrying the chips atom — the
+	// admin never grants currency (a gifted balance would bypass the cash desk, D16).
+	ErrCannotGrantChips = errors.New("payments: cannot grant chips")
+	// ErrCannotGrantTournament means an admin grant targeted a product carrying the tournament atom,
+	// which has no credit target until the tournament stage.
+	ErrCannotGrantTournament = errors.New("payments: cannot grant a tournament atom yet")
+	// ErrNothingToGrant means the product's atoms yield no grantable benefit (hints / no-ads days).
+	ErrNothingToGrant = errors.New("payments: product has nothing to grant")
 )
 
 // withTx runs fn inside a transaction on db, rolling back on error or panic.
@@ -312,6 +320,22 @@ func (s *Store) grant(ctx context.Context, accountID uuid.UUID, origin Source, d
 	return nil
 }
 
+// grantProduct is grant with the source product recorded on the ledger row (product_id), for an
+// admin grant-by-product — the benefit is the product's atoms, the ledger stays auditable to it.
+func (s *Store) grantProduct(ctx context.Context, accountID uuid.UUID, origin Source, productID uuid.UUID, d benefitDelta, snapshot []byte, now time.Time) error {
+	err := withTx(ctx, s.db, func(tx *sql.Tx) error {
+		if err := insertLedgerTx(ctx, tx, accountID, "admin_grant", nil, &origin, 0, &productID, nil, nil, nil, snapshot, now); err != nil {
+			return err
+		}
+		return applyBenefitTx(ctx, tx, accountID, origin, d, now)
+	})
+	if err != nil {
+		return err
+	}
+	s.cache.invalidate(accountID)
+	return nil
+}
+
 // consumeHint decrements one hint from the first applicable origin (in the given priority order)
 // that has one, with a guarded update. It returns whether a hint was spent.
 func (s *Store) consumeHint(ctx context.Context, accountID uuid.UUID, origins []Source, now time.Time) (bool, error) {

backend/internal/postgres/jet/backend/model/config.go

@@ -0,0 +1,18 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package model
+
+type Config struct {
+	OnlyRow             bool `sql:"primary_key"`
+	GuestVsAiLimit      int16
+	GuestRandomLimit    int16
+	GuestFriendsLimit   int16
+	DurableVsAiLimit    int16
+	DurableRandomLimit  int16
+	DurableFriendsLimit int16
+}

backend/internal/postgres/jet/backend/model/games.go

@@ -33,4 +33,5 @@ type Games struct {
 	DropoutTiles         string
 	MultipleWordsPerTurn bool
 	VsAi                 bool
+	GameKind             int16
 }

backend/internal/postgres/jet/backend/table/config.go

@@ -0,0 +1,96 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package table
+
+import (
+	"github.com/go-jet/jet/v2/postgres"
+)
+
+var Config = newConfigTable("backend", "config", "")
+
+type configTable struct {
+	postgres.Table
+
+	// Columns
+	OnlyRow             postgres.ColumnBool
+	GuestVsAiLimit      postgres.ColumnInteger
+	GuestRandomLimit    postgres.ColumnInteger
+	GuestFriendsLimit   postgres.ColumnInteger
+	DurableVsAiLimit    postgres.ColumnInteger
+	DurableRandomLimit  postgres.ColumnInteger
+	DurableFriendsLimit postgres.ColumnInteger
+
+	AllColumns     postgres.ColumnList
+	MutableColumns postgres.ColumnList
+	DefaultColumns postgres.ColumnList
+}
+
+type ConfigTable struct {
+	configTable
+
+	EXCLUDED configTable
+}
+
+// AS creates new ConfigTable with assigned alias
+func (a ConfigTable) AS(alias string) *ConfigTable {
+	return newConfigTable(a.SchemaName(), a.TableName(), alias)
+}
+
+// Schema creates new ConfigTable with assigned schema name
+func (a ConfigTable) FromSchema(schemaName string) *ConfigTable {
+	return newConfigTable(schemaName, a.TableName(), a.Alias())
+}
+
+// WithPrefix creates new ConfigTable with assigned table prefix
+func (a ConfigTable) WithPrefix(prefix string) *ConfigTable {
+	return newConfigTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
+}
+
+// WithSuffix creates new ConfigTable with assigned table suffix
+func (a ConfigTable) WithSuffix(suffix string) *ConfigTable {
+	return newConfigTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
+}
+
+func newConfigTable(schemaName, tableName, alias string) *ConfigTable {
+	return &ConfigTable{
+		configTable: newConfigTableImpl(schemaName, tableName, alias),
+		EXCLUDED:    newConfigTableImpl("", "excluded", ""),
+	}
+}
+
+func newConfigTableImpl(schemaName, tableName, alias string) configTable {
+	var (
+		OnlyRowColumn             = postgres.BoolColumn("only_row")
+		GuestVsAiLimitColumn      = postgres.IntegerColumn("guest_vs_ai_limit")
+		GuestRandomLimitColumn    = postgres.IntegerColumn("guest_random_limit")
+		GuestFriendsLimitColumn   = postgres.IntegerColumn("guest_friends_limit")
+		DurableVsAiLimitColumn    = postgres.IntegerColumn("durable_vs_ai_limit")
+		DurableRandomLimitColumn  = postgres.IntegerColumn("durable_random_limit")
+		DurableFriendsLimitColumn = postgres.IntegerColumn("durable_friends_limit")
+		allColumns                = postgres.ColumnList{OnlyRowColumn, GuestVsAiLimitColumn, GuestRandomLimitColumn, GuestFriendsLimitColumn, DurableVsAiLimitColumn, DurableRandomLimitColumn, DurableFriendsLimitColumn}
+		mutableColumns            = postgres.ColumnList{GuestVsAiLimitColumn, GuestRandomLimitColumn, GuestFriendsLimitColumn, DurableVsAiLimitColumn, DurableRandomLimitColumn, DurableFriendsLimitColumn}
+		defaultColumns            = postgres.ColumnList{OnlyRowColumn, GuestVsAiLimitColumn, GuestRandomLimitColumn, GuestFriendsLimitColumn, DurableVsAiLimitColumn, DurableRandomLimitColumn, DurableFriendsLimitColumn}
+	)
+
+	return configTable{
+		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
+
+		//Columns
+		OnlyRow:             OnlyRowColumn,
+		GuestVsAiLimit:      GuestVsAiLimitColumn,
+		GuestRandomLimit:    GuestRandomLimitColumn,
+		GuestFriendsLimit:   GuestFriendsLimitColumn,
+		DurableVsAiLimit:    DurableVsAiLimitColumn,
+		DurableRandomLimit:  DurableRandomLimitColumn,
+		DurableFriendsLimit: DurableFriendsLimitColumn,
+
+		AllColumns:     allColumns,
+		MutableColumns: mutableColumns,
+		DefaultColumns: defaultColumns,
+	}
+}

backend/internal/postgres/jet/backend/table/games.go

@@ -37,6 +37,7 @@ type gamesTable struct {
 	DropoutTiles         postgres.ColumnString
 	MultipleWordsPerTurn postgres.ColumnBool
 	VsAi                 postgres.ColumnBool
+	GameKind             postgres.ColumnInteger
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -98,9 +99,10 @@ func newGamesTableImpl(schemaName, tableName, alias string) gamesTable {
 		DropoutTilesColumn         = postgres.StringColumn("dropout_tiles")
 		MultipleWordsPerTurnColumn = postgres.BoolColumn("multiple_words_per_turn")
 		VsAiColumn                 = postgres.BoolColumn("vs_ai")
-		allColumns                 = postgres.ColumnList{GameIDColumn, VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn}
+		GameKindColumn             = postgres.IntegerColumn("game_kind")
-		mutableColumns             = postgres.ColumnList{VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn}
+		allColumns                 = postgres.ColumnList{GameIDColumn, VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn, GameKindColumn}
-		defaultColumns             = postgres.ColumnList{StatusColumn, ToMoveColumn, TurnStartedAtColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, CreatedAtColumn, UpdatedAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn}
+		mutableColumns             = postgres.ColumnList{VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn, GameKindColumn}
+		defaultColumns             = postgres.ColumnList{StatusColumn, ToMoveColumn, TurnStartedAtColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, CreatedAtColumn, UpdatedAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn, GameKindColumn}
 	)
 
 	return gamesTable{
@@ -127,6 +129,7 @@ func newGamesTableImpl(schemaName, tableName, alias string) gamesTable {
 		DropoutTiles:         DropoutTilesColumn,
 		MultipleWordsPerTurn: MultipleWordsPerTurnColumn,
 		VsAi:                 VsAiColumn,
+		GameKind:             GameKindColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/table_use_schema.go

@@ -21,6 +21,7 @@ func UseSchema(schema string) {
 	Blocks = Blocks.FromSchema(schema)
 	ChatMessages = ChatMessages.FromSchema(schema)
 	Complaints = Complaints.FromSchema(schema)
+	Config = Config.FromSchema(schema)
 	DictionaryState = DictionaryState.FromSchema(schema)
 	EmailConfirmations = EmailConfirmations.FromSchema(schema)
 	FeedbackMessages = FeedbackMessages.FromSchema(schema)

backend/internal/postgres/migrations/00014_guest_limits.sql

@@ -0,0 +1,36 @@
+-- Guest-limit foundation (E8): tag each game with its kind so the per-tier, per-kind active-game
+-- limits are enforceable, and add the single-row config that holds those limits (tuned in the admin,
+-- no release). It replaces the old hardcoded MaxActiveQuickGames=10 combined cap with a per-tier,
+-- per-kind config. game_kind: 0=unknown (pre-E8 games, never gated), 1=vs_ai, 2=random, 3=friends —
+-- set on creation. The limits are smallint with -1 = unlimited; a guest defaults to 1 vs_ai + 1
+-- random (friends 0, moot — the guest gate blocks friend games), a durable account to 10 per kind
+-- (the old cap, now per kind). Additive only — applies forward via goose with no data rewrite (no
+-- contour wipe); an image rollback ignores the column + table.
+-- +goose Up
+
+ALTER TABLE backend.games
+    ADD COLUMN game_kind smallint DEFAULT 0 NOT NULL;
+ALTER TABLE backend.games
+    ADD CONSTRAINT games_game_kind_chk CHECK (game_kind >= 0 AND game_kind <= 3);
+
+CREATE TABLE backend.config (
+    only_row boolean DEFAULT true NOT NULL,
+    guest_vs_ai_limit smallint DEFAULT 1 NOT NULL,
+    guest_random_limit smallint DEFAULT 1 NOT NULL,
+    guest_friends_limit smallint DEFAULT 0 NOT NULL,
+    durable_vs_ai_limit smallint DEFAULT 10 NOT NULL,
+    durable_random_limit smallint DEFAULT 10 NOT NULL,
+    durable_friends_limit smallint DEFAULT 10 NOT NULL,
+    CONSTRAINT config_pkey PRIMARY KEY (only_row),
+    CONSTRAINT config_single_row_chk CHECK (only_row),
+    CONSTRAINT config_limits_chk CHECK (
+        guest_vs_ai_limit >= -1 AND guest_random_limit >= -1 AND guest_friends_limit >= -1 AND
+        durable_vs_ai_limit >= -1 AND durable_random_limit >= -1 AND durable_friends_limit >= -1)
+);
+
+INSERT INTO backend.config (only_row) VALUES (true);
+
+-- +goose Down
+
+DROP TABLE backend.config;
+ALTER TABLE backend.games DROP COLUMN game_kind;

backend/internal/server/banner.go

@@ -72,6 +72,7 @@ func (s *Server) profileResponse(ctx context.Context, acc account.Account) profi
 	}
 	r.Banner = s.bannerFor(ctx, acc, cxt, present)
 	r.Ads = s.adsFor(ctx, acc, cxt, present)
+	r.GameLimits = s.gameLimitsDTOFor(acc.IsGuest)
 	s.fillLinkedIdentities(ctx, &r, acc.ID)
 	r.DictVersions = s.currentDictVersions()
 	return r

backend/internal/server/dto.go

@@ -78,6 +78,18 @@ type profileResponse struct {
 	// Filled outside the pure projection (it reads the dictionary registry), so it is empty
 	// for callers that build the DTO without a Server. See Server.profileResponse.
 	DictVersions []dictVersion `json:"dict_versions,omitempty"`
+	// GameLimits carries the caller's tier active-game caps per kind (-1 = unlimited); the client
+	// counts its active games per kind from the lobby and locks a capped New-Game start. Filled
+	// outside the pure projection (it reads the limits config). See Server.profileResponse.
+	GameLimits *gameLimitsDTO `json:"game_limits,omitempty"`
+}
+
+// gameLimitsDTO is the caller's tier active-game caps per kind (-1 = unlimited), for the client's
+// per-kind New-Game lock. profileResponse.GameLimits carries it.
+type gameLimitsDTO struct {
+	VsAI    int `json:"vs_ai"`
+	Random  int `json:"random"`
+	Friends int `json:"friends"`
 }
 
 // dictVersion pairs a game variant's stable label (engine.Variant.String) with its current
@@ -134,7 +146,11 @@ type gameDTO struct {
 	MultipleWordsPerTurn bool   `json:"multiple_words_per_turn"`
 	// VsAI marks an honest-AI game: the opponent is shown as 🤖 and chat/nudge/add-friend
 	// are suppressed in the client.
-	VsAI      bool   `json:"vs_ai"`
+	VsAI bool `json:"vs_ai"`
+	// Kind is the game's origin for the active-game limits (game.Kind): 0 unknown (a pre-existing
+	// game), 1 vs_ai, 2 random, 3 friends. The lobby counts active games per kind to lock a capped
+	// New-Game start.
+	Kind      int    `json:"kind"`
 	MoveCount int    `json:"move_count"`
 	EndReason string `json:"end_reason"`
 	// LastActivityUnix is the lobby sort key: the current turn's start for an active
@@ -177,7 +193,6 @@ type stateDTO struct {
 	Rack           []int   `json:"rack"`
 	BagLen         int     `json:"bag_len"`
 	HintsRemaining int     `json:"hints_remaining"`
-	WalletBalance  int     `json:"wallet_balance"`
 	// HintUnlockLeftSeconds is the vs_ai idle-hint gate: seconds until the hint unlocks (0 for a human
 	// game / first move / not your turn). The client anchors a monotonic countdown to it.
 	HintUnlockLeftSeconds int                `json:"hint_unlock_left_seconds"`
@@ -278,6 +293,7 @@ func gameDTOFromGame(g game.Game) gameDTO {
 		TurnTimeoutSecs:      int(g.TurnTimeout.Seconds()),
 		MultipleWordsPerTurn: g.MultipleWordsPerTurn,
 		VsAI:                 g.VsAI,
+		Kind:                 int(g.Kind),
 		MoveCount:            g.MoveCount,
 		EndReason:            g.EndReason,
 		LastActivityUnix:     last.Unix(),
@@ -334,7 +350,6 @@ func stateDTOFrom(v game.StateView, includeAlphabet bool) (stateDTO, error) {
 		Rack:                  rack,
 		BagLen:                v.BagLen,
 		HintsRemaining:        v.HintsRemaining,
-		WalletBalance:         v.WalletBalance,
 		HintUnlockLeftSeconds: v.HintUnlockLeftSeconds,
 	}
 	if includeAlphabet {

backend/internal/server/handlers.go

@@ -319,6 +319,8 @@ func statusForError(err error) (int, string) {
 		return http.StatusConflict, "request_declined"
 	case errors.Is(err, social.ErrFriendCodeInvalid):
 		return http.StatusUnprocessableEntity, "friend_code_invalid"
+	case errors.Is(err, social.ErrGuestForbidden), errors.Is(err, lobby.ErrGuestForbidden):
+		return http.StatusForbidden, "guest_forbidden"
 	case errors.Is(err, feedback.ErrGuestForbidden):
 		return http.StatusForbidden, "feedback_guest_forbidden"
 	case errors.Is(err, feedback.ErrBanned):

backend/internal/server/handlers_admin_catalog.go

@@ -1,11 +1,14 @@
 package server
 
 import (
+	"context"
 	"errors"
+	"fmt"
 	"strconv"
 	"strings"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 
 	"scrabble/backend/internal/adminconsole"
 	"scrabble/backend/internal/payments"
@@ -181,3 +184,95 @@ func (s *Server) consoleDeleteProductAction(c *gin.Context) {
 	}
 	s.renderConsoleMessage(c, "Deleted", "the product was deleted", catalogBack)
 }
+
+// consoleGrant grants raw benefit atoms (hints / no-ads days / forever) to a chosen origin — a
+// zero-price admin sale.
+func (s *Server) consoleGrant(c *gin.Context) {
+	id, ok := s.consoleUUID(c, "/_gm/users")
+	if !ok {
+		return
+	}
+	back := "/_gm/users/" + id.String()
+	if s.payments == nil {
+		s.renderConsoleMessage(c, "Unavailable", "payments are not enabled", back)
+		return
+	}
+	origin := payments.Source(c.PostForm("origin"))
+	hints, _ := strconv.Atoi(strings.TrimSpace(c.PostForm("hints")))
+	noads, _ := strconv.Atoi(strings.TrimSpace(c.PostForm("noads")))
+	forever := c.PostForm("forever") != ""
+	if err := s.payments.Grant(c.Request.Context(), id, origin, hints, noads, forever); err != nil {
+		s.renderConsoleMessage(c, "Grant failed", err.Error(), back)
+		return
+	}
+	s.publishBannerChange(id)
+	s.renderConsoleMessage(c, "Granted", "the benefit was granted", back)
+}
+
+// consoleGrantProduct grants a value product's atoms (a reward bundle, possibly archived) to a
+// chosen origin. It refuses a product carrying chips or the tournament atom (payments enforces it).
+func (s *Server) consoleGrantProduct(c *gin.Context) {
+	id, ok := s.consoleUUID(c, "/_gm/users")
+	if !ok {
+		return
+	}
+	back := "/_gm/users/" + id.String()
+	if s.payments == nil {
+		s.renderConsoleMessage(c, "Unavailable", "payments are not enabled", back)
+		return
+	}
+	origin := payments.Source(c.PostForm("origin"))
+	productID, err := uuid.Parse(strings.TrimSpace(c.PostForm("product_id")))
+	if err != nil {
+		s.renderConsoleMessage(c, "Grant failed", "choose a product", back)
+		return
+	}
+	if err := s.payments.GrantProduct(c.Request.Context(), id, origin, productID); err != nil {
+		s.renderConsoleMessage(c, "Grant failed", err.Error(), back)
+		return
+	}
+	s.publishBannerChange(id)
+	s.renderConsoleMessage(c, "Granted", "the product was granted", back)
+}
+
+// grantForm builds the admin-grant panel: the origin picker and the grantable products (value
+// bundles, including archived ones — chips and tournament products are excluded).
+func (s *Server) grantForm(ctx context.Context) adminconsole.GrantFormView {
+	fv := adminconsole.GrantFormView{Present: true, Origins: []string{"direct", "vk", "telegram"}}
+	products, err := s.payments.AdminCatalog(ctx)
+	if err != nil {
+		return fv
+	}
+	for _, p := range products {
+		if grantableProduct(p) {
+			fv.Products = append(fv.Products, adminconsole.GrantProductOption{
+				ID: p.ID.String(), Title: p.Title, Summary: atomSummary(p.Atoms), Archived: !p.Active,
+			})
+		}
+	}
+	return fv
+}
+
+// grantableProduct reports whether a product can be admin-granted: it carries at least one benefit
+// atom (hints / no-ads days) and no chips or tournament atom.
+func grantableProduct(p payments.AdminProduct) bool {
+	benefit := false
+	for _, a := range p.Atoms {
+		switch a.Atom {
+		case "chips", "tournament":
+			return false
+		case "hints", "noads_days":
+			benefit = true
+		}
+	}
+	return benefit
+}
+
+// atomSummary renders a product's atoms as "hints×5, noads_days×30".
+func atomSummary(atoms []payments.AtomLine) string {
+	parts := make([]string, 0, len(atoms))
+	for _, a := range atoms {
+		parts = append(parts, fmt.Sprintf("%s×%d", a.Atom, a.Quantity))
+	}
+	return strings.Join(parts, ", ")
+}

backend/internal/server/handlers_admin_console.go

@@ -58,6 +58,9 @@ func (s *Server) registerConsole(router *gin.Engine) {
 	gm.POST("/users/:id/grant-role", s.consoleGrantRole)
 	gm.POST("/users/:id/revoke-role", s.consoleRevokeRole)
 	gm.POST("/users/:id/remove-email", s.consoleRemoveEmail)
+	gm.POST("/users/:id/grant", s.consoleGrant)
+	gm.POST("/users/:id/grant-product", s.consoleGrantProduct)
+	gm.POST("/users/:id/refund", s.consoleRefund)
 	gm.POST("/users/:id/delete", s.consoleDeleteUser)
 	gm.GET("/reasons", s.consoleReasons)
 	gm.POST("/reasons", s.consoleCreateReason)
@@ -67,6 +70,10 @@ func (s *Server) registerConsole(router *gin.Engine) {
 	gm.POST("/bans/unban", s.consoleUnban)
 	gm.GET("/games", s.consoleGames)
 	gm.GET("/games/:id", s.consoleGameDetail)
+	if s.gamelimits != nil {
+		gm.GET("/limits", s.consoleLimits)
+		gm.POST("/limits", s.consoleUpdateLimits)
+	}
 	gm.GET("/complaints", s.consoleComplaints)
 	gm.GET("/complaints/:id", s.consoleComplaintDetail)
 	gm.POST("/complaints/:id/resolve", s.consoleResolveComplaint)
@@ -109,6 +116,7 @@ func (s *Server) registerConsole(router *gin.Engine) {
 		gm.POST("/catalog/:id", s.consoleUpdateProduct)
 		gm.POST("/catalog/:id/archive", s.consoleArchiveProduct)
 		gm.POST("/catalog/:id/delete", s.consoleDeleteProductAction)
+		gm.GET("/ledger.csv", s.consoleLedgerExport)
 	}
 }
 
@@ -451,6 +459,7 @@ func (s *Server) consoleUserDetail(c *gin.Context) {
 		} else {
 			s.log.Warn("console: account statement failed", zap.String("account", id.String()), zap.Error(err))
 		}
+		view.Grant = s.grantForm(ctx)
 	}
 	s.renderConsole(c, "user_detail", "users", acc.DisplayName, view)
 }
@@ -1239,7 +1248,7 @@ func (s *Server) consoleUUID(c *gin.Context, back string) (uuid.UUID, bool) {
 
 // gameRow projects a game summary into its console row.
 func gameRow(g game.Game) adminconsole.GameRow {
-	return adminconsole.GameRow{ID: g.ID.String(), Variant: g.Variant.String(), Status: g.Status, Players: g.Players, UpdatedAt: fmtTime(g.UpdatedAt), VsAI: g.VsAI}
+	return adminconsole.GameRow{ID: g.ID.String(), Variant: g.Variant.String(), Status: g.Status, Players: g.Players, UpdatedAt: fmtTime(g.UpdatedAt), VsAI: g.VsAI, Kind: g.Kind.String()}
 }
 
 // trimForm returns the trimmed value of a posted form field.

backend/internal/server/handlers_admin_limits.go

@@ -0,0 +1,75 @@
+package server
+
+import (
+	"fmt"
+
+	"github.com/gin-gonic/gin"
+
+	"scrabble/backend/internal/adminconsole"
+	"scrabble/backend/internal/gamelimits"
+)
+
+// gameLimitsDTOFor resolves the caller's tier active-game caps into the profile DTO, so the client
+// can lock a capped New-Game start per kind. It returns nil when the limits config is not wired.
+func (s *Server) gameLimitsDTOFor(isGuest bool) *gameLimitsDTO {
+	if s.gamelimits == nil {
+		return nil
+	}
+	l := s.gamelimits.LimitsFor(isGuest)
+	return &gameLimitsDTO{VsAI: l.VsAI, Random: l.Random, Friends: l.Friends}
+}
+
+// consoleLimits renders the per-tier, per-kind active-game limit form (backend.config), read from
+// the in-memory cache.
+func (s *Server) consoleLimits(c *gin.Context) {
+	cfg := s.gamelimits.Get()
+	s.renderConsole(c, "limits", "limits", "Game limits", adminconsole.GameLimitsView{
+		GuestVsAI:      cfg.Guest.VsAI,
+		GuestRandom:    cfg.Guest.Random,
+		GuestFriends:   cfg.Guest.Friends,
+		DurableVsAI:    cfg.Durable.VsAI,
+		DurableRandom:  cfg.Durable.Random,
+		DurableFriends: cfg.Durable.Friends,
+	})
+}
+
+// consoleUpdateLimits saves the active-game limits and refreshes the hot cache in place. Each
+// field is a per-kind cap: -1 is unlimited, 0 blocks the kind, a positive value caps concurrent games.
+func (s *Server) consoleUpdateLimits(c *gin.Context) {
+	cfg := gamelimits.Config{
+		Guest: gamelimits.Limits{
+			VsAI:    atoiForm(c, "guest_vs_ai"),
+			Random:  atoiForm(c, "guest_random"),
+			Friends: atoiForm(c, "guest_friends"),
+		},
+		Durable: gamelimits.Limits{
+			VsAI:    atoiForm(c, "durable_vs_ai"),
+			Random:  atoiForm(c, "durable_random"),
+			Friends: atoiForm(c, "durable_friends"),
+		},
+	}
+	if err := validateGameLimits(cfg); err != nil {
+		s.renderConsoleMessage(c, "Invalid", err.Error(), "/_gm/limits")
+		return
+	}
+	if err := s.gamelimits.Update(c.Request.Context(), cfg); err != nil {
+		s.consoleError(c, err)
+		return
+	}
+	s.renderConsoleMessage(c, "Saved", "game limits updated", "/_gm/limits")
+}
+
+// validateGameLimits rejects a limit below -1 (the unlimited sentinel); -1, 0 and any positive count
+// are valid. It mirrors the backend.config CHECK so a bad value is refused with a clean message
+// rather than a raw database error.
+func validateGameLimits(cfg gamelimits.Config) error {
+	for _, v := range []int{
+		cfg.Guest.VsAI, cfg.Guest.Random, cfg.Guest.Friends,
+		cfg.Durable.VsAI, cfg.Durable.Random, cfg.Durable.Friends,
+	} {
+		if v < gamelimits.Unlimited {
+			return fmt.Errorf("a limit must be -1 (unlimited), 0, or a positive count")
+		}
+	}
+	return nil
+}

backend/internal/server/handlers_admin_refund.go

@@ -0,0 +1,71 @@
+package server
+
+import (
+	"encoding/csv"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// consoleRefund refunds a paid order in full at the operator's request. The operator performs the
+// actual money refund on the rail (Robokassa cabinet / VK support / Telegram refundStarPayment);
+// this records it — a refund ledger row and a floor-0 chip revoke (never negative, D27). Idempotent.
+func (s *Server) consoleRefund(c *gin.Context) {
+	id, ok := s.consoleUUID(c, "/_gm/users")
+	if !ok {
+		return
+	}
+	back := "/_gm/users/" + id.String()
+	if s.payments == nil {
+		s.renderConsoleMessage(c, "Unavailable", "payments are not enabled", back)
+		return
+	}
+	orderID, err := uuid.Parse(strings.TrimSpace(c.PostForm("order_id")))
+	if err != nil {
+		s.renderConsoleMessage(c, "Refund failed", "no order to refund", back)
+		return
+	}
+	out, err := s.payments.RefundOrderFull(c.Request.Context(), orderID)
+	if err != nil {
+		s.renderConsoleMessage(c, "Refund failed", err.Error(), back)
+		return
+	}
+	if out.AlreadyRefunded {
+		s.renderConsoleMessage(c, "Already refunded", "this order was already refunded", back)
+		return
+	}
+	s.publishBannerChange(id)
+	msg := fmt.Sprintf("revoked %d chips", out.Revoked)
+	if out.Loss > 0 {
+		msg += fmt.Sprintf("; %d chips were already spent (recorded as a loss + abuse flag)", out.Loss)
+	}
+	s.renderConsoleMessage(c, "Refunded", msg, back)
+}
+
+// consoleLedgerExport streams the entire append-only ledger as a CSV attachment for tax reporting
+// and rail reconciliation. The snapshot column carries the raw purchase/refund JSON.
+func (s *Server) consoleLedgerExport(c *gin.Context) {
+	rows, err := s.payments.LedgerExport(c.Request.Context())
+	if err != nil {
+		s.consoleError(c, err)
+		return
+	}
+	c.Header("Content-Type", "text/csv; charset=utf-8")
+	c.Header("Content-Disposition", `attachment; filename="ledger.csv"`)
+	w := csv.NewWriter(c.Writer)
+	_ = w.Write([]string{
+		"created_at", "account_id", "kind", "source", "origin", "chips_delta",
+		"product_id", "order_id", "provider", "provider_payment_id", "snapshot",
+	})
+	for _, r := range rows {
+		_ = w.Write([]string{
+			r.CreatedAt.UTC().Format(time.RFC3339), r.AccountID, r.Kind, r.Source, r.Origin,
+			strconv.Itoa(r.ChipsDelta), r.ProductID, r.OrderID, r.Provider, r.ProviderPaymentID, r.Snapshot,
+		})
+	}
+	w.Flush()
+}

backend/internal/server/handlers_game.go

@@ -10,6 +10,7 @@ import (
 
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
 )
 
 // The handlers below cover the game and chat operations the UI needs. They follow
@@ -46,10 +47,11 @@ type historyDTO struct {
 }
 
 // gameListDTO is the caller's games (active and finished) for the lobby. AtGameLimit
-// reports whether the caller has reached the simultaneous quick-game cap
+// reports whether the caller has reached its tier's active-game cap for the random
-// (game.MaxActiveQuickGames); while it is true the lobby disables "New Game" and shows a
+// (quick auto-match) kind (the per-tier, per-kind limits in backend.config); while
-// notice. It rides the lobby response — which the lobby re-fetches on every game event —
+// it is true the lobby disables "New Game" and shows a notice. It rides the lobby
-// instead of a separate request.
+// response — which the lobby re-fetches on every game event — instead of a separate
+// request.
 type gameListDTO struct {
 	Games       []gameDTO `json:"games"`
 	AtGameLimit bool      `json:"at_game_limit"`
@@ -395,23 +397,13 @@ func (s *Server) handleSaveDraft(c *gin.Context) {
 	c.JSON(http.StatusOK, okResponse{OK: true})
 }
 
-// atGameLimit reports whether uid already holds the maximum number of simultaneous
+// ensureUnderGameLimit aborts the request with 409 game_limit_reached when uid has reached its
-// quick games (game.MaxActiveQuickGames). It backs both the lobby's at_game_limit flag
+// tier's active-game cap for kind (the per-tier, per-kind limits in backend.config), and reports
-// and the new-game gate; friend games created by invitation are not counted.
+// whether the caller may proceed. It guards the quick new-game entry points — auto-match (random)
-func (s *Server) atGameLimit(ctx context.Context, uid uuid.UUID) (bool, error) {
+// and AI (vs_ai). Friend-invitation limits are enforced in the lobby's CreateInvitation, and
-	n, err := s.games.CountActiveQuickGames(ctx, uid)
+// accepting an incoming invitation is deliberately exempt.
-	if err != nil {
+func (s *Server) ensureUnderGameLimit(c *gin.Context, uid uuid.UUID, kind gamelimits.Kind) bool {
-		return false, err
+	atLimit, err := s.games.AtGameLimit(c.Request.Context(), uid, kind)
-	}
-	return n >= game.MaxActiveQuickGames, nil
-}
-
-// ensureUnderGameLimit aborts the request with 409 game_limit_reached when uid is at the
-// simultaneous quick-game cap, and reports whether the caller may proceed. It guards
-// every new-game entry point — quick auto-match/AI and invitation creation; accepting an
-// incoming invitation is deliberately exempt.
-func (s *Server) ensureUnderGameLimit(c *gin.Context, uid uuid.UUID) bool {
-	atLimit, err := s.atGameLimit(c.Request.Context(), uid)
 	if err != nil {
 		s.abortErr(c, err)
 		return false
@@ -437,7 +429,7 @@ func (s *Server) handleListGames(c *gin.Context) {
 		s.abortErr(c, err)
 		return
 	}
-	atLimit, err := s.atGameLimit(c.Request.Context(), uid)
+	atLimit, err := s.games.AtGameLimit(c.Request.Context(), uid, gamelimits.KindRandom)
 	if err != nil {
 		s.abortErr(c, err)
 		return

backend/internal/server/handlers_invitations.go

@@ -133,9 +133,6 @@ func (s *Server) handleCreateInvitation(c *gin.Context) {
 		}
 		inviteeIDs = append(inviteeIDs, id)
 	}
-	if !s.ensureUnderGameLimit(c, uid) {
-		return
-	}
 	inv, err := s.invitations.CreateInvitation(c.Request.Context(), uid, inviteeIDs, settings)
 	if err != nil {
 		s.abortErr(c, err)

backend/internal/server/handlers_user.go

@@ -8,6 +8,7 @@ import (
 	"github.com/google/uuid"
 
 	"scrabble/backend/internal/engine"
+	"scrabble/backend/internal/gamelimits"
 )
 
 // The /api/v1/user/* endpoints require X-User-ID (RequireUserID middleware). The
@@ -189,13 +190,15 @@ func (s *Server) handleEnqueue(c *gin.Context) {
 	if !s.ensureVariantAllowed(c, uid, variant.String()) {
 		return
 	}
-	if !s.ensureUnderGameLimit(c, uid) {
+	kind := gamelimits.KindRandom
-		return
-	}
 	enter := s.matchmaker.Enqueue
 	if req.VsAI {
+		kind = gamelimits.KindVsAI
 		enter = s.matchmaker.StartVsAI
 	}
+	if !s.ensureUnderGameLimit(c, uid, kind) {
+		return
+	}
 	res, err := enter(c.Request.Context(), uid, variant, req.MultipleWordsPerTurn)
 	if err != nil {
 		s.abortErr(c, err)

backend/internal/server/server.go

@@ -25,6 +25,7 @@ import (
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/feedback"
 	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/gamelimits"
 	"scrabble/backend/internal/link"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/notify"
@@ -100,6 +101,10 @@ type Deps struct {
 	// console routes are registered when the wallet surface lands. A nil Payments
 	// omits them.
 	Payments *payments.Service
+	// GameLimits is the per-tier, per-kind active-game limit config, cached in memory. The
+	// game domain reads it through game.Service (SetGameLimits) for the new-game gate; the admin
+	// console reads and edits it here. A nil GameLimits omits the limits console section.
+	GameLimits *gamelimits.Service
 	// Notifier publishes live-event intents — here the banner-eligibility re-poll
 	// signal the banner/hint/role console actions emit. A nil Notifier discards
 	// them (notify.Nop).
@@ -140,6 +145,7 @@ type Server struct {
 	banview     *banview.View
 	ads         *ads.Service
 	payments    *payments.Service
+	gamelimits  *gamelimits.Service
 	robokassa   robokassa.Config
 	notifier    notify.Publisher
 	console     *adminconsole.Renderer
@@ -194,6 +200,7 @@ func New(addr string, deps Deps) *Server {
 		banview:       deps.BanView,
 		ads:           deps.Ads,
 		payments:      deps.Payments,
+		gamelimits:    deps.GameLimits,
 		robokassa:     deps.Robokassa,
 		notifier:      notifier,
 		renderer:      deps.Renderer,

backend/internal/social/friendcodes.go

@@ -65,6 +65,12 @@ func (svc *Service) IssueFriendCode(ctx context.Context, accountID uuid.UUID) (F
 // ErrRequestBlocked (a block stands between the pair). A redeem bypasses any prior
 // decline between the two: it clears the old row and writes a fresh friendship.
 func (svc *Service) RedeemFriendCode(ctx context.Context, redeemerID uuid.UUID, code string) (uuid.UUID, error) {
+	// A guest cannot use friends: a durable-account feature (the UI hides it).
+	if acc, err := svc.accounts.GetByID(ctx, redeemerID); err != nil {
+		return uuid.UUID{}, err
+	} else if acc.IsGuest {
+		return uuid.UUID{}, ErrGuestForbidden
+	}
 	issuerID, codeID, err := svc.store.liveFriendCodeByHash(ctx, hashFriendCode(code), svc.now())
 	if err != nil {
 		return uuid.UUID{}, err

backend/internal/social/friends.go

@@ -51,6 +51,13 @@ func (svc *Service) SendFriendRequest(ctx context.Context, requesterID, addresse
 	if requesterID == addresseeID {
 		return ErrSelfRelation
 	}
+	// A guest cannot use friends — friends are a durable-account feature; the UI hides the
+	// flow, this is the server source of truth.
+	if acc, err := svc.accounts.GetByID(ctx, requesterID); err != nil {
+		return err
+	} else if acc.IsGuest {
+		return ErrGuestForbidden
+	}
 	iBlockThem, err := svc.store.blockExists(ctx, requesterID, addresseeID)
 	if err != nil {
 		return err

backend/internal/social/robotfriends.go

@@ -42,6 +42,12 @@ func (svc *Service) RequestInGame(ctx context.Context, requesterID, addresseeID,
 	if requesterID == addresseeID {
 		return ErrSelfRelation
 	}
+	// A guest cannot use friends: a durable-account feature (the UI hides it).
+	if acc, err := svc.accounts.GetByID(ctx, requesterID); err != nil {
+		return err
+	} else if acc.IsGuest {
+		return ErrGuestForbidden
+	}
 	isRobot, err := svc.accounts.IsRobot(ctx, addresseeID)
 	if err != nil {
 		return err

backend/internal/social/social.go

@@ -59,6 +59,9 @@ var (
 	// ErrRequestBlocked is returned when the addressee does not accept friend
 	// requests (their global toggle) or a block stands between the two accounts.
 	ErrRequestBlocked = errors.New("social: the addressee is not accepting friend requests")
+	// ErrGuestForbidden is returned when a guest attempts a durable-only action (send a friend
+	// request, redeem a friend code); friends are a durable-account feature.
+	ErrGuestForbidden = errors.New("social: guests cannot use friends")
 	// ErrRequestNotFound is returned when no pending friend request matches.
 	ErrRequestNotFound = errors.New("social: no pending friend request")
 	// ErrNoSharedGame is returned when a friend request targets someone the

deploy/.env.example

@@ -125,6 +125,17 @@ GATEWAY_VK_APP_SECRET=
 # come from VITE_VK_APP_ID / VITE_VK_ID_REDIRECT_URL above. All three empty disables link.vk.*.
 GATEWAY_VK_ID_CLIENT_SECRET=
 
+# --- Payments: Robokassa (direct RUB rail) ----------------------------------
+# The shop's merchant login + the two pass phrases (Password1 signs the launch request,
+# Password2 signs/verifies the Result callback). An empty login leaves the direct rail off.
+# ROBOKASSA_TEST=1 runs test payments against the shop's TEST pass phrases (no real money);
+# empty/0 is live. Mapped in compose to BACKEND_ROBOKASSA_*; Gitea TEST_/PROD_ secrets, with
+# PROD_BACKEND_ROBOKASSA_TEST a variable so go-live is a flag flip, not a secret redeploy.
+ROBOKASSA_MERCHANT_LOGIN=
+ROBOKASSA_PASSWORD1=
+ROBOKASSA_PASSWORD2=
+ROBOKASSA_TEST=
+
 # --- Gateway anti-abuse ------------------------------------------------------
 # Planted honeytoken bearer value: any request presenting it is flagged — a 24h IP ban
 # where the IP ban is on (prod), logs + a ban metric otherwise (test). Plant the value

deploy/README.md

@@ -76,6 +76,9 @@ compose binds from this directory.
 | `GM_BASICAUTH_HASH` | secret | bcrypt hash gating `/_gm` (admin console + Grafana). Generate with `docker run --rm caddy:2-alpine caddy hash-password --plaintext '<pw>'`. |
 | `TELEGRAM_MINIAPP_URL` | derived | The Mini App URL the bot hands out in deep links / buttons. The deploy derives `PUBLIC_BASE_URL + /telegram/`; set it directly only for a local run (compose still `:?`-requires it). |
 | `EXPORT_SIGN_KEY` | secret | HMAC key signing the public finished-game export download URLs (`/dl/*`). Generate with `openssl rand -base64 32`. |
+| `BACKEND_ROBOKASSA_MERCHANT_LOGIN` | secret | Robokassa shop login for the direct RUB rail. Empty leaves the rail off. |
+| `BACKEND_ROBOKASSA_PASSWORD1` / `…_PASSWORD2` | secret | Robokassa pass phrases: Password1 signs the launch request, Password2 signs/verifies the Result callback. Use the shop's **test** pair while `…_ROBOKASSA_TEST=1`, the **live** pair for real money. (Password3 — Robokassa's JWT-invoice API — is unused.) |
+| `BACKEND_ROBOKASSA_TEST` | **variable** | `1` runs test payments against the test pass phrases (no real money); empty/`0` is live. A variable, not a secret, so go-live is a flag flip + redeploy, not a secret rotation. |
 
 **Plus the bot token** — `TELEGRAM_BOT_TOKEN` (secret), shared by the validator (HMAC
 secret) and the bot (Bot API). It defaults to empty in compose, but both **fail at

deploy/ansible/roles/common/tasks/main.yml

@@ -213,6 +213,20 @@
   loop:
     - ""
     - config
-    - certs
     - dumps
     - images
+
+# The certs dir holds the reverse-mTLS bot-link keypair, bind-mounted into the gateway (and
+# backend) which run as the distroless nonroot UID 65532 — not the deploy user. The dir must be
+# traversable by "other" (0755) or the nonroot process cannot open the 0644 keypair and crash-loops
+# at startup ("mtls: load server keypair: ... permission denied") — a latent failure that only bites
+# on a container restart (e.g. a host reboot), not while a long-running container holds the keypair
+# in memory. The keys themselves are 0644 by design (see the gateway compose); the host is
+# single-tenant and SSH-access-controlled, so a traversable certs dir adds no meaningful exposure.
+- name: Create the scrabble certs directory (traversable by the nonroot gateway UID)
+  ansible.builtin.file:
+    path: "{{ scrabble_base_dir }}/certs"
+    state: directory
+    owner: "{{ deploy_user }}"
+    group: "{{ deploy_user }}"
+    mode: "0755"

deploy/write-prod-env.sh

@@ -52,6 +52,10 @@ export APP_VERSION='$APP_VERSION'
 export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
 export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
 export GATEWAY_VK_APP_SECRET='$GATEWAY_VK_APP_SECRET'
+export ROBOKASSA_MERCHANT_LOGIN='$ROBOKASSA_MERCHANT_LOGIN'
+export ROBOKASSA_PASSWORD1='$ROBOKASSA_PASSWORD1'
+export ROBOKASSA_PASSWORD2='$ROBOKASSA_PASSWORD2'
+export ROBOKASSA_TEST='$ROBOKASSA_TEST'
 export VITE_VK_APP_ID='$VITE_VK_APP_ID'
 export VITE_VK_ID_REDIRECT_URL='$VITE_VK_ID_REDIRECT_URL'
 export GATEWAY_VK_ID_CLIENT_SECRET='$GATEWAY_VK_ID_CLIENT_SECRET'

docs/ARCHITECTURE.md

@@ -650,18 +650,30 @@ in either direction (the enqueue excludes the caller's `BlockedWith` set);
   game is `open` the starter may move on their turn, but resign, chat and nudge are
   refused (no opponent yet) and the lobby and opponent card show a "searching for
   opponent" placeholder.
-- **Simultaneous-game cap**: a player may hold at most `game.MaxActiveQuickGames`
+- **Active-game caps (per tier, per kind)**: a player's simultaneous unfinished games are
-  (**10**) active quick games. `game.Service.CountActiveQuickGames` counts the games
+  capped per **kind** — `vs_ai`, `random` (quick auto-match), `friends` — with independent
-  seating the account in status `active` or `open` **without** a linked
+  **guest** and **durable-account** tiers. The caps live in the single-row `backend.config`
-  `game_invitations` row — friend games are excluded, and hidden games still occupy a
+  table (`-1` = unlimited), read once at boot into an in-memory cache (`internal/gamelimits`)
-  slot, so it is a dedicated count rather than a filter over the lobby list. The backend
+  and refreshed in place when an operator edits them in the admin (`/_gm/limits`) — so a
-  **gate** (`Server.ensureUnderGameLimit`) refuses **both** new-game entry points at the
+  login or game-create never queries the table. The seeded defaults are guest **1 vs_ai / 1
-  cap — `POST /lobby/enqueue` and `POST /invitations` — with **409 `game_limit_reached`**;
+  random / 0 friends** and durable **10 / 10 / 10** (this replaced the earlier flat
-  **accepting** an invitation (`POST /invitations/:id/accept`) is never gated, so friend
+  `MaxActiveQuickGames`=10 combined cap). Each game is tagged with `games.game_kind` on
-  games are capped only at initiation. The lobby learns the state from a boolean
+  creation (0 = an untagged game, never gated). `game.Service.AtGameLimit` resolves the
-  **`at_game_limit`** carried on the `games.list` response — the lobby already re-fetches
+  account's tier, then counts its `active`/`open` games of the kind (hidden games still
-  that on entry and on every game event, so the flag needs no separate request or
+  occupy a slot) against the cap. The gate (`Server.ensureUnderGameLimit`) refuses
-  per-event payload; while it is set the client disables **New Game** and shows a notice.
+  `POST /lobby/enqueue` — random or vs_ai per the request — with **409 `game_limit_reached`**;
+  the `POST /invitations` (friends) path enforces the durable friends cap the same way and
+  refuses a **guest** outright with **403** (guests cannot use friends — the same guest gate
+  covers friend requests and friend-code redemption). **Accepting** an invitation
+  (`POST /invitations/:id/accept`) is never gated, so friend games are capped only at
+  initiation. The client counts its lobby games per kind against the per-tier caps it reads on
+  the profile (`Profile.game_limits`, carrying `GameView.kind`), and locks a capped kind's
+  New-Game start — a 🔒 outline button that opens a prompt instead of a game: a sign-in funnel
+  for a guest, a "finish a current game first" notice for a durable account (native inside
+  Telegram, an in-app modal elsewhere), lifting when the profile is re-fetched after a
+  guest→durable upgrade. The `games.list` `at_game_limit` boolean (now the random-kind cap) is
+  still carried but no longer drives the UI — the per-kind start lock superseded the old
+  New-Game-tab disable.
 - **Friends**: two add paths over one `friendships` table. A **one-time
   code** the to-be-added player issues (a `friend_codes` row: 6-digit numeric,
   SHA-256-hashed, **12 h** TTL, one live code per issuer, single-use, redeem

docs/FUNCTIONAL.md

@@ -190,14 +190,17 @@ Mini App, the link only opens the app and the recipient enters the copied code b
 settings and the game starts once every invitee has accepted — any decline cancels it, and an unanswered invitation
 expires after seven days.
 
-**Simultaneous-game cap.** A player may hold at most **10 active quick games** at once —
+**Active-game caps (per kind).** A player's simultaneous unfinished games are capped **per kind** —
-counting both in-progress and still-searching auto-match/AI games, but **not** friend games
+against the AI, in a random match, and by friend invitation — with separate limits for a **guest**
-created by invitation. At the cap the **New Game** button is disabled (greyed) and a plain,
+and a signed-in (durable) account, tuned by the operator without a release. A **guest** may hold **1**
-low-emphasis line under the lists reads *"You've reached the simultaneous games limit."*; both
+game against the AI and **1** random match at once and cannot start friend games at all; a signed-in
-clear automatically once an active game finishes and the count drops below ten. The cap blocks
+account holds up to **10** of each kind. Only in-progress and still-searching games count; a finished
-**starting** any game (a quick game or a friend invitation, which share the New Game entry), but
+game frees its slot, and games already in progress are never interrupted. On the **New Game** screen a
-**accepting an incoming invitation is never blocked** — so friend games are capped from the other
+start whose kind is at its cap shows a **🔒** and, when tapped, opens a short prompt instead of a game:
-end (you cannot initiate one while at the cap) while you can always join a game you are invited to.
+a **guest** is invited to sign in or create an account (to play several games at once), a signed-in
+player is told to finish a current game first. **Accepting an incoming invitation is never blocked** —
+friend games are capped only when you start one. The server enforces every cap regardless of the
+client, and refuses a guest's friend request, friend code or invitation outright.
 
 ### Playing a game
 Place tiles, pass, exchange, or resign. Pass and exchange share one control —

docs/FUNCTIONAL_ru.md

@@ -197,15 +197,18 @@ e-mail) либо ввод фразы. Активные игры форфейтя
 выбирает настройки, и партия стартует, когда приняли все приглашённые — любой отказ отменяет приглашение, а без
 ответа приглашение протухает через семь дней.
 
-**Лимит одновременных партий.** Игрок может держать одновременно не более **10 активных
+**Лимит одновременных партий (по видам).** Число одновременных незавершённых партий игрока
-быстрых партий** — считаются и идущие, и ещё ищущие соперника авто-подбор/AI-партии, но **не**
+ограничено **по видам** — против AI, в случайном подборе и по приглашению друзей — с раздельными
-игры с друзьями, созданные приглашением. На лимите кнопка **«Новая игра»** становится неактивной
+лимитами для **гостя** и для вошедшего (постоянного) аккаунта; оператор настраивает их без релиза.
-(серой), а под списками появляется ненавязчивая строка *«Вы достигли лимита одновременных
+**Гость** может держать **1** партию против AI и **1** случайную одновременно и вовсе не может
-партий»*; и кнопка, и надпись снимаются автоматически, как только активная партия завершается и
+создавать игры с друзьями; вошедший аккаунт — до **10** каждого вида. Считаются только идущие и ещё
-счётчик опускается ниже десяти. Лимит запрещает **создавать** любую партию (быструю или
+ищущие соперника партии; завершённая освобождает слот, а уже идущие партии никогда не прерываются.
-приглашение в игру с друзьями — у них общий вход «Новая игра»), но **принимать входящее
+На экране **«Новая игра»** старт того вида, что достиг лимита, показывает **🔒** и по нажатию
-приглашение никогда не запрещено** — так игры с друзьями ограничиваются «с другого конца» (на
+открывает короткое сообщение вместо партии: **гостю** предлагают войти или создать учётную запись
-лимите их нельзя инициировать), а присоединиться к партии по приглашению можно всегда.
+(чтобы играть несколько партий сразу), вошедшему — сначала завершить текущую. **Принимать входящее
+приглашение никогда не запрещено** — игры с друзьями ограничиваются только при создании. Сервер
+применяет все лимиты независимо от клиента и напрямую отклоняет заявку в друзья, код друга или
+приглашение от гостя.
 
 ### Игровой процесс
 Выкладывание фишек, пас, обмен или сдача. Пас и обмен — один элемент управления:

docs/PAYMENTS.md

@@ -319,10 +319,12 @@ cache. Identity-presence (which segments are awake, §6) is supplied by the call
 here, so unlink/re-link takes effect immediately.
 
 **Admin rewards.** An admin grants **concrete values only** (no-ads / hints) — **never
-chips** (a gifted currency balance = a store cash-desk bypass). The admin **picks the
+chips** (a gifted currency balance = a store cash-desk bypass). It grants either raw atoms or a
+**defined value product** (a reward bundle, which may be archived — hidden from the store but
+grantable); both refuse a `chips` or `tournament` atom. The admin **picks the
 origin** at grant time (compliance is on them: `origin=vk` point-wise/low-volume = low risk,
 `origin=direct` = safe). A grant is a ledger transaction of type `admin_grant`, price 0
-chips — full audit of rewards.
+chips (the by-product grant records the source `product_id` + snapshot) — full audit of rewards.
 
 **Per-user financial report** in the admin console `/_gm` — segment balances, payments,
 spends, grants, refunds, full history — as an extension of the existing user card

docs/PAYMENTS_ru.md

@@ -318,10 +318,13 @@ in-process кэш сегментов и бенефитов по ключу-ак
 вызывающий, здесь не кэшируется, поэтому отвязка/повторная привязка действует сразу.
 
 **Награждение админом.** Админ начисляет **только конкретные ценности** (без рекламы /
-подсказки) — **никогда не Фишки** (подаренный баланс валюты = обход кассы стора). Админ
+подсказки) — **никогда не Фишки** (подаренный баланс валюты = обход кассы стора). Выдаёт либо
+сырыми атомами, либо **готовым продуктом-ценностью** (набор-награда, возможно архивный — скрыт
+из магазина, но выдаётся); оба отказывают на атоме `chips` или `tournament`. Админ
 **выбирает origin** при выдаче (ответственность за комплаенс на нём: `origin=vk`
 точечно/малый объём = низкий риск, `origin=direct` = безопасно). Грант — транзакция журнала
-типа `admin_grant`, цена 0 Фишек — полный аудит наград.
+типа `admin_grant`, цена 0 Фишек (грант по продукту пишет исходный `product_id` + снапшот) —
+полный аудит наград.
 
 **Финансовый отчёт по пользователю** в админке `/_gm` — балансы сегментов, платежи, траты,
 гранты, возвраты, полная история — расширение существующей карточки (`UserDetailView`,

docs/UI_DESIGN.md

@@ -347,12 +347,15 @@ its entrance (`components/Toast.svelte`, re-keyed on a per-message sequence). An
 lives ~2 s, drifting up by about the tab-bar height as it fades (a plain fade, no travel, under
 reduce-motion); an **error** toast dwells longer (~4 s). Either dismisses instantly on tap.
 
-**Simultaneous-game cap.** When the player is at the active-quick-game cap (`games.list`
+**Active-game caps.** A player's simultaneous unfinished games are capped per kind (vs AI / random /
-`at_game_limit`), the lobby's **New Game** tab is **disabled** (greyed via the shared
+friends) against the caller's per-tier limits (`Profile.game_limits`), counted client-side from the
-`.tab:disabled` opacity) and a plain, low-emphasis line — muted, centred, no accent — sits
+lobby games. The lobby's **New Game** tab is **always enabled** — the lock lives on the per-kind
-under the lists with the localized "limit reached" notice. Both follow the flag carried in the
+start, not the tab. On the **New Game** screen a start whose kind is at its cap renders as an
-cached lobby snapshot, so they render in their last-known state on entry (the button stays
+**outline** button with a **🔒** (not the filled accent CTA), so it reads as gated rather than ready;
-enabled on the first, uncached load) and flip in place when an event refreshes the lobby.
+tapped, it opens a short prompt instead of a game — inside Telegram a **native popup**, elsewhere the
+in-app **Modal**. A **guest** sees a sign-in funnel (Cancel / Sign in → the account screen); a
+signed-in account at its cap sees a plain "finish a current game first" notice (OK). The lock lifts in
+place when the profile is re-fetched after a guest→durable upgrade.
 
 ## Social, account & history surfaces
 

gateway/internal/backendclient/api.go

@@ -47,6 +47,16 @@ type ProfileResp struct {
 	// DictVersions is the current dictionary version per game variant, forwarded verbatim
 	// into the Profile payload so an offline-capable client preloads the matching dawg.
 	DictVersions []DictVersion `json:"dict_versions,omitempty"`
+	// GameLimits is the caller's tier active-game caps per kind (-1 = unlimited), forwarded verbatim
+	// into the Profile payload for the client's per-kind New-Game lock.
+	GameLimits *GameLimitsResp `json:"game_limits,omitempty"`
+}
+
+// GameLimitsResp is the caller's tier active-game caps per kind (-1 = unlimited) in the profile.
+type GameLimitsResp struct {
+	VsAI    int `json:"vs_ai"`
+	Random  int `json:"random"`
+	Friends int `json:"friends"`
 }
 
 // AdsResp is the post-move interstitial config in the profile: the client-mirrored cooldowns
@@ -170,6 +180,7 @@ type GameResp struct {
 	Seats                []SeatResp `json:"seats"`
 	UnreadChat           bool       `json:"unread_chat"`
 	UnreadMessages       bool       `json:"unread_messages"`
+	Kind                 int        `json:"kind"`
 }
 
 // MoveResultResp is the outcome of a committed move. Rack carries the actor's refilled rack as
@@ -197,7 +208,6 @@ type StateResp struct {
 	Rack                  []int               `json:"rack"`
 	BagLen                int                 `json:"bag_len"`
 	HintsRemaining        int                 `json:"hints_remaining"`
-	WalletBalance         int                 `json:"wallet_balance"`
 	HintUnlockLeftSeconds int                 `json:"hint_unlock_left_seconds"`
 	Alphabet              []AlphabetEntryJSON `json:"alphabet,omitempty"`
 }

gateway/internal/transcode/encode.go

@@ -194,6 +194,15 @@ func encodeProfile(p backendclient.ProfileResp) []byte {
 		fb.AdsInfoAddSuppressed(b, p.Ads.Suppressed)
 		ads = fb.AdsInfoEnd(b)
 	}
+	// The active-game limits table (scalars only), built before Profile is opened.
+	var gameLimits flatbuffers.UOffsetT
+	if p.GameLimits != nil {
+		fb.GameLimitsStart(b)
+		fb.GameLimitsAddVsAi(b, int32(p.GameLimits.VsAI))
+		fb.GameLimitsAddRandom(b, int32(p.GameLimits.Random))
+		fb.GameLimitsAddFriends(b, int32(p.GameLimits.Friends))
+		gameLimits = fb.GameLimitsEnd(b)
+	}
 	fb.ProfileStart(b)
 	fb.ProfileAddUserId(b, uid)
 	fb.ProfileAddDisplayName(b, name)
@@ -219,6 +228,9 @@ func encodeProfile(p backendclient.ProfileResp) []byte {
 	if p.Ads != nil {
 		fb.ProfileAddAds(b, ads)
 	}
+	if p.GameLimits != nil {
+		fb.ProfileAddGameLimits(b, gameLimits)
+	}
 	b.Finish(fb.ProfileEnd(b))
 	return b.FinishedBytes()
 }
@@ -405,7 +417,6 @@ func toWireState(s backendclient.StateResp) wire.StateView {
 		Rack:                  s.Rack,
 		BagLen:                s.BagLen,
 		HintsRemaining:        s.HintsRemaining,
-		WalletBalance:         s.WalletBalance,
 		HintUnlockLeftSeconds: s.HintUnlockLeftSeconds,
 		Alphabet:              alphabet,
 	}
@@ -625,6 +636,7 @@ func toWireGame(g backendclient.GameResp) wire.GameView {
 		LastActivityUnix:     g.LastActivityUnix,
 		UnreadChat:           g.UnreadChat,
 		UnreadMessages:       g.UnreadMessages,
+		Kind:                 g.Kind,
 	}
 }
 

gateway/internal/transcode/transcode_gamelimits_test.go

@@ -0,0 +1,61 @@
+package transcode_test
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"scrabble/gateway/internal/transcode"
+	fb "scrabble/pkg/fbs/scrabblefb"
+)
+
+// TestProfileGetEncodesGameLimits verifies the gateway forwards the backend's per-kind active-game
+// caps into the Profile payload — the caps the client's New-Game lock reads. The encode is not
+// exercised by the mock e2e (it bypasses the codec), so a dropped field would only surface here.
+func TestProfileGetEncodesGameLimits(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/api/v1/user/profile" {
+			t.Errorf("unexpected %s %q", r.Method, r.URL.Path)
+		}
+		_, _ = w.Write([]byte(`{"user_id":"u-1","display_name":"Kaya","preferred_language":"en",` +
+			`"game_limits":{"vs_ai":1,"random":1,"friends":0}}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, ok := reg.Lookup(transcode.MsgProfileGet)
+	if !ok {
+		t.Fatal("profile.get not registered")
+	}
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1"})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+
+	gl := fb.GetRootAsProfile(payload, 0).GameLimits(nil)
+	if gl == nil {
+		t.Fatal("profile carries no game_limits block")
+	}
+	if gl.VsAi() != 1 || gl.Random() != 1 || gl.Friends() != 0 {
+		t.Errorf("game limits = %d/%d/%d, want 1/1/0", gl.VsAi(), gl.Random(), gl.Friends())
+	}
+}
+
+// TestProfileGetNoGameLimits verifies a profile without a game_limits block encodes none (the
+// backend omits it only when the limits config is unwired; normally the block is present).
+func TestProfileGetNoGameLimits(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`{"user_id":"u-1","display_name":"Kaya","preferred_language":"en"}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, _ := reg.Lookup(transcode.MsgProfileGet)
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1"})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	if p := fb.GetRootAsProfile(payload, 0); p.GameLimits(nil) != nil {
+		t.Error("profile without a game_limits block unexpectedly carries one")
+	}
+}

gateway/internal/transcode/transcode_test.go

@@ -59,7 +59,7 @@ func TestGameStateRoundTripForwardsUserID(t *testing.T) {
 		if r.URL.Path != "/api/v1/user/games/g-1/state" {
 			t.Errorf("unexpected path %q", r.URL.Path)
 		}
-		_, _ = w.Write([]byte(`{"game":{"id":"g-1","variant":"scrabble_en","status":"active","players":2,"to_move":1,"seats":[{"seat":0,"account_id":"u-7","score":5}]},"seat":0,"rack":[0,1],"bag_len":80,"hints_remaining":4,"wallet_balance":3,"hint_unlock_left_seconds":1200}`))
+		_, _ = w.Write([]byte(`{"game":{"id":"g-1","variant":"scrabble_en","status":"active","players":2,"to_move":1,"seats":[{"seat":0,"account_id":"u-7","score":5}]},"seat":0,"rack":[0,1],"bag_len":80,"hints_remaining":4,"hint_unlock_left_seconds":1200}`))
 	})
 	defer cleanup()
 
@@ -77,8 +77,8 @@ func TestGameStateRoundTripForwardsUserID(t *testing.T) {
 		t.Fatalf("handler: %v", err)
 	}
 	st := fb.GetRootAsStateView(payload, 0)
-	if st.BagLen() != 80 || st.RackLength() != 2 || st.HintsRemaining() != 4 || st.WalletBalance() != 3 || st.HintUnlockLeftSeconds() != 1200 {
+	if st.BagLen() != 80 || st.RackLength() != 2 || st.HintsRemaining() != 4 || st.HintUnlockLeftSeconds() != 1200 {
-		t.Fatalf("state decoded wrong: bag=%d rack=%d hints=%d wallet=%d unlockLeft=%d", st.BagLen(), st.RackLength(), st.HintsRemaining(), st.WalletBalance(), st.HintUnlockLeftSeconds())
+		t.Fatalf("state decoded wrong: bag=%d rack=%d hints=%d unlockLeft=%d", st.BagLen(), st.RackLength(), st.HintsRemaining(), st.HintUnlockLeftSeconds())
 	}
 	game := st.Game(nil)
 	if game == nil || string(game.Id()) != "g-1" || string(game.Variant()) != "scrabble_en" || game.ToMove() != 1 {

pkg/fbs/scrabble.fbs

@@ -80,6 +80,11 @@ table GameView {
   // message (not just a nudge). With unread_chat it colours the badge — both set is the regular
   // badge, unread_chat alone is the softer nudge-only badge.
   unread_messages:bool;
+  // kind is the game's origin for the active-game limits: 0 unknown (a pre-existing game, never
+  // gated), 1 vs_ai, 2 random, 3 friends. The lobby counts active games per kind against the
+  // caller's per-kind limits (Profile.game_limits) to lock a capped New-Game start (added
+  // trailing — backward-compatible).
+  kind:int;
 }
 
 // MoveRecord is one decoded move (a committed play, or a hint preview).
@@ -267,6 +272,10 @@ table Profile {
   // ads carries the post-move interstitial config (cooldowns + suppressed) for the client-mirrored
   // gate (added trailing — backward-compatible).
   ads:AdsInfo;
+  // game_limits carries the caller's tier active-game caps per kind (-1 = unlimited); the client
+  // counts its active games per kind from the lobby and locks a capped New-Game start (added
+  // trailing — backward-compatible).
+  game_limits:GameLimits;
 }
 
 // AdsInfo is the post-move interstitial config: the client-mirrored cooldowns (seconds) and whether
@@ -278,6 +287,15 @@ table AdsInfo {
   suppressed:bool;
 }
 
+// GameLimits is the caller's tier active-game caps per kind (-1 = unlimited), resolved to the
+// guest or durable tier server-side. It rides Profile.game_limits for the client's per-kind
+// New-Game lock.
+table GameLimits {
+  vs_ai:int;
+  random:int;
+  friends:int;
+}
+
 // BlockStatus reports the caller's current manual block. The UI fetches it after any operation
 // returns the "account_blocked" result code, then replaces every screen with the terminal blocked
 // screen and stops all push/poll. permanent is false for a temporary block; until is an RFC3339
@@ -330,12 +348,11 @@ table StateView {
   bag_len:int;
   hints_remaining:int;
   alphabet:[AlphabetEntry];
-  // wallet_balance is the requesting player's global hint-wallet balance, sent apart from
+  // wallet_balance is deprecated (D31): the purchasable hint wallet moved to the profile (payments),
-  // hints_remaining (which folds the wallet in with the per-game allowance) so the client can
+  // and hints_remaining now carries the per-game allowance alone. The field is tombstoned rather than
-  // separate the two: the per-game allowance remaining is hints_remaining - wallet_balance, and
+  // deleted so the vtable slots of the fields after it stay stable across a rolling deploy (an old
-  // the wallet is a single global figure the client keeps live across games (added trailing —
+  // SPA served before the deploy must keep reading a new gateway correctly). No accessor is generated.
-  // backward-compatible).
+  wallet_balance:int (deprecated);
-  wallet_balance:int;
   // hint_unlock_left_seconds is, for a vs_ai game, how many seconds until the idle hint unlocks
   // (the robot's last move plus the idle window, computed from the SERVER clock online / the device
   // clock offline, capped at the window and floored at 0); 0 for a human's first move (no robot move
@@ -393,10 +410,9 @@ table ComplaintRequest {
   note:string;
 }
 
-// HintResult is the top-ranked move plus the remaining hint budget. wallet_balance is the
+// HintResult is the top-ranked move plus hints_remaining (the per-game allowance alone) and
-// global hint-wallet balance after spending (see StateView.wallet_balance), so the client
+// wallet_balance (the purchasable hint wallet after spending, from payments). The client adopts
-// refreshes its live wallet and re-derives the per-game allowance (added trailing —
+// wallet_balance into the profile so the badge stays live across games (see lib/hints).
-// backward-compatible).
 table HintResult {
   move:MoveRecord;
   hints_remaining:int;

pkg/fbs/scrabblefb/GameLimits.go

@@ -0,0 +1,94 @@
+// Code generated by the FlatBuffers compiler. DO NOT EDIT.
+
+package scrabblefb
+
+import (
+	flatbuffers "github.com/google/flatbuffers/go"
+)
+
+type GameLimits struct {
+	_tab flatbuffers.Table
+}
+
+func GetRootAsGameLimits(buf []byte, offset flatbuffers.UOffsetT) *GameLimits {
+	n := flatbuffers.GetUOffsetT(buf[offset:])
+	x := &GameLimits{}
+	x.Init(buf, n+offset)
+	return x
+}
+
+func FinishGameLimitsBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.Finish(offset)
+}
+
+func GetSizePrefixedRootAsGameLimits(buf []byte, offset flatbuffers.UOffsetT) *GameLimits {
+	n := flatbuffers.GetUOffsetT(buf[offset+flatbuffers.SizeUint32:])
+	x := &GameLimits{}
+	x.Init(buf, n+offset+flatbuffers.SizeUint32)
+	return x
+}
+
+func FinishSizePrefixedGameLimitsBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.FinishSizePrefixed(offset)
+}
+
+func (rcv *GameLimits) Init(buf []byte, i flatbuffers.UOffsetT) {
+	rcv._tab.Bytes = buf
+	rcv._tab.Pos = i
+}
+
+func (rcv *GameLimits) Table() flatbuffers.Table {
+	return rcv._tab
+}
+
+func (rcv *GameLimits) VsAi() int32 {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(4))
+	if o != 0 {
+		return rcv._tab.GetInt32(o + rcv._tab.Pos)
+	}
+	return 0
+}
+
+func (rcv *GameLimits) MutateVsAi(n int32) bool {
+	return rcv._tab.MutateInt32Slot(4, n)
+}
+
+func (rcv *GameLimits) Random() int32 {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
+	if o != 0 {
+		return rcv._tab.GetInt32(o + rcv._tab.Pos)
+	}
+	return 0
+}
+
+func (rcv *GameLimits) MutateRandom(n int32) bool {
+	return rcv._tab.MutateInt32Slot(6, n)
+}
+
+func (rcv *GameLimits) Friends() int32 {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(8))
+	if o != 0 {
+		return rcv._tab.GetInt32(o + rcv._tab.Pos)
+	}
+	return 0
+}
+
+func (rcv *GameLimits) MutateFriends(n int32) bool {
+	return rcv._tab.MutateInt32Slot(8, n)
+}
+
+func GameLimitsStart(builder *flatbuffers.Builder) {
+	builder.StartObject(3)
+}
+func GameLimitsAddVsAi(builder *flatbuffers.Builder, vsAi int32) {
+	builder.PrependInt32Slot(0, vsAi, 0)
+}
+func GameLimitsAddRandom(builder *flatbuffers.Builder, random int32) {
+	builder.PrependInt32Slot(1, random, 0)
+}
+func GameLimitsAddFriends(builder *flatbuffers.Builder, friends int32) {
+	builder.PrependInt32Slot(2, friends, 0)
+}
+func GameLimitsEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
+	return builder.EndObject()
+}

pkg/fbs/scrabblefb/GameView.go

@@ -209,8 +209,20 @@ func (rcv *GameView) MutateUnreadMessages(n bool) bool {
 	return rcv._tab.MutateBoolSlot(32, n)
 }
 
+func (rcv *GameView) Kind() int32 {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(34))
+	if o != 0 {
+		return rcv._tab.GetInt32(o + rcv._tab.Pos)
+	}
+	return 0
+}
+
+func (rcv *GameView) MutateKind(n int32) bool {
+	return rcv._tab.MutateInt32Slot(34, n)
+}
+
 func GameViewStart(builder *flatbuffers.Builder) {
-	builder.StartObject(15)
+	builder.StartObject(16)
 }
 func GameViewAddId(builder *flatbuffers.Builder, id flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(id), 0)
@@ -260,6 +272,9 @@ func GameViewAddUnreadChat(builder *flatbuffers.Builder, unreadChat bool) {
 func GameViewAddUnreadMessages(builder *flatbuffers.Builder, unreadMessages bool) {
 	builder.PrependBoolSlot(14, unreadMessages, false)
 }
+func GameViewAddKind(builder *flatbuffers.Builder, kind int32) {
+	builder.PrependInt32Slot(15, kind, 0)
+}
 func GameViewEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

pkg/fbs/scrabblefb/Profile.go

@@ -244,8 +244,21 @@ func (rcv *Profile) Ads(obj *AdsInfo) *AdsInfo {
 	return nil
 }
 
+func (rcv *Profile) GameLimits(obj *GameLimits) *GameLimits {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(40))
+	if o != 0 {
+		x := rcv._tab.Indirect(o + rcv._tab.Pos)
+		if obj == nil {
+			obj = new(GameLimits)
+		}
+		obj.Init(rcv._tab.Bytes, x)
+		return obj
+	}
+	return nil
+}
+
 func ProfileStart(builder *flatbuffers.Builder) {
-	builder.StartObject(18)
+	builder.StartObject(19)
 }
 func ProfileAddUserId(builder *flatbuffers.Builder, userId flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(userId), 0)
@@ -307,6 +320,9 @@ func ProfileStartDictVersionsVector(builder *flatbuffers.Builder, numElems int)
 func ProfileAddAds(builder *flatbuffers.Builder, ads flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(17, flatbuffers.UOffsetT(ads), 0)
 }
+func ProfileAddGameLimits(builder *flatbuffers.Builder, gameLimits flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(18, flatbuffers.UOffsetT(gameLimits), 0)
+}
 func ProfileEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

pkg/fbs/scrabblefb/StateView.go

@@ -144,18 +144,6 @@ func (rcv *StateView) AlphabetLength() int {
 	return 0
 }
 
-func (rcv *StateView) WalletBalance() int32 {
-	o := flatbuffers.UOffsetT(rcv._tab.Offset(16))
-	if o != 0 {
-		return rcv._tab.GetInt32(o + rcv._tab.Pos)
-	}
-	return 0
-}
-
-func (rcv *StateView) MutateWalletBalance(n int32) bool {
-	return rcv._tab.MutateInt32Slot(16, n)
-}
-
 func (rcv *StateView) HintUnlockLeftSeconds() int32 {
 	o := flatbuffers.UOffsetT(rcv._tab.Offset(18))
 	if o != 0 {
@@ -195,9 +183,6 @@ func StateViewAddAlphabet(builder *flatbuffers.Builder, alphabet flatbuffers.UOf
 func StateViewStartAlphabetVector(builder *flatbuffers.Builder, numElems int) flatbuffers.UOffsetT {
 	return builder.StartVector(4, numElems, 4)
 }
-func StateViewAddWalletBalance(builder *flatbuffers.Builder, walletBalance int32) {
-	builder.PrependInt32Slot(6, walletBalance, 0)
-}
 func StateViewAddHintUnlockLeftSeconds(builder *flatbuffers.Builder, hintUnlockLeftSeconds int32) {
 	builder.PrependInt32Slot(7, hintUnlockLeftSeconds, 0)
 }

pkg/wire/build.go

@@ -49,6 +49,9 @@ type GameView struct {
 	// UnreadMessages is a per-viewer flag: at least one unread entry is a real message (not just
 	// a nudge), so the badge can be coloured apart from the nudge-only case.
 	UnreadMessages bool
+	// Kind is the game's origin for the active-game limits: 0 unknown (a pre-existing game), 1 vs_ai,
+	// 2 random, 3 friends. The lobby counts active games per kind to lock a capped New-Game start.
+	Kind int
 }
 
 // TileRecord is one tile in a decoded MoveRecord (the concrete letter, "?" for a blank
@@ -92,7 +95,6 @@ type StateView struct {
 	Rack                  []int
 	BagLen                int
 	HintsRemaining        int
-	WalletBalance         int
 	HintUnlockLeftSeconds int
 	Alphabet              []AlphabetEntry
 }
@@ -170,6 +172,7 @@ func BuildGameView(b *flatbuffers.Builder, g GameView) flatbuffers.UOffsetT {
 	fb.GameViewAddVsAi(b, g.VsAI)
 	fb.GameViewAddUnreadChat(b, g.UnreadChat)
 	fb.GameViewAddUnreadMessages(b, g.UnreadMessages)
+	fb.GameViewAddKind(b, int32(g.Kind))
 	return fb.GameViewEnd(b)
 }
 
@@ -256,7 +259,6 @@ func BuildStateView(b *flatbuffers.Builder, s StateView) flatbuffers.UOffsetT {
 	fb.StateViewAddRack(b, rack)
 	fb.StateViewAddBagLen(b, int32(s.BagLen))
 	fb.StateViewAddHintsRemaining(b, int32(s.HintsRemaining))
-	fb.StateViewAddWalletBalance(b, int32(s.WalletBalance))
 	fb.StateViewAddHintUnlockLeftSeconds(b, int32(s.HintUnlockLeftSeconds))
 	if hasAlphabet {
 		fb.StateViewAddAlphabet(b, alphabet)

ui/e2e/gamelimit.spec.ts

@@ -1,31 +1,40 @@
 import { expect, test } from './fixtures';
 
-// The simultaneous quick-game cap. When the backend reports the player is at the limit
+// The active-game limit lock on the New Game screen. When a start's kind is at the caller's per-kind
-// (games.list at_game_limit), the lobby disables the "New Game" tab and shows a plain,
+// cap (Profile.game_limits), the start button shows a 🔒 and opens a funnel modal instead of a game;
-// low-emphasis notice under the lists; when it clears, the button re-enables and the
+// when the cap lifts (the profile refetch a guest→durable upgrade would trigger), the lock clears and
-// notice goes. Driven by the mock transport's __mock.setGameLimit seam (no backend), which
+// the button starts a game again. Driven by the mock's __mock.setGameLimits seam (no backend). The
-// also nudges the lobby to re-fetch (the lobby refreshes on any live event).
+// native Telegram popup path is verified on the contour; here the cross-platform in-app modal shows
+// (the mock profile is a durable account, so it is the "finish a current game first" notice).
 
-test('lobby: New Game disables and a notice shows at the simultaneous-game limit', async ({ page }) => {
+type Limits = { vsAi: number; random: number; friends: number };
+function setLimits(l: Limits) {
+  (window as unknown as { __mock: { setGameLimits(l: Limits): void } }).__mock.setGameLimits(l);
+}
+
+test('new game: a start locks at its per-kind cap and the funnel modal opens', async ({ page }) => {
   await page.goto('/');
   await page.getByRole('button', { name: /guest/i }).click();
 
-  // Below the limit: the New Game tab is enabled and no notice is shown.
+  // The New Game button always opens the screen now — the per-kind lock lives on the start button.
-  const newGame = page.getByRole('button', { name: /🎲/ });
+  await page.getByRole('button', { name: /🎲/ }).click();
-  await expect(newGame).toBeEnabled();
-  await expect(page.getByText(/reached the simultaneous games limit/i)).toHaveCount(0);
 
-  // Reach the limit: the button greys out (disabled) and the notice appears under the lists.
+  const start = page.getByRole('button', { name: /start game/i });
-  await page.evaluate(() =>
+  await expect(start).not.toContainText('🔒');
-    (window as unknown as { __mock: { setGameLimit(v: boolean): void } }).__mock.setGameLimit(true),
-  );
-  await expect(newGame).toBeDisabled();
-  await expect(page.getByText(/reached the simultaneous games limit/i)).toBeVisible();
 
-  // Drop back below the limit (a game finished): the button re-enables and the notice clears.
+  // Cap every kind: the AI start (the default opponent) locks.
-  await page.evaluate(() =>
+  await page.evaluate(setLimits, { vsAi: 0, random: 0, friends: 0 });
-    (window as unknown as { __mock: { setGameLimit(v: boolean): void } }).__mock.setGameLimit(false),
+  await expect(start).toContainText('🔒');
-  );
+
-  await expect(newGame).toBeEnabled();
+  // Tapping the locked start opens the modal instead of a game, and does not navigate away.
-  await expect(page.getByText(/reached the simultaneous games limit/i)).toHaveCount(0);
+  await start.click();
+  const notice = page.getByText(/reached the limit/i);
+  await expect(notice).toBeVisible();
+  await expect(page).toHaveURL(/\/new$/);
+  await page.getByRole('button', { name: /^ok$/i }).click();
+  await expect(notice).toHaveCount(0);
+
+  // Lift the cap (the same profile-refetch path a registration takes): the lock clears.
+  await page.evaluate(setLimits, { vsAi: 10, random: 10, friends: 10 });
+  await expect(start).not.toContainText('🔒');
 });

ui/src/components/GameLimitModal.svelte

@@ -0,0 +1,70 @@
+<script lang="ts">
+  import { t } from '../lib/i18n/index.svelte';
+  import { insideTelegram, telegramDialogsAvailable, telegramShowPopup } from '../lib/telegram';
+  import { LOGIN_BUTTON_ID, gameLimitGuestPopup, gameLimitDurablePopup } from '../lib/nativedialogs';
+  import Modal from './Modal.svelte';
+
+  // The New-Game screen raises this when the player taps a start whose kind is at its cap. guest
+  // picks the message: a sign-in funnel (a guest plays more by registering) vs a durable account's
+  // plain "finish a current game first" notice. onclose dismisses; onlogin routes a guest to sign-in.
+  let { open, guest, onclose, onlogin }: { open: boolean; guest: boolean; onclose: () => void; onlogin: () => void } = $props();
+
+  const title = $derived(guest ? t('new.limitGuestTitle') : t('new.limitDurableTitle'));
+  const body = $derived(guest ? t('new.limitGuestBody') : t('new.limitDurableBody'));
+
+  // Native path: inside the Mini App with native dialogs, present Telegram's own popup instead of
+  // the in-app modal (evaluated at fire time — the SDK loads after mount). A guest popup's login
+  // button routes to sign-in; any other dismissal closes. The message here is a plain notice with
+  // no gesture-gated follow-up, so a native popup is safe (unlike share/clipboard flows).
+  let shown = false;
+  $effect(() => {
+    if (open && !shown && insideTelegram() && telegramDialogsAvailable()) {
+      shown = true;
+      const params = guest
+        ? gameLimitGuestPopup(title, body, t('common.cancel'), t('new.limitLogin'))
+        : gameLimitDurablePopup(title, body, t('common.ok'));
+      void telegramShowPopup(params).then((id) => (guest && id === LOGIN_BUTTON_ID ? onlogin() : onclose()));
+    } else if (!open) {
+      shown = false;
+    }
+  });
+</script>
+
+{#if open && !(insideTelegram() && telegramDialogsAvailable())}
+  <Modal {title} onclose={onclose}>
+    <p class="msg">{body}</p>
+    <div class="actions">
+      {#if guest}
+        <button class="cancel" onclick={onclose}>{t('common.cancel')}</button>
+        <button class="primary" onclick={onlogin}>{t('new.limitLogin')}</button>
+      {:else}
+        <button class="primary" onclick={onclose}>{t('common.ok')}</button>
+      {/if}
+    </div>
+  </Modal>
+{/if}
+
+<style>
+  .msg {
+    margin: 0 0 16px;
+    line-height: 1.5;
+  }
+  .actions {
+    display: flex;
+    gap: 8px;
+  }
+  .actions button {
+    flex: 1;
+    padding: 10px 12px;
+    border-radius: var(--radius-sm);
+    border: 1px solid var(--accent);
+  }
+  .cancel {
+    background: transparent;
+    color: var(--accent);
+  }
+  .primary {
+    background: var(--accent);
+    color: var(--accent-text);
+  }
+</style>

ui/src/game/Game.svelte

@@ -251,7 +251,8 @@
       view = st;
       // Anchor the vs_ai idle-hint countdown to the freshly fetched seconds-left (0 = open / non-vs_ai).
       armHintGate(st.game.vsAi ? (st.hintUnlockLeftSeconds ?? 0) : 0);
-      syncWallet(st.walletBalance);
+      // The game state no longer carries the hint wallet (it lives on the profile); do not touch
+      // app.profile.hintBalance here — that would clobber the authoritative payments balance.
       // Seed the unread flag from the authoritative state (the live stream only raises it).
       seedChatUnread(id, st.game.unreadChat, st.game.unreadMessages);
       moves = hist.moves;
@@ -833,10 +834,9 @@
       seat: r.move.player,
       rack: r.rack,
       bagLen: r.bagLen,
-      // A move is not a hint, so the per-game allowance and the wallet are unchanged: carry both
+      // A move is not a hint, so the per-game allowance is unchanged: carry it forward. The badge
-      // forward (their difference is the stable allowance; the badge adds the live wallet).
+      // adds the live wallet from the profile.
       hintsRemaining: view?.hintsRemaining ?? 0,
-      walletBalance: view?.walletBalance ?? 0,
     };
     // The move result is an authoritative per-viewer view: a nudge the actor just answered by
     // moving is already cleared server-side, so reconcile the unread flag from it.
@@ -1047,7 +1047,7 @@
           recenter++;
         }
         if (isCoarse() && !landscape) zoomed = true;
-        view = { ...view, hintsRemaining: h.hintsRemaining, walletBalance: h.walletBalance };
+        view = { ...view, hintsRemaining: h.hintsRemaining };
         syncWallet(h.walletBalance);
         // The hint is the engine's own top-ranked, fully scored legal move: reuse it as the
         // preview instead of a redundant evaluate (same engine call, same placement). Cancel any

ui/src/gen/fbs/scrabblefb.ts

@@ -42,6 +42,7 @@ export { FriendCode } from './scrabblefb/friend-code.js';
 export { FriendList } from './scrabblefb/friend-list.js';
 export { FriendRespondRequest } from './scrabblefb/friend-respond-request.js';
 export { GameActionRequest } from './scrabblefb/game-action-request.js';
+export { GameLimits } from './scrabblefb/game-limits.js';
 export { GameList } from './scrabblefb/game-list.js';
 export { GameOverEvent } from './scrabblefb/game-over-event.js';
 export { GameView } from './scrabblefb/game-view.js';

ui/src/gen/fbs/scrabblefb/game-limits.ts

@@ -0,0 +1,66 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+import * as flatbuffers from 'flatbuffers';
+
+export class GameLimits {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):GameLimits {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsGameLimits(bb:flatbuffers.ByteBuffer, obj?:GameLimits):GameLimits {
+  return (obj || new GameLimits()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsGameLimits(bb:flatbuffers.ByteBuffer, obj?:GameLimits):GameLimits {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new GameLimits()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+vsAi():number {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readInt32(this.bb_pos + offset) : 0;
+}
+
+random():number {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readInt32(this.bb_pos + offset) : 0;
+}
+
+friends():number {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.readInt32(this.bb_pos + offset) : 0;
+}
+
+static startGameLimits(builder:flatbuffers.Builder) {
+  builder.startObject(3);
+}
+
+static addVsAi(builder:flatbuffers.Builder, vsAi:number) {
+  builder.addFieldInt32(0, vsAi, 0);
+}
+
+static addRandom(builder:flatbuffers.Builder, random:number) {
+  builder.addFieldInt32(1, random, 0);
+}
+
+static addFriends(builder:flatbuffers.Builder, friends:number) {
+  builder.addFieldInt32(2, friends, 0);
+}
+
+static endGameLimits(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createGameLimits(builder:flatbuffers.Builder, vsAi:number, random:number, friends:number):flatbuffers.Offset {
+  GameLimits.startGameLimits(builder);
+  GameLimits.addVsAi(builder, vsAi);
+  GameLimits.addRandom(builder, random);
+  GameLimits.addFriends(builder, friends);
+  return GameLimits.endGameLimits(builder);
+}
+}

ui/src/gen/fbs/scrabblefb/game-view.ts

@@ -113,8 +113,13 @@ unreadMessages():boolean {
   return offset ? !!this.bb!.readInt8(this.bb_pos + offset) : false;
 }
 
+kind():number {
+  const offset = this.bb!.__offset(this.bb_pos, 34);
+  return offset ? this.bb!.readInt32(this.bb_pos + offset) : 0;
+}
+
 static startGameView(builder:flatbuffers.Builder) {
-  builder.startObject(15);
+  builder.startObject(16);
 }
 
 static addId(builder:flatbuffers.Builder, idOffset:flatbuffers.Offset) {
@@ -189,12 +194,16 @@ static addUnreadMessages(builder:flatbuffers.Builder, unreadMessages:boolean) {
   builder.addFieldInt8(14, +unreadMessages, +false);
 }
 
+static addKind(builder:flatbuffers.Builder, kind:number) {
+  builder.addFieldInt32(15, kind, 0);
+}
+
 static endGameView(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createGameView(builder:flatbuffers.Builder, idOffset:flatbuffers.Offset, variantOffset:flatbuffers.Offset, dictVersionOffset:flatbuffers.Offset, statusOffset:flatbuffers.Offset, players:number, toMove:number, turnTimeoutSecs:number, multipleWordsPerTurn:boolean, moveCount:number, endReasonOffset:flatbuffers.Offset, seatsOffset:flatbuffers.Offset, lastActivityUnix:bigint, vsAi:boolean, unreadChat:boolean, unreadMessages:boolean):flatbuffers.Offset {
+static createGameView(builder:flatbuffers.Builder, idOffset:flatbuffers.Offset, variantOffset:flatbuffers.Offset, dictVersionOffset:flatbuffers.Offset, statusOffset:flatbuffers.Offset, players:number, toMove:number, turnTimeoutSecs:number, multipleWordsPerTurn:boolean, moveCount:number, endReasonOffset:flatbuffers.Offset, seatsOffset:flatbuffers.Offset, lastActivityUnix:bigint, vsAi:boolean, unreadChat:boolean, unreadMessages:boolean, kind:number):flatbuffers.Offset {
   GameView.startGameView(builder);
   GameView.addId(builder, idOffset);
   GameView.addVariant(builder, variantOffset);
@@ -211,6 +220,7 @@ static createGameView(builder:flatbuffers.Builder, idOffset:flatbuffers.Offset,
   GameView.addVsAi(builder, vsAi);
   GameView.addUnreadChat(builder, unreadChat);
   GameView.addUnreadMessages(builder, unreadMessages);
+  GameView.addKind(builder, kind);
   return GameView.endGameView(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/profile.ts

@@ -5,6 +5,7 @@ import * as flatbuffers from 'flatbuffers';
 import { AdsInfo } from '../scrabblefb/ads-info.js';
 import { BannerInfo } from '../scrabblefb/banner-info.js';
 import { DictVersion } from '../scrabblefb/dict-version.js';
+import { GameLimits } from '../scrabblefb/game-limits.js';
 
 
 export class Profile {
@@ -141,8 +142,13 @@ ads(obj?:AdsInfo):AdsInfo|null {
   return offset ? (obj || new AdsInfo()).__init(this.bb!.__indirect(this.bb_pos + offset), this.bb!) : null;
 }
 
+gameLimits(obj?:GameLimits):GameLimits|null {
+  const offset = this.bb!.__offset(this.bb_pos, 40);
+  return offset ? (obj || new GameLimits()).__init(this.bb!.__indirect(this.bb_pos + offset), this.bb!) : null;
+}
+
 static startProfile(builder:flatbuffers.Builder) {
-  builder.startObject(18);
+  builder.startObject(19);
 }
 
 static addUserId(builder:flatbuffers.Builder, userIdOffset:flatbuffers.Offset) {
@@ -241,6 +247,10 @@ static addAds(builder:flatbuffers.Builder, adsOffset:flatbuffers.Offset) {
   builder.addFieldOffset(17, adsOffset, 0);
 }
 
+static addGameLimits(builder:flatbuffers.Builder, gameLimitsOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(18, gameLimitsOffset, 0);
+}
+
 static endProfile(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;

ui/src/gen/fbs/scrabblefb/state-view.ts

@@ -69,11 +69,6 @@ alphabetLength():number {
   return offset ? this.bb!.__vector_len(this.bb_pos + offset) : 0;
 }
 
-walletBalance():number {
-  const offset = this.bb!.__offset(this.bb_pos, 16);
-  return offset ? this.bb!.readInt32(this.bb_pos + offset) : 0;
-}
-
 hintUnlockLeftSeconds():number {
   const offset = this.bb!.__offset(this.bb_pos, 18);
   return offset ? this.bb!.readInt32(this.bb_pos + offset) : 0;
@@ -131,10 +126,6 @@ static startAlphabetVector(builder:flatbuffers.Builder, numElems:number) {
   builder.startVector(4, numElems, 4);
 }
 
-static addWalletBalance(builder:flatbuffers.Builder, walletBalance:number) {
-  builder.addFieldInt32(6, walletBalance, 0);
-}
-
 static addHintUnlockLeftSeconds(builder:flatbuffers.Builder, hintUnlockLeftSeconds:number) {
   builder.addFieldInt32(7, hintUnlockLeftSeconds, 0);
 }
@@ -144,7 +135,7 @@ static endStateView(builder:flatbuffers.Builder):flatbuffers.Offset {
   return offset;
 }
 
-static createStateView(builder:flatbuffers.Builder, gameOffset:flatbuffers.Offset, seat:number, rackOffset:flatbuffers.Offset, bagLen:number, hintsRemaining:number, alphabetOffset:flatbuffers.Offset, walletBalance:number, hintUnlockLeftSeconds:number):flatbuffers.Offset {
+static createStateView(builder:flatbuffers.Builder, gameOffset:flatbuffers.Offset, seat:number, rackOffset:flatbuffers.Offset, bagLen:number, hintsRemaining:number, alphabetOffset:flatbuffers.Offset, hintUnlockLeftSeconds:number):flatbuffers.Offset {
   StateView.startStateView(builder);
   StateView.addGame(builder, gameOffset);
   StateView.addSeat(builder, seat);
@@ -152,7 +143,6 @@ static createStateView(builder:flatbuffers.Builder, gameOffset:flatbuffers.Offse
   StateView.addBagLen(builder, bagLen);
   StateView.addHintsRemaining(builder, hintsRemaining);
   StateView.addAlphabet(builder, alphabetOffset);
-  StateView.addWalletBalance(builder, walletBalance);
   StateView.addHintUnlockLeftSeconds(builder, hintUnlockLeftSeconds);
   return StateView.endStateView(builder);
 }

ui/src/lib/codec.test.ts

@@ -421,6 +421,7 @@ describe('codec', () => {
     fb.GameView.addLastActivityUnix(b, BigInt(1717000000));
     fb.GameView.addVsAi(b, true);
     fb.GameView.addUnreadChat(b, true);
+    fb.GameView.addKind(b, 2);
     const game = fb.GameView.endGameView(b);
     const games = fb.GameList.createGamesVector(b, [game]);
     fb.GameList.startGameList(b);
@@ -436,6 +437,7 @@ describe('codec', () => {
     expect(gl.games[0].lastActivityUnix).toBe(1717000000);
     expect(gl.games[0].vsAi).toBe(true);
     expect(gl.games[0].unreadChat).toBe(true);
+    expect(gl.games[0].kind).toBe(2);
     expect(gl.atGameLimit).toBe(true);
   });
 
@@ -830,6 +832,26 @@ describe('codec', () => {
     });
   });
 
+  it('decodes the profile active-game limits (guest tier)', () => {
+    const b = new Builder(64);
+    const uid = b.createString('u-1');
+    const limits = fb.GameLimits.createGameLimits(b, 1, 1, 0);
+    fb.Profile.startProfile(b);
+    fb.Profile.addUserId(b, uid);
+    fb.Profile.addGameLimits(b, limits);
+    b.finish(fb.Profile.endProfile(b));
+    expect(decodeProfile(b.asUint8Array()).gameLimits).toEqual({ vsAi: 1, random: 1, friends: 0 });
+  });
+
+  it('leaves the profile game limits undefined when absent', () => {
+    const b = new Builder(64);
+    const uid = b.createString('u-1');
+    fb.Profile.startProfile(b);
+    fb.Profile.addUserId(b, uid);
+    b.finish(fb.Profile.endProfile(b));
+    expect(decodeProfile(b.asUint8Array()).gameLimits).toBeUndefined();
+  });
+
   it('carries the suppressed flag through the ad config', () => {
     const b = new Builder(64);
     const uid = b.createString('u-1');

ui/src/lib/codec.ts

@@ -15,6 +15,7 @@ import type {
   RobotFriendRequestEntry,
   Banner,
   AdsConfig,
+  GameLimits,
   BannerCampaign,
   BestMove,
   BestMoveTile,
@@ -314,6 +315,7 @@ function decodeGameView(g: fb.GameView): GameView {
     vsAi: g.vsAi(),
     unreadChat: g.unreadChat(),
     unreadMessages: g.unreadMessages(),
+    kind: g.kind(),
     seats,
   };
 }
@@ -467,9 +469,18 @@ export function decodeProfile(buf: Uint8Array): Profile {
     telegramLinked: p.telegramLinked(),
     vkLinked: p.vkLinked(),
     dictVersions: decodeDictVersions(p),
+    gameLimits: decodeGameLimits(p),
   };
 }
 
+// decodeGameLimits projects the caller's tier active-game caps (per kind, -1 = unlimited), or
+// undefined when absent (an old backend); the New-Game screen then applies no lock.
+function decodeGameLimits(p: fb.Profile): GameLimits | undefined {
+  const g = p.gameLimits();
+  if (!g) return undefined;
+  return { vsAi: g.vsAi(), random: g.random(), friends: g.friends() };
+}
+
 // decodeDictVersions reads the profile's per-variant current dictionary versions into a
 // variant-keyed map, so the offline preloader can look up the version for each enabled
 // variant. An entry with an unknown variant or empty version is skipped.
@@ -575,7 +586,6 @@ function decodeStateViewTable(v: fb.StateView): StateView {
     rack,
     bagLen: v.bagLen(),
     hintsRemaining: v.hintsRemaining(),
-    walletBalance: v.walletBalance(),
     hintUnlockLeftSeconds: v.hintUnlockLeftSeconds(),
   };
 }
@@ -1138,6 +1148,7 @@ function emptyGame(): GameView {
     vsAi: false,
     unreadChat: false,
     unreadMessages: false,
+    kind: 0,
     seats: [],
   };
 }

ui/src/lib/gamecache.test.ts

@@ -10,6 +10,7 @@ function gameView(id: string): GameView {
     vsAi: false,
     unreadChat: false,
     unreadMessages: false,
+    kind: 0,
     status: 'active',
     players: 2,
     toMove: 0,
@@ -23,7 +24,7 @@ function gameView(id: string): GameView {
 }
 
 function view(id: string, rack: string[] = ['A', 'B']): StateView {
-  return { game: gameView(id), seat: 0, rack, bagLen: 50, hintsRemaining: 1, walletBalance: 0 };
+  return { game: gameView(id), seat: 0, rack, bagLen: 50, hintsRemaining: 1 };
 }
 
 function move(player: number): MoveRecord {

ui/src/lib/gamedelta.test.ts

@@ -11,6 +11,7 @@ function gameView(moveCount: number, over = false): GameView {
     vsAi: false,
     unreadChat: false,
     unreadMessages: false,
+    kind: 0,
     status: over ? 'finished' : 'active',
     players: 2,
     toMove: 1,
@@ -28,7 +29,7 @@ function move(player: number): MoveRecord {
 }
 
 function cache(moveCount: number, seat = 0, over = false): CachedGame {
-  const view: StateView = { game: gameView(moveCount, over), seat, rack: ['a', 'b'], bagLen: 50, hintsRemaining: 1, walletBalance: 0 };
+  const view: StateView = { game: gameView(moveCount, over), seat, rack: ['a', 'b'], bagLen: 50, hintsRemaining: 1 };
   return { view, moves: [] };
 }
 
@@ -38,7 +39,7 @@ function delta(moveCount: number, player: number, bagLen = 47): MoveDelta {
 
 describe('seedInitialState', () => {
   it('wraps an initial view with an empty journal', () => {
-    const view: StateView = { game: gameView(0), seat: 1, rack: ['x'], bagLen: 80, hintsRemaining: 2, walletBalance: 0 };
+    const view: StateView = { game: gameView(0), seat: 1, rack: ['x'], bagLen: 80, hintsRemaining: 2 };
     expect(seedInitialState(view)).toEqual({ view, moves: [] });
   });
 });
@@ -153,12 +154,12 @@ describe('applyOpponentJoined', () => {
       { seat: 0, accountId: 'me', displayName: 'Me', score: 0, hintsUsed: 0, isWinner: false },
       { seat: 1, accountId: 'opp', displayName: 'Opp', score: 0, hintsUsed: 0, isWinner: false },
     ] };
-    return { game, seat: 0, rack: ['x'], bagLen: 90, hintsRemaining: 0, walletBalance: 0 };
+    return { game, seat: 0, rack: ['x'], bagLen: 90, hintsRemaining: 0 };
   }
 
   it("adopts the joined seats and status while preserving the cached rack and moves", () => {
     // The cached open game is still "searching": empty seats, status open, the starter's own rack.
-    const cached: CachedGame = { view: { game: { ...gameView(2), status: 'open', seats: [] }, seat: 0, rack: ['a', 'b'], bagLen: 50, hintsRemaining: 1, walletBalance: 0 }, moves: [move(0)] };
+    const cached: CachedGame = { view: { game: { ...gameView(2), status: 'open', seats: [] }, seat: 0, rack: ['a', 'b'], bagLen: 50, hintsRemaining: 1 }, moves: [move(0)] };
     const res = applyOpponentJoined(cached, joinedState());
     expect(res?.view.game.status).toBe('active');
     expect(res?.view.game.seats).toHaveLength(2);

ui/src/lib/gameimage.test.ts

@@ -14,6 +14,7 @@ function game(seats: Seat[], over = true): GameView {
     vsAi: false,
     unreadChat: false,
     unreadMessages: false,
+    kind: 0,
     status: over ? 'finished' : 'active',
     players: seats.length,
     toMove: 0,

ui/src/lib/gamelimits.test.ts

@@ -0,0 +1,85 @@
+import { describe, it, expect } from 'vitest';
+import { activeByKind, capFor, isKindLocked } from './gamelimits';
+import { GameKind, type GameView, type GameLimits } from './model';
+
+// game builds a minimal GameView for the count: only kind, status and (optionally) hotseat matter.
+function game(kind: number, status: string, extra: Partial<GameView> = {}): GameView {
+  return {
+    id: 'g',
+    variant: 'scrabble_en',
+    dictVersion: '',
+    status,
+    players: 2,
+    toMove: 0,
+    turnTimeoutSecs: 0,
+    multipleWordsPerTurn: true,
+    moveCount: 0,
+    endReason: '',
+    lastActivityUnix: 0,
+    vsAi: false,
+    unreadChat: false,
+    unreadMessages: false,
+    kind,
+    seats: [],
+    ...extra,
+  };
+}
+
+describe('activeByKind', () => {
+  it('counts open+active games per kind, skipping finished, hotseat and untagged (kind 0)', () => {
+    const by = activeByKind([
+      game(GameKind.vsAi, 'active'),
+      game(GameKind.random, 'open'),
+      game(GameKind.random, 'active'),
+      game(GameKind.random, 'finished'), // finished → not counted
+      game(GameKind.vsAi, 'active', { hotseat: true }), // local pass-and-play → not counted
+      game(0, 'active'), // pre-existing / untagged → not counted
+    ]);
+    expect(by[GameKind.vsAi]).toBe(1);
+    expect(by[GameKind.random]).toBe(2);
+  });
+});
+
+describe('capFor', () => {
+  const limits: GameLimits = { vsAi: 1, random: 10, friends: 0 };
+  it('maps each kind to its tier cap; unknown kind and absent limits are unlimited (-1)', () => {
+    expect(capFor(limits, GameKind.vsAi)).toBe(1);
+    expect(capFor(limits, GameKind.random)).toBe(10);
+    expect(capFor(limits, GameKind.friends)).toBe(0);
+    expect(capFor(limits, 0)).toBe(-1);
+    expect(capFor(undefined, GameKind.vsAi)).toBe(-1);
+  });
+});
+
+describe('isKindLocked', () => {
+  const guest: GameLimits = { vsAi: 1, random: 1, friends: 0 };
+  const durable: GameLimits = { vsAi: 10, random: 10, friends: 10 };
+
+  it('locks a guest at the per-kind cap, not another kind', () => {
+    const games = [game(GameKind.vsAi, 'active')];
+    expect(isKindLocked(games, guest, GameKind.vsAi)).toBe(true);
+    expect(isKindLocked(games, guest, GameKind.random)).toBe(false);
+  });
+
+  it('a cap of 0 always locks (a guest cannot start friend games)', () => {
+    expect(isKindLocked([], guest, GameKind.friends)).toBe(true);
+  });
+
+  it('an unlimited cap (-1) or absent limits never lock', () => {
+    const many = [game(GameKind.random, 'active'), game(GameKind.random, 'active')];
+    expect(isKindLocked(many, { vsAi: -1, random: -1, friends: -1 }, GameKind.random)).toBe(false);
+    expect(isKindLocked(many, undefined, GameKind.random)).toBe(false);
+  });
+
+  it('a durable account stays well under its higher cap', () => {
+    expect(isKindLocked([game(GameKind.random, 'active')], durable, GameKind.random)).toBe(false);
+  });
+
+  it('locks only the reached kind: at the vs_ai cap, random with no games stays open', () => {
+    const limits = { vsAi: 3, random: 2, friends: 1 };
+    const games = [game(GameKind.vsAi, 'active'), game(GameKind.vsAi, 'active'), game(GameKind.vsAi, 'active')];
+    expect(isKindLocked(games, limits, GameKind.vsAi)).toBe(true);
+    expect(isKindLocked(games, limits, GameKind.random)).toBe(false);
+    expect(isKindLocked(games, limits, GameKind.friends)).toBe(false);
+  });
+});

ui/src/lib/gamelimits.ts

@@ -0,0 +1,50 @@
+// Client-side active-game limit logic: count the caller's active games per kind and test a kind
+// against the caller's per-tier cap so the New-Game screen can lock a capped start. The server is
+// the source of truth (it refuses a capped create); this only drives the pre-emptive UI lock. Kept
+// pure (no DOM / stores) so it unit-tests in the node environment.
+
+import { GameKind, type GameLimits, type GameView } from './model';
+
+/**
+ * activeByKind counts the caller's active (status open or in-progress) games per kind. Finished
+ * games, local pass-and-play (hotseat) games and untagged games (kind 0, pre-existing) do not
+ * count — matching the server's per-kind cap, which is keyed on games.game_kind for open/active
+ * games only.
+ */
+export function activeByKind(games: GameView[]): Record<number, number> {
+  const out: Record<number, number> = {};
+  for (const g of games) {
+    if (g.hotseat) continue;
+    if (g.kind === 0) continue;
+    if (g.status !== 'active' && g.status !== 'open') continue;
+    out[g.kind] = (out[g.kind] ?? 0) + 1;
+  }
+  return out;
+}
+
+/** capFor returns the caller's tier cap for a kind (-1 = unlimited), or -1 when the limits are
+ *  absent (an old backend) — the lock then never applies. */
+export function capFor(limits: GameLimits | undefined, kind: number): number {
+  if (!limits) return -1;
+  switch (kind) {
+    case GameKind.vsAi:
+      return limits.vsAi;
+    case GameKind.random:
+      return limits.random;
+    case GameKind.friends:
+      return limits.friends;
+    default:
+      return -1;
+  }
+}
+
+/**
+ * isKindLocked reports whether the caller has reached its cap for kind, so the New-Game start for
+ * that kind is locked. An unlimited cap (-1) or absent limits never lock; a cap of 0 always locks
+ * (the kind is disabled for the tier).
+ */
+export function isKindLocked(games: GameView[], limits: GameLimits | undefined, kind: number): boolean {
+  const cap = capFor(limits, kind);
+  if (cap < 0) return false;
+  return (activeByKind(games)[kind] ?? 0) >= cap;
+}

ui/src/lib/gateway.ts

@@ -39,7 +39,7 @@ if (isMock && typeof window !== 'undefined') {
         joinOpponent(): void;
         joinOpponentSilently(): void;
         adminReply(): void;
-        setGameLimit(v: boolean): void;
+        setGameLimits(l: { vsAi: number; random: number; friends: number }): void;
         clearEmail(): void;
         confirmEmailOutOfBand(email: string): void;
         setLocalSeed(seed: string): void;
@@ -49,7 +49,7 @@ if (isMock && typeof window !== 'undefined') {
     joinOpponent: () => (gateway as MockGateway).joinPendingOpponent(),
     joinOpponentSilently: () => (gateway as MockGateway).joinPendingOpponentSilently(),
     adminReply: () => (gateway as MockGateway).mockAdminReply(),
-    setGameLimit: (v: boolean) => (gateway as MockGateway).setGameLimit(v),
+    setGameLimits: (l: { vsAi: number; random: number; friends: number }) => (gateway as MockGateway).setGameLimits(l),
     clearEmail: () => (gateway as MockGateway).mockClearEmail(),
     confirmEmailOutOfBand: (email: string) => (gateway as MockGateway).mockConfirmEmailOutOfBand(email),
     // Pin the next local game's bag seed, so the offline e2e deals a known rack (a bigint as a

ui/src/lib/hints.test.ts

@@ -1,33 +1,31 @@
 import { describe, expect, it } from 'vitest';
 import { hintsLeft, hintGateRemainingMs, hintLockMinutes } from './hints';
 
-// view carries only the two fields hintsLeft reads.
+// view carries only the field hintsLeft reads (the per-game allowance).
-const view = (hintsRemaining: number, walletBalance: number) => ({ hintsRemaining, walletBalance });
+const view = (hintsRemaining: number) => ({ hintsRemaining });
 
 describe('hintsLeft', () => {
   it('is zero without a view', () => {
     expect(hintsLeft(null, 5)).toBe(0);
   });
 
-  it('adds the per-game allowance to the live wallet (fresh view)', () => {
+  it('adds the per-game allowance to the live wallet', () => {
-    // hints_remaining 4 = allowance 1 + wallet 3; live wallet matches the snapshot → 1 + 3.
+    expect(hintsLeft(view(1), 3)).toBe(4); // allowance 1 + wallet 3
-    expect(hintsLeft(view(4, 3), 3)).toBe(4);
   });
 
-  it('reflects the LIVE wallet, not the per-game snapshot (the staleness fix)', () => {
+  it('reflects the LIVE wallet, not the view (the staleness fix)', () => {
-    // The view was fetched when the wallet was 3 (allowance 1), but a wallet hint was since spent
+    // A wallet hint spent in another game since this view was fetched → the live wallet is 2, so the
-    // in another game, so the live wallet is 2: the count must drop to 1 + 2 = 3, not stay at 4.
+    // count is 1 + 2 = 3. The wallet is always passed live (from the profile), never read off the view.
-    expect(hintsLeft(view(4, 3), 2)).toBe(3);
+    expect(hintsLeft(view(1), 2)).toBe(3);
   });
 
   it('shows just the wallet when the per-game allowance is used up', () => {
-    // allowance 0 (hints_remaining 3 == snapshot wallet 3); live wallet 3 → 0 + 3.
+    expect(hintsLeft(view(0), 3)).toBe(3); // allowance 0 + wallet 3
-    expect(hintsLeft(view(3, 3), 3)).toBe(3);
   });
 
-  it('clamps a non-negative allowance and wallet', () => {
+  it('clamps negatives', () => {
-    expect(hintsLeft(view(2, 3), 0)).toBe(0);
+    expect(hintsLeft(view(1), -5)).toBe(1); // a negative wallet clamps to 0
-    expect(hintsLeft(view(1, 0), -5)).toBe(1);
+    expect(hintsLeft(view(-2), 3)).toBe(3); // a negative allowance clamps to 0
   });
 });
 

ui/src/lib/hints.ts

@@ -1,28 +1,23 @@
 // Hint-count derivation, kept out of the .svelte component so it is unit-testable.
 //
-// The badge shows the per-game hint allowance remaining plus the player's global hint
+// The badge shows the per-game hint allowance remaining plus the player's global hint wallet. The
-// wallet. The server's hints_remaining folds the two together, but the wallet is global —
+// view's hints_remaining is the per-game allowance alone; the wallet is global (shared across every
-// shared across every game — so caching the combined number per game makes it go stale the
+// game) and read live from the profile (payments), never the per-game snapshot — so a wallet hint
-// moment a wallet hint is spent in another game. We therefore split it: the per-game
+// spent in another game stays reflected here.
-// allowance is hints_remaining - wallet_balance (both from the same fetch, so it is stable
-// and cacheable), and the wallet is read live from the global profile, never the per-game
-// snapshot.
 
 import type { StateView } from './model';
 
 /**
- * hintsLeft is the hint count for the badge: the per-game allowance remaining (the view's
+ * hintsLeft is the hint count for the badge: the per-game allowance remaining (view.hintsRemaining)
- * hints_remaining minus the wallet snapshot baked into that same view) plus the live global
+ * plus the live global wallet balance (passed in from the profile, so it stays correct when a wallet
- * wallet balance. Passing the live wallet (not view.walletBalance) is what keeps the count
+ * hint was spent in another game since this view was fetched).
- * correct when a wallet hint was spent in another game since this view was fetched.
  */
 export function hintsLeft(
-  view: Pick<StateView, 'hintsRemaining' | 'walletBalance'> | null,
+  view: Pick<StateView, 'hintsRemaining'> | null,
   walletBalance: number,
 ): number {
   if (!view) return 0;
-  const allowance = Math.max(0, view.hintsRemaining - view.walletBalance);
+  return Math.max(0, view.hintsRemaining) + Math.max(0, walletBalance);
-  return allowance + Math.max(0, walletBalance);
 }
 
 /** HINT_GATE_MS is the idle time a vs_ai player must be stuck on a turn before a hint unlocks. */

ui/src/lib/i18n/en.ts

@@ -379,6 +379,11 @@ export const en = {
   'new.multipleWordsPerTurn': 'Multiple words per turn',
   'new.start': 'Start game',
   'new.invited': 'Invitation sent.',
+  'new.limitGuestTitle': 'More games?',
+  'new.limitGuestBody': 'Sign in or create an account to use all the game features.',
+  'new.limitDurableTitle': 'Game limit',
+  'new.limitDurableBody': 'You have reached the limit. Finish your active games to start a new one.',
+  'new.limitLogin': 'Sign in',
   'new.noFriends': 'Add friends first to invite them.',
   'new.opponentAI': 'AI',
   'new.opponentRandom': 'Random player',

ui/src/lib/i18n/ru.ts

@@ -379,6 +379,11 @@ export const ru: Record<MessageKey, string> = {
   'new.multipleWordsPerTurn': 'Несколько слов за ход',
   'new.start': 'Начать игру',
   'new.invited': 'Приглашение отправлено.',
+  'new.limitGuestTitle': 'Больше партий?',
+  'new.limitGuestBody': 'Войдите или создайте учётную запись, чтобы воспользоваться всеми функциями игры.',
+  'new.limitDurableTitle': 'Лимит игр',
+  'new.limitDurableBody': 'Вы достигли лимита. Доиграйте активные партии, чтобы начать новую.',
+  'new.limitLogin': 'Вход',
   'new.noFriends': 'Сначала добавьте друзей, чтобы пригласить их.',
   'new.opponentAI': 'ИИ',
   'new.opponentRandom': 'Случайный игрок',

ui/src/lib/lobbycache.test.ts

@@ -27,6 +27,7 @@ function gameView(id: string, status: GameView['status'] = 'active', toMove = 0)
     vsAi: false,
     unreadChat: false,
     unreadMessages: false,
+    kind: 0,
     status,
     players: 2,
     toMove,
@@ -43,7 +44,7 @@ beforeEach(() => clearLobby());
 
 describe('patchLobbyGame', () => {
   it('replaces the matching game by id and leaves the others untouched', () => {
-    setLobby({ games: [gameView('a', 'active', 0), gameView('b', 'active', 0)], invitations: [], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games: [gameView('a', 'active', 0), gameView('b', 'active', 0)], invitations: [], incoming: [], offline: false });
     // The player's own move flipped game "a" to the opponent's turn.
     patchLobbyGame(gameView('a', 'active', 1));
     const snap = getLobby(false);
@@ -54,14 +55,14 @@ describe('patchLobbyGame', () => {
 
   it('preserves invitations and incoming when patching a game', () => {
     const incoming: AccountRef[] = [{ accountId: 'u9', displayName: 'Nine' }];
-    setLobby({ games: [gameView('a')], invitations: [], incoming, atGameLimit: false, offline: false });
+    setLobby({ games: [gameView('a')], invitations: [], incoming, offline: false });
     patchLobbyGame(gameView('a', 'finished'));
     expect(getLobby(false)?.incoming).toEqual(incoming);
     expect(getLobby(false)?.games[0].status).toBe('finished');
   });
 
   it('adds the game when it is not yet in the cached lobby (a game started elsewhere)', () => {
-    setLobby({ games: [gameView('a')], invitations: [], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games: [gameView('a')], invitations: [], incoming: [], offline: false });
     patchLobbyGame(gameView('z', 'active'));
     // Order is irrelevant — the lobby re-groups and re-sorts on render — so assert membership.
     expect(getLobby(false)?.games.map((g) => g.id).sort()).toEqual(['a', 'z']);
@@ -74,29 +75,21 @@ describe('patchLobbyGame', () => {
 
   it('does not mutate the previous snapshot array', () => {
     const games = [gameView('a', 'active', 0)];
-    setLobby({ games, invitations: [], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games, invitations: [], incoming: [], offline: false });
     patchLobbyGame(gameView('a', 'active', 1));
     expect(games[0].toMove).toBe(0); // the original array/object is left intact
   });
-
-  it('preserves the at-game-limit flag across a game patch', () => {
-    // A finished-game patch arriving while the lobby is unmounted must not drop the flag —
-    // the lobby renders the "New Game" button from the cached snapshot before the refresh.
-    setLobby({ games: [gameView('a')], invitations: [], incoming: [], atGameLimit: true, offline: false });
-    patchLobbyGame(gameView('a', 'finished'));
-    expect(getLobby(false)?.atGameLimit).toBe(true);
-  });
 });
 
 describe('patchLobbyInvitation', () => {
   it('adds a new pending invitation to the cached lobby', () => {
-    setLobby({ games: [], invitations: [], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games: [], invitations: [], incoming: [], offline: false });
     patchLobbyInvitation(invitation('i1', 'pending'));
     expect(getLobby(false)?.invitations.map((x) => x.id)).toEqual(['i1']);
   });
 
   it('replaces a pending invitation already in the list (e.g. an updated response)', () => {
-    setLobby({ games: [], invitations: [invitation('i1', 'pending'), invitation('i2', 'pending')], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games: [], invitations: [invitation('i1', 'pending'), invitation('i2', 'pending')], incoming: [], offline: false });
     const updated = { ...invitation('i1', 'pending'), turnTimeoutSecs: 999 };
     patchLobbyInvitation(updated);
     expect(getLobby(false)?.invitations.map((x) => x.id)).toEqual(['i1', 'i2']);
@@ -105,14 +98,14 @@ describe('patchLobbyInvitation', () => {
 
   it('removes an invitation that reached a terminal status', () => {
     for (const terminal of ['declined', 'cancelled', 'started', 'expired']) {
-      setLobby({ games: [], invitations: [invitation('i1', 'pending'), invitation('i2', 'pending')], incoming: [], atGameLimit: false, offline: false });
+      setLobby({ games: [], invitations: [invitation('i1', 'pending'), invitation('i2', 'pending')], incoming: [], offline: false });
       patchLobbyInvitation(invitation('i1', terminal));
       expect(getLobby(false)?.invitations.map((x) => x.id)).toEqual(['i2']);
     }
   });
 
   it('is a no-op for a terminal invitation that is not in the list', () => {
-    setLobby({ games: [], invitations: [invitation('i2', 'pending')], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games: [], invitations: [invitation('i2', 'pending')], incoming: [], offline: false });
     patchLobbyInvitation(invitation('i1', 'declined'));
     expect(getLobby(false)?.invitations.map((x) => x.id)).toEqual(['i2']);
   });
@@ -124,7 +117,7 @@ describe('patchLobbyInvitation', () => {
 
   it('preserves games and incoming when patching an invitation', () => {
     const incoming: AccountRef[] = [{ accountId: 'u9', displayName: 'Nine' }];
-    setLobby({ games: [gameView('g1')], invitations: [], incoming, atGameLimit: false, offline: false });
+    setLobby({ games: [gameView('g1')], invitations: [], incoming, offline: false });
     patchLobbyInvitation(invitation('i1', 'pending'));
     expect(getLobby(false)?.games.map((g) => g.id)).toEqual(['g1']);
     expect(getLobby(false)?.incoming).toEqual(incoming);
@@ -133,15 +126,15 @@ describe('patchLobbyInvitation', () => {
 
 describe('getLobby is mode-aware (a mode flip must not render the other mode’s games)', () => {
   it('returns the snapshot only for the mode it was stored under', () => {
-    setLobby({ games: [gameView('online1')], invitations: [], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games: [gameView('online1')], invitations: [], incoming: [], offline: false });
     expect(getLobby(false)?.games.map((g) => g.id)).toEqual(['online1']);
     // Reading it as the OTHER (offline) mode must not surface the online snapshot.
     expect(getLobby(true)).toBeNull();
   });
 
   it('replaces the snapshot when the mode changes, so the stale mode is dropped', () => {
-    setLobby({ games: [gameView('online1')], invitations: [], incoming: [], atGameLimit: false, offline: false });
+    setLobby({ games: [gameView('online1')], invitations: [], incoming: [], offline: false });
-    setLobby({ games: [gameView('local1')], invitations: [], incoming: [], atGameLimit: false, offline: true });
+    setLobby({ games: [gameView('local1')], invitations: [], incoming: [], offline: true });
     expect(getLobby(false)).toBeNull();
     expect(getLobby(true)?.games.map((g) => g.id)).toEqual(['local1']);
   });

ui/src/lib/lobbycache.ts

@@ -10,9 +10,6 @@ interface LobbySnapshot {
   games: GameView[];
   invitations: Invitation[];
   incoming: AccountRef[];
-  // atGameLimit rides the snapshot so the lobby renders the "New Game" button in its last
-  // known enabled/disabled state instantly (no flicker), then refreshes it in the background.
-  atGameLimit: boolean;
   // Which mode the snapshot belongs to (offline = device-local games, online = server games). The
   // lobby renders it instantly only when it matches the current mode, so a mode flip never flashes —
   // or lets the player open — the other mode's games before the background refresh replaces them.

ui/src/lib/lobbysort.test.ts

@@ -20,6 +20,7 @@ function game(id: string, status: GameView['status'], toMove: number, lastActivi
     vsAi: false,
     unreadChat: false,
     unreadMessages: false,
+    kind: 0,
     status,
     players: 2,
     toMove,

ui/src/lib/localgame/source.ts

@@ -435,7 +435,6 @@ export class LocalSource implements GameLoopSource {
       rack,
       bagLen: entry.game.bagLength,
       hintsRemaining: 1,
-      walletBalance: 0,
       hintUnlockLeftSeconds: this.hintUnlockLeft(entry),
       locked,
     };
@@ -482,6 +481,7 @@ export class LocalSource implements GameLoopSource {
       hotseat: !!record.hotseat,
       unreadChat: false,
       unreadMessages: false,
+      kind: 0,
       seats,
     };
   }

ui/src/lib/mock/client.ts

@@ -33,6 +33,7 @@ import type {
   MoveResult,
   OutgoingList,
   Profile,
+  GameLimits,
   ProfileUpdate,
   PushEvent,
   Session,
@@ -105,8 +106,6 @@ export class MockGateway implements GatewayClient {
   private feedbackReplyUnread = false;
   // The most recently opened auto-match game still awaiting an opponent, for the e2e join hook.
   private openGameId: string | null = null;
-  // gameLimit forces the lobby's at_game_limit flag for the e2e (window.__mock.setGameLimit).
-  private gameLimit = false;
   private friends: AccountRef[] = MOCK_FRIENDS.map((f) => ({ ...f }));
   private incoming: AccountRef[] = MOCK_INCOMING.map((f) => ({ ...f }));
   private outgoing: AccountRef[] = [];
@@ -267,7 +266,7 @@ export class MockGateway implements GatewayClient {
   async gamesList(): Promise<GameList> {
     return {
       games: [...this.games.values()].map((g) => structuredClone(g.view)),
-      atGameLimit: this.gameLimit,
+      atGameLimit: false,
     };
   }
 
@@ -293,6 +292,7 @@ export class MockGateway implements GatewayClient {
           vsAi: true,
           unreadChat: false,
           unreadMessages: false,
+          kind: 1,
           seats: [
             { seat: 0, accountId: ME, displayName: 'You', score: 0, hintsUsed: 0, isWinner: false },
             { seat: 1, accountId: 'robot', displayName: 'Robot', score: 0, hintsUsed: 0, isWinner: false },
@@ -326,6 +326,7 @@ export class MockGateway implements GatewayClient {
         vsAi: false,
         unreadChat: false,
         unreadMessages: false,
+        kind: 2,
         seats: [
           { seat: 0, accountId: ME, displayName: 'You', score: 0, hintsUsed: 0, isWinner: false },
           { seat: 1, accountId: '', displayName: '', score: 0, hintsUsed: 0, isWinner: false },
@@ -377,13 +378,13 @@ export class MockGateway implements GatewayClient {
     if (this.openGameId) this.seatOpponent(this.openGameId);
   }
 
-  // setGameLimit forces the lobby's at_game_limit flag (the e2e hook
+  // setGameLimits overrides the profile's per-kind active-game caps (the e2e hook
-  // window.__mock.setGameLimit), then nudges the lobby to re-fetch games.list so the
+  // window.__mock.setGameLimits), then emits a profile notify so the app re-fetches the profile and
-  // "New Game" button and the notice update in place. The lobby refetches on any
+  // the New-Game screen's per-kind lock recomputes in place — the same path a guest→durable upgrade
-  // non-heartbeat event; an unrecognised notify sub triggers only that refetch.
+  // takes to lift the lock.
-  setGameLimit(v: boolean): void {
+  setGameLimits(l: GameLimits): void {
-    this.gameLimit = v;
+    this.profile.gameLimits = { ...l };
-    this.emit({ kind: 'notify', sub: 'game_limit' });
+    this.emit({ kind: 'notify', sub: 'profile' });
   }
 
   async lobbyPoll(): Promise<MatchResult> {
@@ -408,10 +409,9 @@ export class MockGateway implements GatewayClient {
       seat: this.mySeat(g),
       rack: [...g.rack],
       bagLen: g.bagLen,
-      // g.hintsRemaining is the per-game allowance; the wallet is the shared profile balance.
+      // hintsRemaining is the per-game allowance alone; the wallet lives on the profile and the
-      // hints_remaining folds the two together (as the backend does), walletBalance is the wallet.
+      // client adds it (lib/hints).
-      hintsRemaining: g.hintsRemaining + this.profile.hintBalance,
+      hintsRemaining: g.hintsRemaining,
-      walletBalance: this.profile.hintBalance,
     };
   }
 
@@ -530,7 +530,7 @@ export class MockGateway implements GatewayClient {
         score: valueForLetter(g.view.variant, letter),
         total: 0,
       },
-      hintsRemaining: g.hintsRemaining + this.profile.hintBalance,
+      hintsRemaining: g.hintsRemaining,
       walletBalance: this.profile.hintBalance,
     };
   }

ui/src/lib/mock/data.ts

@@ -47,6 +47,9 @@ export const PROFILE: Profile = {
   dictVersions: { erudit_ru: 'v1.3.0', scrabble_ru: 'v1.3.0', scrabble_en: 'v1.3.0' },
   // Post-move interstitial config (short cooldowns so the mock stub is exercisable); not suppressed.
   ads: { cooldownGlobalS: 300, cooldownVsAiS: 1800, cooldownHintS: 60, suppressed: false },
+  // The durable tier's per-kind active-game caps (the seeded defaults); the e2e lowers them through
+  // window.__mock.setGameLimits to exercise the New-Game lock.
+  gameLimits: { vsAi: 10, random: 10, friends: 10 },
 };
 
 // Seed social/account data for the mock (pnpm start + Playwright). The mock profile
@@ -189,6 +192,7 @@ function activeGame(): MockGame {
       vsAi: false,
       unreadChat: false,
       unreadMessages: false,
+      kind: 2,
       status: 'active',
       players: 2,
       toMove: 0,
@@ -227,6 +231,7 @@ function finishedG2(): MockGame {
       vsAi: false,
       unreadChat: false,
       unreadMessages: false,
+      kind: 2,
       status: 'finished',
       players: 2,
       toMove: 0,
@@ -266,6 +271,7 @@ function finishedG3(): MockGame {
       vsAi: false,
       unreadChat: false,
       unreadMessages: false,
+      kind: 2,
       status: 'finished',
       players: 2,
       toMove: 0,

ui/src/lib/model.ts

@@ -62,6 +62,11 @@ export interface GameView {
    *  badge can be coloured apart from the nudge-only case. Same REST-seeded lifecycle as
    *  unreadChat; the live-event GameView leaves it false. */
   unreadMessages: boolean;
+  /** The game's origin for the active-game limits: 0 unknown (a pre-existing game, never gated),
+   *  1 vs_ai, 2 random, 3 friends. The lobby counts active games per kind against the caller's
+   *  per-kind limits (Profile.gameLimits) to lock a capped New-Game start. Local/offline games
+   *  leave it 0 (they never count toward the online limits). */
+  kind: number;
   seats: Seat[];
 }
 
@@ -78,17 +83,14 @@ export interface MoveRecord {
   total: number;
 }
 
-/** A seated player's private view of a game. hintsRemaining folds the per-game allowance
+/** A seated player's private view of a game. hintsRemaining is the per-game allowance alone; the
- *  together with the global wallet; walletBalance is the wallet alone, so the client can
+ *  purchasable hint wallet lives on the profile (payments), and the client adds it (see lib/hints). */
- *  derive the per-game allowance (hintsRemaining - walletBalance) and keep the wallet live
- *  across games (see lib/hints). */
 export interface StateView {
   game: GameView;
   seat: number;
   rack: string[];
   bagLen: number;
   hintsRemaining: number;
-  walletBalance: number;
   /** For a vs_ai game, the seconds until the idle hint unlocks (computed by the source: the SERVER
    *  clock online, the device clock offline) — 0/undefined while open (the human's first move, or a
    *  non-vs_ai game). The client anchors a MONOTONIC countdown (performance.now()) to it on receipt,
@@ -237,6 +239,21 @@ export interface Profile {
    *  offline-capable PWA reads it to preload the matching dawg for each enabled variant off
    *  this cold-start response. Empty only in a degenerate deployment with no resident dictionary. */
   dictVersions: Partial<Record<Variant, string>>;
+  /** The caller's tier active-game caps per kind (-1 = unlimited); the New-Game screen counts the
+   *  player's active games per kind from the lobby and locks a capped start. Absent from an old
+   *  backend (then no lock applies). */
+  gameLimits?: GameLimits;
+}
+
+/** GameKind labels the game_kind wire values for the active-game limits. */
+export const GameKind = { vsAi: 1, random: 2, friends: 3 } as const;
+
+/** The caller's tier active-game caps per kind (-1 = unlimited), resolved to the guest or durable
+ *  tier server-side. The New-Game screen locks a start whose kind is at its cap. */
+export interface GameLimits {
+  vsAi: number;
+  random: number;
+  friends: number;
 }
 
 /** The post-move interstitial-ad config for the client-mirrored gate: the cooldowns (seconds) and

ui/src/lib/nativedialogs.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { BOT_BUTTON_ID, botInfoPopup } from './nativedialogs';
+import { BOT_BUTTON_ID, LOGIN_BUTTON_ID, botInfoPopup, gameLimitGuestPopup, gameLimitDurablePopup } from './nativedialogs';
 
 describe('botInfoPopup', () => {
   it('inlines the bot handle and adds an open-bot button', () => {
@@ -23,3 +23,22 @@ describe('botInfoPopup', () => {
     expect(p.message).toBe('Welcome!\n\nUse @b now.');
   });
 });
+
+describe('gameLimitGuestPopup', () => {
+  it('offers a cancel and a login button (the sign-in funnel)', () => {
+    const p = gameLimitGuestPopup('More games?', 'Sign in to play more.', 'Cancel', 'Sign in');
+    expect(p.title).toBe('More games?');
+    expect(p.message).toBe('Sign in to play more.');
+    expect(p.buttons).toEqual([
+      { id: 'cancel', text: 'Cancel' },
+      { id: LOGIN_BUTTON_ID, text: 'Sign in' },
+    ]);
+  });
+});
+
+describe('gameLimitDurablePopup', () => {
+  it('is an OK-only notice', () => {
+    const p = gameLimitDurablePopup('Game limit', 'Finish a current game first.', 'OK');
+    expect(p.buttons).toEqual([{ id: 'ok', text: 'OK' }]);
+  });
+});